Installed Skill Auditor

What it does

skill-vetting scans before install. installed-skill-auditor scans after — continuously.

Skills can be modified after installation. A community skill that was safe on Monday can be compromised by Tuesday if the source repo is pushed to and your agent auto-pulls. This skill runs weekly to catch post-install drift: injected payloads, hardcoded credentials, and pattern changes that weren't there at install time.

It maintains a content hash of every skill file at the time it was first audited. On each weekly run it re-hashes and flags anything that changed unexpectedly.

When to invoke

• Automatically, every Monday at 9am (cron)
• Manually after any git pull that touches skill directories
• After any agent action that writes to the skills tree

Audit checks

Check	What it detects
INJECTION	Instruction-override patterns in SKILL.md prose
CREDENTIAL	Hardcoded tokens, API keys, or secrets in any file
EXFILTRATION	URLs + data-sending patterns suggesting exfil
DRIFT	File content changed since last known-good baseline
ORPHAN	Skill directory present but not in install manifest

Severity: CRITICAL (INJECTION, EXFILTRATION) · HIGH (CREDENTIAL) · MEDIUM (DRIFT, ORPHAN)

Output

Installed Skill Audit — 2026-03-16
────────────────────────────────────────────
32 skills audited | 0 CRITICAL | 1 HIGH | 2 MEDIUM

HIGH     community/my-custom-skill — CREDENTIAL
         Hardcoded token pattern detected in run.py (line 14)

MEDIUM   community/expense-tracker — DRIFT
         SKILL.md hash changed since 2026-03-10 baseline
         Run: python3 audit.py --diff expense-tracker

How to use

python3 audit.py --scan                    # Full audit pass
python3 audit.py --scan --critical-only    # CRITICAL findings only
python3 audit.py --baseline                # Record current state as trusted
python3 audit.py --diff <skill-name>       # Show changed lines since baseline
python3 audit.py --resolve <skill-name>    # Mark finding resolved after review
python3 audit.py --status                  # Summary of last run
python3 audit.py --format json             # Machine-readable output

Procedure

Step 1 — Review the report

The cron run generates a report automatically. Open it via --status or check state. Any CRITICAL finding requires immediate action.

Step 2 — Triage by severity

• CRITICAL: Do not run the skill. Inspect the file, remove or quarantine the skill.
• HIGH: Rotate the exposed credential immediately; investigate how it got there.
• MEDIUM (DRIFT): Use --diff to see what changed. If the change is expected (you updated the skill), run --baseline to accept it. If unexpected, treat as CRITICAL.
• MEDIUM (ORPHAN): A skill directory exists with no install record. Either re-install through the vetting process or remove the directory.

Step 3 — Resolve or escalate

Run --resolve <skill-name> after reviewing a finding. This marks it acknowledged in state. Unresolved CRITICAL findings are surfaced again on next cron run.

Step 4 — Update baseline after intentional changes

When you intentionally update a skill (e.g., upgrading to a new version), run --baseline so future drift detection has an accurate reference point.

State

Results and content hashes stored in ~/.openclaw/skill-state/installed-skill-auditor/state.yaml.

Fields: last_audit_at, baselines (hash map), findings, audit_history.