openclaw-master-skills Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

openclaw-master-skills is an AI agent skill, created by ckllyswin and published at ckllyswin/openclaw-master-skills-. ClawSecure audited openclaw-master-skills across 76 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 60/100 (Medium Risk). The 7 findings concentrate in Code Injection, Command Injection and Obfuscation, including Potentially dangerous code pattern detected: curl.*\|.*sh and Potentially dangerous code pattern detected: exec\(. 2 were rated high or critical severity.

Is openclaw-master-skills safe?

ClawSecure audited openclaw-master-skills and assigned a security score of 60/100 (Medium Risk), identifying 7 findings across Code Injection and Command Injection. Review the findings below before installing.

What did ClawSecure find in openclaw-master-skills?

ClawSecure identified 7 findings in openclaw-master-skills, concentrated in Code Injection, Command Injection and Obfuscation. 2 were rated high or critical severity. The most severe include Potentially dangerous code pattern detected: curl.*\|.*sh and Potentially dangerous code pattern detected: exec\(.

How was openclaw-master-skills audited?

ClawSecure ran openclaw-master-skills through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 76 files from ckllyswin/openclaw-master-skills-.

What does a score of 60 mean?

ClawSecure assigned openclaw-master-skills a security score of 60/100, placing it in the Medium Risk range. This reflects 7 findings led by Code Injection that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for openclaw-master-skills

ClawSecure detected 7 security findings in openclaw-master-skills, spanning Code Injection, Command Injection, Obfuscation and Permissions Manifest.

high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in collect.sh.
high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in generator_template.js.
medium · Variable $remote_url (line 292) flows to `sh` at line 293.. Command Injection finding detected in scripts/collect.sh:293.
medium · Variable $count (line 310) flows to `sh` at line 315.. Command Injection finding detected in scripts/collect.sh:315.
medium · File 'SKILL.md' extension (.md) suggests one format but…. Obfuscation finding detected in skills/architecture-blueprint-generator/SKILL.md.
medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
info · Missing License Declaration. Policy Violation finding detected in SKILL.md.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for openclaw-master-skills

Eliminate dynamic code execution

openclaw-master-skills evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.

Harden command execution

openclaw-master-skills constructs or runs system commands. Validate that commands are built only from trusted inputs, never pass user-controlled strings directly to a shell, and restrict execution to an allow-list of expected commands.

Review obfuscated or hidden code

openclaw-master-skills contains obfuscated or hidden content that resists review. Inspect encoded, minified or hidden files to confirm they are not concealing unexpected behavior before installing.

Related Security Research

Why Generic Scanners Fail at AI Agent Security→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→

Related AI Agent Security Audits

tradingview-mcpScore 55/100 jiraScore 50/100 playwright-best-practicesScore 63/100 neckr0ik-polymarket-traderScore 55/100 ai-trading-claude-mainScore 70/100

Scanned on March 5, 2026. openclaw-master-skills is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan