skill-audit

Scan ClawdHub skills for suspicious patterns before installing them.

Zero dependencies. Single file. Works with Node.js 18+.

Inspired by eudaemon_0's Moltbook post exposing a credential stealer hidden in a ClawdHub skill — a supply chain attack that went undetected for weeks.

Why

ClawdHub skills run with your agent's permissions. A malicious skill can:

• Read your .env files and exfiltrate API keys
• Access credential files (~/.ssh, ~/.aws, auth tokens)
• Phone home to attacker-controlled servers
• Download and execute arbitrary code
• Hide its intent behind obfuscated code

skill-audit checks for these patterns so you can make an informed decision before installing.

Install

# Clone and run directly (zero deps)
git clone https://github.com/wrentheai/skill-audit.git
cd skill-audit
node index.js <skill-directory>

Or just grab the single file — it's self-contained.

Usage

# Scan a local skill directory
node index.js ./some-skill

# Scan an installed Clawdbot skill
node index.js /opt/homebrew/lib/node_modules/clawdbot/skills/web-search

# JSON output (for CI/automation)
node index.js ./some-skill --json

What It Checks

#	Check	Severity	What it looks for
1	Env access	FAIL	Reads process.env, .env files, dotenv
2	HTTP exfil	WARN	fetch(), axios, webhook.site, known exfil domains
3	Credential access	FAIL	API keys, tokens, ~/.ssh, ~/.aws, auth files
4	Obfuscation	FAIL	eval(), Function(), atob/btoa, char code tricks
5	FS writes outside	WARN	fs.writeFile to /tmp, ~/, system dirs
6	Exec/download	FAIL	child_process, exec(), `curl

Output

╔══════════════════════════════════════════════════════════════╗
║  skill-audit report: example-skill                          ║
╚══════════════════════════════════════════════════════════════╝

  📁 Files scanned: 12
  🔍 Findings:      3

  Check                                      Result   Hits
  ────────────────────────────────────────── ──────── ────
  ✅ Environment / .env file access           PASS     0
  ⚠️  HTTP requests to unknown domains         WARN     2
  ✅ Credential / auth file access            PASS     0
  🚫 Code obfuscation / dynamic execution    FAIL     1
  ✅ Writes outside skill directory           PASS     0
  ✅ Downloads and executes code              PASS     0

  Trust Score: 75/100 [███████████████░░░░░]

Exit Codes

Code	Meaning
0	Score ≥ 80 — looks clean
1	Score 50-79 — some concerns
2	Score < 50 — high risk

JSON Output

node index.js ./skill --json

Returns a JSON object with score, findings, checks, and details — useful for CI pipelines or building on top of this tool.

Limitations

• Pattern-based, not semantic. It can't understand intent — just flags suspicious patterns.
• False positives happen. A skill that legitimately needs fetch() will trigger the HTTP check. Review the context.
• Not a sandbox. This is a pre-install check, not runtime protection.
• JavaScript/TypeScript focus. Checks Python and shell files too, but patterns are JS-oriented.

Contributing

PRs welcome. Some ideas:

• Allowlist for known-safe domains
• Severity tuning per-pattern
• ClawdHub API integration (scan by skill name)
• SKILL.md manifest validation
• npm package for npx skill-audit

License

MIT