Installed Skill Auditor

What it does

skill-vetting scans before install. installed-skill-auditor scans after — continuously.

Skills can be modified after installation. A community skill that was safe on Monday can be compromised by Tuesday if the source repo is pushed to and your agent auto-pulls. This skill runs weekly to catch post-install drift: injected payloads, hardcoded credentials, and pattern changes that weren't there at install time.

It maintains a content hash of every skill file at the time it was first audited. On each weekly run it re-hashes and flags anything that changed unexpectedly.

When to invoke

Automatically, every Monday at 9am (cron)
Manually after any git pull that touches skill directories
After any agent action that writes to the skills tree

Audit checks

Check	What it detects
INJECTION	Instruction-override patterns in SKILL.md prose
CREDENTIAL	Hardcoded tokens, API keys, or secrets in any file
EXFILTRATION	URLs + data-sending patterns suggesting exfil
DRIFT	File content changed since last known-good baseline
ORPHAN	Skill directory present but not in install manifest

Severity: CRITICAL (INJECTION, EXFILTRATION) · HIGH (CREDENTIAL) · MEDIUM (DRIFT, ORPHAN)

Output

Installed Skill Audit — 2026-03-16
────────────────────────────────────────────
32 skills audited | 0 CRITICAL | 1 HIGH | 2 MEDIUM

HIGH     community/my-custom-skill — CREDENTIAL
         Hardcoded token pattern detected in run.py (line 14)

MEDIUM   community/expense-tracker — DRIFT
         SKILL.md hash changed since 2026-03-10 baseline
         Run: python3 audit.py --diff expense-tracker

How to use

python3 audit.py --scan                    # Full audit pass
python3 audit.py --scan --critical-only    # CRITICAL findings only
python3 audit.py --baseline                # Record current state as trusted
python3 audit.py --diff <skill-name>       # Show changed lines since baseline
python3 audit.py --resolve <skill-name>    # Mark finding resolved after review
python3 audit.py --status                  # Summary of last run
python3 audit.py --format json             # Machine-readable output

Procedure

Step 1 — Review the report

The cron run generates a report automatically. Open it via --status or check state. Any CRITICAL finding requires immediate action.

Step 2 — Triage by severity

CRITICAL: Do not run the skill. Inspect the file, remove or quarantine the skill.
HIGH: Rotate the exposed credential immediately; investigate how it got there.
MEDIUM (DRIFT): Use --diff to see what changed. If the change is expected (you updated the skill), run --baseline to accept it. If unexpected, treat as CRITICAL.
MEDIUM (ORPHAN): A skill directory exists with no install record. Either re-install through the vetting process or remove the directory.

Step 3 — Resolve or escalate

Run --resolve <skill-name> after reviewing a finding. This marks it acknowledged in state. Unresolved CRITICAL findings are surfaced again on next cron run.

Step 4 — Update baseline after intentional changes

When you intentionally update a skill (e.g., upgrading to a new version), run --baseline so future drift detection has an accurate reference point.

State

Results and content hashes stored in ~/.openclaw/skill-state/installed-skill-auditor/state.yaml.

Fields: last_audit_at, baselines (hash map), findings, audit_history.