Skill Security Audit — 2026-02-28
⚠️ Immediate Attention: NONE
No malicious or suspicious skills detected. All installed skills are clean.
Summary
- Total skills audited: 74 (52 npm-bundled + 22 workspace-installed)
- Clean: 74
- Suspicious: 0
- Malicious: 0
Threat Intelligence
Cross-referenced against ClawHavoc campaign (discovered Feb 2026):
- 341→1,184 malicious skills found on ClawHub marketplace
- Attack pattern: fake "Prerequisites" sections directing users to download AMOS (Atomic macOS Stealer) via password-protected ZIPs or obfuscated glot.io scripts
- IOC domains: glot.io snippets, app-distribution.net, IP 91.92.242.30
- Target categories: crypto/Solana wallets, Polymarket bots, YouTube tools, ClawHub typosquats
None of these IOCs or patterns were found in any installed skill.
Scan Results
NPM-Bundled Skills (~/.npm-global/lib/node_modules/openclaw/skills/)
| Skill | Status | Notes |
|---|---|---|
| 1password | ✅ Clean | |
| apple-notes | ✅ Clean | References pip install (legitimate) |
| apple-reminders | ✅ Clean | |
| bear-notes | ✅ Clean | |
| blogwatcher | ✅ Clean | |
| blucli | ✅ Clean | |
| bluebubbles | ✅ Clean | |
| camsnap | ✅ Clean | |
| canvas | ✅ Clean | References fetch (documentation only) |
| clawhub | ✅ Clean | |
| coding-agent | ✅ Clean | References npm install for pi agent (documented) |
| discord | ✅ Clean | |
| eightctl | ✅ Clean | |
| gemini | ✅ Clean | |
| gh-issues | ✅ Clean | |
| gifgrep | ✅ Clean | |
| github | ✅ Clean | |
| gog | ✅ Clean | |
| goplaces | ✅ Clean | |
| healthcheck | ✅ Clean | |
| himalaya | ✅ Clean | |
| imsg | ✅ Clean | |
| mcporter | ✅ Clean | |
| model-usage | ✅ Clean | |
| nano-banana-pro | ✅ Clean | base64 usage for image data (legitimate) |
| nano-pdf | ✅ Clean | |
| notion | ✅ Clean | |
| obsidian | ✅ Clean | |
| openai-image-gen | ✅ Clean | base64 for image decode (legitimate) |
| openai-whisper | ✅ Clean | |
| openai-whisper-api | ✅ Clean | curl for API calls (legitimate) |
| openhue | ✅ Clean | |
| oracle | ✅ Clean | |
| ordercli | ✅ Clean | |
| peekaboo | ✅ Clean | |
| sag | ✅ Clean | |
| session-logs | ✅ Clean | |
| sherpa-onnx-tts | ✅ Clean | |
| skill-creator | ✅ Clean | |
| slack | ✅ Clean | |
| songsee | ✅ Clean | |
| sonoscli | ✅ Clean | |
| spotify-player | ✅ Clean | |
| summarize | ✅ Clean | |
| things-mac | ✅ Clean | |
| tmux | ✅ Clean | |
| trello | ✅ Clean | |
| video-frames | ✅ Clean | |
| voice-call | ✅ Clean | |
| wacli | ✅ Clean | |
| weather | ✅ Clean | |
| xurl | ✅ Clean |
Workspace Skills (~/.openclaw/workspace/skills/)
| Skill | Status | Notes |
|---|---|---|
| agent-autonomy-kit | ✅ Clean | |
| api-gateway | ✅ Clean | |
| auto-updater | ✅ Clean | |
| automation-workflows | ✅ Clean | |
| blogwatcher | ✅ Clean | |
| deep-research-pro | ✅ Clean | |
| find-skills | ✅ Clean | |
| frontend-design | ✅ Clean | |
| github | ✅ Clean | |
| gmail | ✅ Clean | |
| home-assistant | ✅ Clean | curl for HA API (legitimate, uses HA_TOKEN) |
| humanizer | ✅ Clean | |
| mcporter | ✅ Clean | |
| n8n | ✅ Clean | Has Python scripts for n8n API (legitimate) |
| nano-banana-pro | ✅ Clean | |
| obsidian | ✅ Clean | |
| openai-whisper | ✅ Clean | |
| outlook-api | ✅ Clean | |
| self-improving-agent | ✅ Clean | References SOUL.md/AGENTS.md in documentation context only (suggests where to promote learnings) |
| summarize | ✅ Clean | |
| telegram | ✅ Clean | |
| youtube-watcher | ✅ Clean |
What Was Checked
- Malicious URLs/domains: grep for curl, wget, fetch to external domains — only legitimate API calls found
- System file tampering: grep for SOUL.md/MEMORY.md/AGENTS.md write/modify — only documentation references found (self-improving-agent suggests edits, doesn't perform them autonomously)
- Obfuscated code: grep for base64, eval, atob, encoded hex — only legitimate image processing (base64 decode of API image responses)
- Binary downloads: grep for npm install, pip install, chmod +x, /tmp — only documented tool installation instructions
- ClawHavoc IOCs: grep for glot.io, openclaw-agent, app-distribution.net, 91.92.242.30 — zero matches
- Typosquat names: checked for crypto/solana/phantom/polymarket/wallet/trading skill names — zero matches
Recommendations
- No immediate action needed — all skills are clean
- Consider pinning skill versions and reviewing diffs on updates (ClawHavoc has been expanding)
- The
auto-updaterskill auto-updates from ClawHub — monitor its update summaries for new skill installs from unknown authors - Re-run this audit periodically, especially after installing new skills from ClawHub