• Before installing any third-party skill or plugin from a marketplace
• When reviewing skills downloaded from OpenClaw, ClawHub, or other registries
• Periodic audit of all installed skills and plugins
• When a skill requests unusual permissions or behaves unexpectedly

Load

references/security-rules.md

(relative to this file's directory) for detailed detection patterns, examples, and false positive guidance.

• If user specifies a directory path, scan all files in that directory recursively.
• If user says "scan installed", scan platform-specific skill directories:
  • Claude Code:

    ~/.claude/plugins/cache/

  • Cursor:

    ~/.cursor/extensions/

    and project

    .cursorrules

  • Windsurf:

    ~/.codeium/windsurf/

  • Other platforms: ask user for the directory path.
• If user provides a GitHub URL, use WebFetch to retrieve the repository content, or clone it locally.
• Scan these file types:

  .md

  ,

  .json

  ,

  .js

  ,

  .py

  ,

  .sh

  ,

  .ts

  ,

  .yaml

  ,

  .yml

• List all files found and confirm with user before proceeding.

Important: Do NOT dispatch this audit to a subagent (Task tool). Subagents run in a sandboxed environment that cannot read

~/.claude/plugins/cache/

or other system directories. Always run the audit in the main conversation context.

• Load

  references/security-rules.md

  (relative to this file's directory) for detailed detection patterns.
• Read each file using the Read tool.
• Check file content against all 9 categories (PI, DE, CE, OB, PA, SC, MP, TE, BM).
• For each finding, record: rule ID (e.g., PI-001), severity, file path and line number, description, and recommended action.
• Apply context-aware judgment — not every pattern match is a true positive.
• When a single code block triggers multiple rules, report each applicable rule separately. Cross-category overlap (e.g., OB + CE + PI on the same line) increases confidence that the finding is a true positive.
• Consider the skill's stated purpose when evaluating findings. A security auditing skill will naturally reference dangerous patterns.

• Calculate risk score using the scoring formula below.
• Output the structured report using the template below.
• For batch scans of multiple skills, output a summary table at the end.

• [PI-001] file.md:42 — Description of finding Risk: Why this is dangerous Action: Recommended response

• [OB-003] script.js:15 — Description of finding Risk: Why this is concerning Action: Recommended response

• [BM-002] SKILL.md:88 — Description of finding Risk: Why this is worth noting Action: Recommended response

• CRITICAL: N | WARNING: N | INFO: N
• Risk Score: X.X/10 — [Overall recommendation]

undefined

• Each CRITICAL finding: +2.0 points
• Each WARNING finding: +0.8 points
• Each INFO finding: +0.2 points
• Maximum score: 10.0

• 0.0–2.0: SAFE — No significant risks found.
• 2.1–5.0: RISKY — Manual review recommended before use.
• 5.1–8.0: DANGEROUS — Do not install.
• 8.1–10.0: MALICIOUS — Confirmed malicious intent. Report to marketplace.

• Consider the skill's legitimate purpose before flagging.
• A security auditing skill will naturally reference dangerous patterns — this is not malicious.
• Development tools may legitimately need Bash access.
• Look for intent, not just pattern presence.
• When uncertain, report the finding with a note explaining the ambiguity.