claw skill security audit

### Quick judgment A strong, well‑scoped security auditing skill specialized for static analysis of codebases and OpenClaw SKILL.md files. It emphasizes concrete, evidence‑based findings and avoids speculative or purely theoretical issues. Best suited as a security review assistant and governance layer around skills and LLM integrations, not as a full replacement for professional penetration testing or dynamic security tools. ### Key risks / limitations - **Static-only viewpoint:** Relies on read‑only filesystem access and source inspection; it cannot perform dynamic testing, fuzzing, or live exploitation validation. - **Coverage limits:** While it covers many common vulnerability classes (injection, access control, secrets, privacy, prompt/LLM safety), it may miss highly framework‑specific issues, complex business‑logic flaws, or vulnerabilities hidden in binary/dependency artifacts. - **Potential for false negatives/positives:** As with any SAST-style approach, some subtle issues may be missed, and some reported risks may require human validation in context. ### Recommended scenarios - Vetting **OpenClaw SKILL.md** files for instruction injection, data exfiltration, or privilege-escalation patterns before enabling skills on shared or production agents. - Running a **security pass on codebases** when a user explicitly requests vulnerability assessment, SAST-style scanning, or security hardening input. - Reviewing **LLM-related integration code** (prompt construction, tool wiring, exec paths) to catch prompt injection, unsafe eval/exec, or untrusted-output-to-dangerous-sink flows. - Performing **privacy impact checks** on how sensitive fields (email, password, ssn, phone, apiKey) are logged or sent to third parties in application code or agent workflows.