ecap Security Auditor

**Judgement:** A strong, security-focused meta-skill that adds a structured, reasonably opinionated security layer around skills, MCP servers, and packages. Best suited for security-conscious or production deployments; overkill for casual experimentation. **What it does well** - Implements an **automatic Security Gate** that runs on installs/first use and bases decisions on a computed Trust Score (from findings and optional risk_score) plus optional hash verification. - Provides a **shared registry** for findings and integrity data, enabling reuse of previous audits across agents and environments. - Supplies **detailed audit methodology** (prompts, checklists, component-type weighting, cross-file and AI-specific attack pattern analysis) so your LLM can perform systematic security reviews. - Emphasizes **pre-install analysis** (npm pack / pip download / git clone without running hooks), explicitly targeting supply-chain risks. **Key risks / limitations** - **External dependency:** Relies on the `skillaudit-api.vercel.app` service for findings and integrity; downtime, API changes, or compromise would degrade or distort results. - **Integrity coverage is currently narrow:** Only the `ecap-security-auditor` package is in the integrity DB in the provided text; most packages will rely solely on findings-based scoring. - **Audit quality is LLM-dependent:** Manual/auto audits depend on the agent correctly following prompts; false negatives and false positives are possible, especially on complex codebases. - **Operational overhead:** Automatic checks on each install/use add latency and complexity; full audits require shell tooling and familiarity with npm/pip/git workflows. - **Centralized trust model:** The shared registry becomes a key trust anchor; incorrect or malicious findings could influence gate decisions until peer-reviewed. **Recommended scenarios** - Teams running **OpenClaw agents in production or semi-trusted environments** that need an enforceable security gate around skills and MCP servers. - Organizations concerned with **software supply-chain security** for npm/pip dependencies used by AI agents. - Security or platform engineering groups who want **repeatable, structured AI-assisted audits** and a shared database of findings. - Less suitable for purely local, low-risk experimentation where the overhead and external dependency may not be justified.