Security Dashboard

Monitor security scores and issues across all skills in the directory.

How we make skill installs safer

The ClawHavoc incident in the OpenClaw ecosystem showed a real risk: a SKILL.md file can look normal while hiding malicious instructions. That can lead to command execution, data exfiltration, or credential theft.

Direct installs from random GitHub repositories put the full security review burden on each user. Most teams do not have time to manually audit every skill file before installing it.

agentskill.sh uses a two-layer model: centralized scanning on the platform plus local verification in /learn at install time. This gives both broad coverage and a final check before files are written.

Exactly what we do to improve security

We run server-side static analysis on every skill across 12 threat categories.
We assign a normalized 0-100 security score with issue severity and category details.
We show the score and metadata in /learn before installation starts.
We warn on low scores (<50) and require explicit confirmation for very low scores (<30).
We continuously rescan skills and ingest new reports to refresh risk signals.
We self-check /learn updates with content SHA verification to avoid stale security logic.

For safer installs, use /learn and review this dashboard instead of blindly cloning unknown skill files. For incident context, see CrowdStrike's OpenClaw analysis .

Security Dashboard

How we make skill installs safer

Exactly what we do to improve security

Score Distribution

Issues by Severity

Top Issue Categories

Low Security Skills

Recently Flagged for Review