Audit Methodology & Rubric

How we analyze every skill for security, permissions, and risk

Risk Levels Explained

🟢

LOW

  • ✓ Network-only access
  • ✓ No filesystem access
  • ✓ No shell execution
  • ✓ No credentials needed
  • ✓ Predictable behavior

Examples: Weather, Web Search, News

🟡

MEDIUM

  • ⚠ Filesystem read access
  • ⚠ API integrations
  • ⚠ Messaging capabilities
  • ⚠ Requires configuration
  • ⚠ Moderate complexity

Examples: Telegram, Discord, GitHub

🔴

HIGH

  • ⚠ Shell command execution
  • ⚠ Broad filesystem access
  • ⚠ Credential handling
  • ⚠ Crypto/financial operations
  • ⚠ System-level access

Examples: Docker, Agent Zero, Wallets

10-Point Audit Framework

1

Metadata & Provenance

Author verification, license, repository history, update frequency, community trust signals

2

Functionality Analysis

Purpose clarity, scope boundaries, feature completeness, edge case handling

3

Network Access Audit

External APIs called, data exfiltration risk, HTTPS usage, domain restrictions

4

Filesystem Access Audit

Read/write paths, sensitive location access (~/.clawdbot/, ~/.ssh/), scope limitations

5

System Access Audit

Shell execution, subprocess spawning, environment variable access, system calls

6

Credential Handling

API key requirements, password storage, encryption at rest, secure transmission

7

Static Security Analysis

YARA rules, hardcoded secrets, suspicious imports, obfuscation detection

8

Code Quality Review

Organization, documentation, test coverage, error handling, complexity metrics

9

Supply Chain Verification

Dependency audit, vulnerability scanning, dependency pinning, reputable sources

10

Risk Scoring & Weighting

Weighted algorithm across 6 factors: network (20%), filesystem (20%), system (25%), credentials (20%), maturity (10%), author (5%)

Sample Audit Reports

Weather

🟢 LOW

Network-only weather utility. No filesystem, shell, or credential access. Minimal permissions example.

Docker

🔴 HIGH

Container management with shell execution, broad filesystem access, and system-level operations.

Want Your Skill Audited?

Get the SecureSkills Verified badge and build trust with the agent community.

Request Audit