Audit Skills for OpenClaw Agents

Audit and reduce AI agent runtime spend in dollars. Use for AI costs, agent spend, token waste, runtime attribution, detector coverage, and FinOps. Works with OpenClaw, Hermes, QM, Claude Code, Cursor, and generic event ingest.

OpenClaw Workspace Auditor

@dtsola

OpenClaw workspace health auditor (read-only inspection): scans an agent workspace for directory-structure compliance, task/PROGRESS.md health, memory-log gaps, knowledge-base index orphans and junk files; outputs a severity-graded report (red/yellow/green) with fix suggestions via a zero-dependency Python script (scan_workspace.py, stdlib only). Use when user asks to audit/inspect/health-check the workspace (工作区体检/审计/健康 检查/看看工作区乱不乱/检查目录规范). 中文：OpenClaw 工作区体检工具（只读审计）。 扫描 agent 工作区健康度：目录结构合规（initializer 规范）、任务进度卡健康 （tracker PROGRESS.md）、记忆日志空窗（memory-distill 约定）、知识库索引 同步与孤儿文件（kb-retriever data_structure.md）、垃圾/临时文件；通过零依赖 Python 脚本（scan_workspace.py，纯标准库）输出分级报告（🔴/🟡/🟢）与修复 建议。只读不修：脚本永不修改/删除任何文件。

Skill Vetter

@zuoyunlai

OpenClaw 技能自动化审计器 Pro（安全/性能/质量三维度 38 条规则）。基于 spclaudehome v1.0.0 fork 深度升级，新增 JSON 报告、CI 退出码、豁免机制、severity-cap 引擎适配。安装第三方技能前必跑。触发词：vet skill, audit skill, 安全审计, 扫描 skill, skill 检查.

risk-assessment

@dangsllc

Framework-directable information security risk assessment. Identifies threats, evaluates likelihood/impact via a 3x3 matrix, maps findings to any compliance framework, and recommends risk treatment options with prioritization guidance.

experiment-lifecycle-governance

@diamond2nv

Add governance to experiment workflows — PIN-protected destructive ops, standardized metrics registry with thresholds, compare-scores ranking with gating, and competition rules audit. Builds on clearml-agent-dispatch and fysom-fsm-integration.

Skill创作发明家

@muippt

Skill创建与质量门控，含56项10层审计模型。触发词：创建skill、skill创建、skill审计、质量审计。不适用：skill发布、生态体检（用mu-skill-auditor）

Claim-to-Source Auditor

@haiyangchenbj

When the user asks to audit, fact-check, verify, or cross-check an article, report, draft, or series. Triggered by 审稿/审计/核验/事实检查/来源追溯/查一下这个数据/核对/审查/跨平台一致性/三平台统一/回归检查/有没有事实错误/这个引用对不对/跟上次比有没有退化. Extracts verifiable claims, traces them to L0 primary or L1 reliable secondary sources, marks each as 通过/部分支持/缺证/错误/判断, and produces a structured audit report with P0-P2 severity. Supports cross-platform version comparison and regression gold-set re-runs. Only audits facts and sources — does not edit style or argument structure.

qsr-audit-readiness-countdown

@mcphersonai

30-day countdown protocol for third-party compliance audits — EcoSure, health department, corporate brand audits. Milestone-driven preparation that makes perfect audit scores the natural outcome of the process, not a last-minute scramble. Built by a franchise GM with 16 years in QSR operations and multiple consecutive years of 100% EcoSure compliance.

skill-usefulness-audit

@gongyu0918-debug

Review your installed agent skills to see what you actually use, what overlaps, and what may no longer be worth keeping.

Cross-Material Consistency Auditor

@haiyangchenbj

Compare two or more materials on the same topic or event for cross-material consistency before publication. Identifies mismatched numbers, product names, fac...

agent-runtime-impact-research

@haiyangchenbj

Research and analyze major Agent harness, runtime, coding-agent, skills, subagent, and plugin releases. Use when a model or platform launches an Agent execution layer and the user needs verified facts, architecture explanation, ecosystem impact, and implications for agent platforms and coding agents. Produces a fact table, runtime flow explanation, layered impact analysis, and a source register with judgment and evidence visibly separated. 中文摘要：研究 Agent 运行时、编码代理、Skills、插件与子代理的重大发布。产出经核实的 事实表、架构解析、分层影响分析与来源登记，判断与证据分离。触发词：Agent 运行时分析、 Agent 发布影响评估、Harness 架构解读、插件生态影响.

notion-personal-space-audit

@haiyangchenbj

Audit a personal Notion hub and its nested pages and databases: identify mixed content types, empty placeholders, weak navigation, and sensitivity-boundary problems, then produce a practical information-architecture redesign and migration map. Read-only by default — it never modifies Notion content without explicit authorization. 中文摘要：审计个人 Notion 空间及其嵌套页面与数据库，识别混合内容类型、空占位记录、 弱导航与敏感边界问题，产出信息架构重设计与迁移方案。默认只读。触发词：Notion 空间 整理、Notion 页面审计、信息架构重构、数据库迁移方案.

sealvera

@ahessami123

Tamper-evident audit trail for AI agent decisions. Use when logging LLM decisions, setting up AI compliance, auditing agents for EU AI Act, HIPAA, GDPR or SOC 2, or when a user asks about AI decision audit trails, explainability, or SealVera.

determinability-checker

@schchit

Check target determinability on a bounded finite configuration set.

jep-guard-audit

@schchit

Verify signed audit evidence and inspect tenant-scoped event references.

Image Audit

@xiaowu89

对图片进行鉴黄、政治、暴恐内容审核。先将图片压缩到 500px/JPEG 后直传 NX API 审核，以表格汇总结果。适用于用户提到图片审核、内容检查、鉴黄、政治识别、暴恐识别、违规扫描、图片安全、JPG/PNG/WebP 审核的场景。

Agent安全审计免费版

@thcjp

AI Agent系统安全审计工具,支持代码库安全检查、提示注入检测与基础配置审计,适合个人开发者快速安全自查。Use when 需要安全检测、合规审计、漏洞扫描、加密防护时使用。不适用于渗透测试未授权目标。适用于独立开发者、企业团队和自动化工作流场景。支持中文交互，无需复杂配置即开即用。输出结果可直接使用，减少二次加工成本。

独立审计工具（免费版）

@thcjp

对AI Agent进行安全、性能、合规及代码质量的综合审计，适合个人用户免费快速上手使用。

Verify an LLM API endpoint — model authenticity, billing inflation, relay provenance, performance and silent downgrades. Use when the user asks whether the model they are paying for is genuine, whether a relay or proxy is trustworthy, whether they are being overcharged, or whether a model has been quietly downgraded. 检测 LLM API 端点的真伪、计费掺水、中转来源、性能与降智；当用户问"我用的模型是不是真的"、"这个中转站靠谱吗"、"是不是被降智了"、"计费对不对"时使用。

AI Forensic Audit (Evidence Chain)

@zhaoxinghua09-cell

AI 溯源审计技能：对 AI 生成内容/Agent 行为/对话记录执行溯源审计——采集证据链（来源/时间线/操作日志/生成痕迹）→ 交叉验证 → 输出结构化审计报告（证据清单+可信度+风险点+建议）。对标国际标准：C2PA 内容溯源 / SLSA 供应链 / EU AI Act Art.50 / 审计准则（ISSAI/COBIT）。适用：AI 内容是否由某 AI 生成、Agent 操作合规审计、泄密溯源、医疗 AI 审计（细分第一）。触发词：溯源、审计、证据链、AI 审计、这是谁生成的、provenance、forensic、audit trail、内容溯源。

credential-exposure-map

@thomaszhou22

Map all credentials your OpenClaw agent can access. Scans env vars, config, memory, skills, MCP servers, git history. Generates exposure report with risk scoring. Activate when user says "credential audit", "exposure map", "security audit", or "what can my agent access".

安全审计工具(免费版)

@thcjp

免费安全审计工具支持凭据泄露、开放端口、配置及文件权限扫描，且可自动修复常见安全问题，适合个人与小团队使用。

审计

@thcjp

对知识库进行断链、缺失元数据、标签不一致和封面等健康检查，支持自动化配置和中文交互，提升审计效率。

Vibe Codebase Audit

@43622283

Comprehensive automated and multi-model AI security audits for AI-generated codebases, checking vulnerabilities, secrets, dependency risks, and config issues.

OpenClaw Security Hardening

@kylejfrost

Protect OpenClaw installations from prompt injection, data exfiltration, malicious skills, and workspace tampering

技能盘点与效能体检

@elisabeth15501

Office-agent skill inventory & health check. Scans any skills directory, measures size and context-token footprint, detects duplicates, and classifies skills into used / protected / closeable / manual-review buckets. Reverse-dependency scanning locks every skill referenced by automations, hooks or plugins. Read-only by default: two disclosed, consent-gated write paths — `--overrides --apply --yes` (programmatic close on platforms like WorkBuddy; auto-backup first, dry-run without --yes) and `--set-lang` (saves the report language preference to ~/.workbuddy/skill-inventory.json). Report language: auto (default; the Agent decides per conversation language) / zh / en; one-off override via --lang; JSON output is always English-keyed. No network access, no subprocesses. English docs: SKILL.en.md. 办公型 Agent 通用的技能库盘点与效能体检。扫描任意技能目录，统计数量/体积/上下文 token 占用， 识别重复与近似技能，并按「有使用记录/受保护/可关闭候选/需人工确认」四档给出保守建议；反向依赖 扫描会锁定被自动化/Hook/插件引用的技能。默认只读，写路径共两处且均需显式授权：`--overrides --apply --yes`（仅 WorkBuddy 等可关平台，先自动备份，缺 --yes 只做预览）与 `--set-lang`（把报告 语言偏好写入 ~/.workbuddy/skill-inventory.json）。语言设置三选一：auto（默认，Agent 按对话语言 决定）/ zh / en；--lang 仅本次运行覆盖；--json 输出恒为英文键。无网络、无子进程。 英文文档见 SKILL.en.md。

Skillscanner

@rexshang

Security scanner for ClawHub skills from Gen Digital. Looks up skill safety via the scan API.

安全审计

@thcjp

Audit codebases, infrastructure, AND agentic AI systems for security。Use when 需要安全检测、合规审计、漏洞扫描、加密防护时使用。不适用于渗透测试未授权目标。适用于独立开发者、企业团队和自动化工作流场景。支持中文交互，无需复杂配置即开即用...

审计与内控合规专家（免费版）

@chenqg618

审计与内控合规专家，一个技能覆盖这一类 6 个子技能——审计调整分录核对、审计与账务调整技能包、行业专项技能包、采购与付款技能包、研发费用辅助账与高新指标核对、关联方交易与同期资料一致性核对。贴一张表进来，自动分诊到对应的子技能并给出逐条结论（带原文行号、可复算），材料不足时如实说"缺哪些列"，绝不给结论。触发词包括 审计与内控合规专家、审计调整分录核对、审计与账务调整技能包、行业专项技能包、采购与付款技能包、研发费用辅助账与高新指标核对、关联方交易与同期资料一致性核对。

XAPS Tollbooth

@sentvan23

Audit agent value moves before sign or settle. Payers attach X-XAPS-Receipt; counterparties independently clear. Advisory receipt, not insurance — XAPS does not execute or warrant the transfer.

TrollBridge

@eric-tijerina

Pay-per-call crypto intel API — 100 tolled lanes (markets, token safety, scam detection, Polymarket odds, DeFi yields) paid in USDC on Base via x402.

security-check

@samir-abis

Run a free, read-only security check of the user's own web app or API through Rheono; the report arrives by email. Use when the user asks to check, scan, audit, or pentest their own site, app, or API.

Clean Code 审计法 · 第一性原理

@elisabeth15501

第一性原理 clean code 审计法。从单根前提「代码是写给人看的」推导出两根判据—— A. 理解成本（读起来费不费劲）/ B. 修改风险（改起来怕不怕），用红/黄/绿三档给代码打分， 并明确允许「有意的、注释了的、范围可控的技术债」暂时存在。专用于审计你自己的 WorkBuddy Skill 脚本或其他 Python 代码，产出带证据(文件:行)的可勾选报告。 触发词：「用第一性原理审代码」「理解成本/修改风险」「clean code 审计」「审计我的 Skill 脚本」 「按红黄绿审代码」「clean code 审计样例」。注意：本 skill 只做可读性/可维护性的第一性原理审计， 不做通用 PR/MR 审查（那用 code-review-assistant 或 critical-code-reviewer）， 不替代 clean-code 的写代码规范手册，也不做 lint/格式化（那用 project-code-standard）。 First-Principles Clean Code Audit. Derives two criteria from one root premise — "code is written for humans": A. Comprehension cost (how hard to read) / B. Change risk (how scary to modify) — scored red/amber/green, explicitly permitting intentional, documented, scoped tech debt. Audits your own WorkBuddy skill scripts or Python code, emitting an evidence-backed (file:line) checklist report. Triggers: "audit code with first principles", "comprehension/change risk", "clean code audit", "audit my skill scripts". Read-only: emits findings, never edits. Note: this skill does first-principles readability/maintainability audit only — not generic PR/MR review (use code-review-assistant / critical-code-reviewer), not a style handbook (use clean-code), and not lint/format (use project-code-standard).

Skilllab

@indigokarasu

Skill library maintenance: audit, merge, rename, delete, consolidate, publish, sanitize, and critique skills. Interactive menu via clarify tool. Scans ALL profile directories recursively — never hardcodes a single path. Use when the user asks to clean up the skill library, merge overlapping skills, rename skills to follow naming conventions, delete auto-generated or stale skills, audit skills for authorship, publish skills to external registries, sanitize skills for security scanner compliance, score skills against the 10-dimension rubric, generate improvement plans, or run autonomous library grinding (10khr). Also covers frontmatter conventions and how to identify skills by type (ocas-*, util-*, protected, auto-generated). NOT for: building or debugging a skill's own scripts (that is not a library task), running code autofix on skill source, or writing arbitrary code unrelated to the skill library.

审计验证工具箱(专业版)

@thcjp

企业级审计验证工具，支持批量自动化审计、实时监控、多标准交叉分析、加密认证与趋势预测，保障持续合规与安全。