OpenClaw Skill Security Guide

A Skill is text, but its instructions can cause an agent to run tools with the permissions available in that session. Review the requested behavior, not only the YAML frontmatter.

Establish provenance

Record where the Skill came from, the exact revision, and who maintains it. Prefer a repository where changes can be reviewed. A copied SKILL.md with no origin is difficult to update or audit.

Inspect risky instruction classes

Look for:

• Shell commands and package installation
• Downloads followed by execution
• Requests to read environment variables or credential files
• Broad recursive filesystem access
• Instructions that disable approval, sandbox, or security controls
• External messages, uploads, or webhooks
• Persistence outside the intended workspace
• Attempts to override higher-priority operator instructions

Risk depends on the effective tool policy. A dangerous command cannot run without a matching tool, but installing the Skill in a full-profile session may provide that tool later.

Test with narrow permissions

Use a disposable workspace, a restricted tool profile, test credentials, and harmless inputs. Confirm the Skill refuses tasks outside its stated scope. Review every external host and executable dependency before enabling it in a persistent agent.

Run the browser-local SKILL.md Checker for a structural and risk preflight. It is heuristic and does not prove safety.

Expected result

• The source and revision are recorded.
• Required tools and external services match the stated purpose.
• No hidden secret, download, persistence, or broad filesystem behavior remains unexplained.
• The Skill completes a test task without escaping its permitted workspace.

Re-run the review after every material update. A trusted old version does not automatically make a new revision safe.