## Workflow

Follow these steps in order when the user asks to scan skills.

### Step 1: Discover installed skills

Find all installed skill directories. Skills can be in multiple locations:

For each directory found, look for these files that define a skill:

- `SKILL.md` — Skill definition and instructions
- `*.ts`, `*.js` — Source code (TypeScript/JavaScript)
- `*.sh`, `*.bash` — Shell scripts
- `*.py` — Python scripts
- `package.json` — Package definition with dependencies
- `openclaw.plugin.json` — Plugin configuration

### Step 2: Read and collect skill content

For each skill found, read ALL source files. Prioritize files in this order:

1. Any `.ts`, `.js`, `.sh`, `.bash`, `.py` files (executable code — highest risk)
2. `SKILL.md` (may contain embedded shell commands or curl calls)
3. `package.json` (check for suspicious dependencies or scripts)
4. `openclaw.plugin.json` (check for dangerous hooks or permissions)

Concatenate all content for each skill with clear file markers:

### Step 3: Chunk the content

If a skill's combined content exceeds 4000 characters, split it into chunks:

- **Chunk size:** 4000 characters
- **Overlap:** 200 characters (to catch malicious patterns that span chunk boundaries)

If the content is under 4000 characters, treat it as a single chunk.

### Step 4: Analyze each chunk with OG-Text

For each chunk, call the OG-Text model using curl:

## Threat Categories

Analyze this code for the following threat categories:

### 1. ClickFix (Social Engineering Download & Execute)
Look for patterns that trick users into downloading and executing malicious code:
- Commands that download files from external URLs then execute them (curl|wget piped to sh/bash)
- Fake update prompts that run arbitrary scripts
- Instructions telling users to copy-paste commands into terminal
- Disguised install scripts that fetch remote payloads
- PowerShell download cradles or encoded commands
- Deceptive prompts that make malicious actions look like legitimate setup steps
- Use of osascript/AppleScript to display fake dialog boxes prompting code execution

### 2. RAT (Remote Access Trojan / Reverse Shell)
Look for patterns that establish unauthorized remote access:
- Reverse shell connections (bash -i >& /dev/tcp/, nc -e, python socket connect-back)
- Outbound connections to unknown C2 servers
- Persistent backdoors via cron, launchd, or systemd
- SSH key injection into authorized_keys
- Tunneling or port forwarding to external hosts
- WebSocket or HTTP-based command-and-control channels
- Process spawning with stdin/stdout redirected to network sockets

### 3. Info Stealer (Data Exfiltration)
Look for patterns that steal sensitive data:
- Reading SSH keys (~/.ssh/), tokens, API keys, or credentials
- Accessing macOS Keychain (security find-generic-password, security find-internet-password)
- Reading browser profiles, cookies, or saved passwords
- Exfiltrating environment variables (especially tokens/keys)
- Reading ~/.openclaw/credentials/ or other credential stores
- Sending collected data to external servers via HTTP, DNS, or other channels
- Clipboard monitoring or screenshot capture
- Reading /etc/passwd, /etc/shadow, or system configuration files

## Analysis Rules

- Focus on ACTUAL malicious code, not theoretical discussions about security
- A skill that legitimately uses curl to call an API is NOT malicious — look for ABUSE patterns
- Shell commands in SKILL.md that teach the agent to use a CLI tool are normal — flag only if the commands themselves are dangerous
- Obfuscated code (base64 encoded commands, hex-encoded strings, eval of dynamic strings) is highly suspicious
- Pay attention to code that runs on install, on import, or as side effects rather than explicit function calls
- Check package.json "scripts" section for preinstall/postinstall hooks that run suspicious commands
- Consider the INTENT: a weather skill that reads SSH keys is suspicious; a 1password skill that reads credentials is expected

## Response Format

Return ONLY valid JSON (no markdown fences, no extra text):

{
  "isRisky": true or false,
  "confidence": 0.0 to 1.0,
  "category": "clickfix" or "rat" or "stealer" or "none",
  "severity": "critical" or "high" or "medium" or "low" or "none",
  "reason": "brief explanation of what was found",
  "findings": [
    {
      "threat": "clickfix" or "rat" or "stealer",
      "suspiciousCode": "exact code snippet found",
      "explanation": "why this is dangerous in plain language"
    }
  ]
}

If the code is safe, return:
{"isRisky": false, "confidence": 0.9, "category": "none", "severity": "none", "reason": "No malicious patterns detected", "findings": []}

### Step 8: Recommend actions

Based on findings, suggest these actions:

**For Critical/High risks:**
- Remove the skill immediately: `openclaw skills remove <skill-name>`
- If credentials were at risk, advise rotating affected keys/passwords
- Check system for persistence (cron jobs, launchd agents)

**For Medium risks:**
- Review the suspicious code manually
- Consider disabling the skill until reviewed
- Run a deeper scan

**For Low risks:**
- Note the finding for awareness
- Monitor the skill's behavior

## Severity Guide

| Severity | Criteria |
|----------|----------|
| Critical | Active exfiltration, reverse shell, or confirmed malicious payload |
| High | Download-and-execute patterns, credential access with external send |
| Medium | Suspicious obfuscation, unusual file access, or untrusted dependencies |
| Low | Minor concerns like overly broad file access or unusual permissions |

## On-Demand Deep Scan

If the user asks for a deep scan of a specific skill, perform additional checks:

1. **Dependency audit** — Read `package.json` and check each dependency:
   - Is it a well-known package or an obscure one?
   - Does the version look like typosquatting (e.g., `lod-ash` instead of `lodash`)?
   - Are there suspicious preinstall/postinstall scripts?

2. **Network analysis** — Extract all URLs, hostnames, and IP addresses from the code:
   - Are they well-known services or unknown hosts?
   - Are there hardcoded IP addresses (potential C2)?
   - Do any URLs use URL shorteners or redirects?

3. **Permission analysis** — What system access does the skill request?
   - File system access scope
   - Network access patterns
   - Shell command execution
   - Environment variable reads

## Example Malicious Patterns

These are examples of what to detect (for reference, DO NOT include these in analysis prompts):

**ClickFix example hidden in a weather skill:**

## Scheduling Periodic Scans

Offer to schedule regular skill scans:

# Built-in skills
ls ~/.openclaw/skills/

# User-installed skills (npm packages)
ls ~/.openclaw/node_modules/@*/

# Extension skills
ls ~/.openclaw/extensions/*/

# Local workspace skills
ls ~/.openclaw/workspace/skills/ 2>/dev/null

=== FILE: skill-name/index.ts ===
<file content>
=== END FILE ===

=== FILE: skill-name/SKILL.md ===
<file content>
=== END FILE ===

curl -s -X POST "https://api.openguardrails.com/v1/model/chat/completions" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sk-xxai-model-0e5a52bd1c70cca03d5f67fe1c2ca406" \
  -d '{
    "model": "OG-Text",
    "temperature": 0.1,
    "messages": [
      {
        "role": "user",
        "content": "<ANALYSIS_PROMPT>"
      }
    ]
  }'

You are a cybersecurity expert specializing in AI agent supply chain attacks. You are analyzing an OpenClaw skill (a plugin/extension for an AI agent platform) for hidden malicious behavior.

## Skill Being Analyzed: {SKILL_NAME}
## Content Chunk {CHUNK_INDEX}/{CHUNK_TOTAL}