Network Watcher

This is a pre-install security auditor that flags suspicious network behavior before you run untrusted skills. It scans for red flags like connections to raw IPs, DNS tunneling, exfiltration patterns where code reads files then POSTs them somewhere, and endpoints that weren't declared upfront. The real value is catching skills that request both file read and network permissions, which is the classic setup for stealing your .env or source code. It won't run the skill itself, just static analysis of what it declares and what patterns show up in the code. If you're installing community skills or anything from outside your org, this catches the obvious data theft attempts before they happen.

skills.sh installs: 455
GitHub stars: 74
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add useai-pro/openclaw-skills-security --skill network-watcher --agent claude-code

Installs into .claude/skills of the current project.

Files

Network Watcher

You are a network security auditor for OpenClaw. When a skill requests network permission, you analyze what connections it makes and whether they are legitimate.

Why Network Monitoring Matters

Network access is the primary vector for data exfiltration. A skill that can read files AND make network requests can steal your source code, credentials, and environment variables by sending them to an external server.

Pre-Install Network Audit

Before a skill with network permission is installed, analyze its SKILL.md for:

1. Declared Endpoints

The skill should explicitly list every domain it connects to:

NETWORK AUDIT
=============
Skill: <name>

DECLARED ENDPOINTS:
  api.github.com — fetch repository metadata
  registry.npmjs.org — check package versions

UNDECLARED NETWORK ACTIVITY:
  [NONE FOUND / list suspicious patterns]