Check any URL for phishing, malware and brand abuse before visiting
Domain Trust Check gives your OpenClaw agent the ability to verify any URL before visiting it — checking for phishing indicators, active malware, brand abuse and known scam patterns. As agents become more autonomous and browse the web on your behalf, the risk of visiting a malicious URL silently increases. This skill acts as a real-time safety layer querying multiple threat intelligence sources before your agent loads any external page.
Skim the SKILL.md before installing, and check which credentials it asks for against what it actually claims to do.
It queries a database or persistent store. Prefer a read-only credential unless it genuinely needs to write.
This skill's own description refers to "query"
It contacts external services. Outbound calls are how data leaves your machine, so it is worth knowing where it connects.
This skill's own description refers to "web"
These permissions are inferred from this listing — the credentials it declares, any maintainer warning, and the operations its own description mentions. ClawVault has not audited this skill's source code. Treat it as a starting point for your own review, not a substitute for one.
An OpenClaw skill is a directory containing a SKILL.md file: Markdown with YAML frontmatter. At startup OpenClaw scans the eligible skill directories and injects a compressed description of each skill into its system prompt, so the agent knows what it can do and invokes a skill when a request matches.
openclaw skills search domain-trust-checkClawHub is the public registry for OpenClaw skills. Searching first gives you the exact owner-qualified reference, which is what the install command needs. Omit the query to browse the default feed.
openclaw skills verify @<owner>/domain-trust-checkverify prints ClawHub's verification envelope, including its scan decision and, when available, a commit-pinned source URL. Add --card to read the generated Skill Card instead. Substitute the owner handle returned by the search above.
openclaw skills install @<owner>/domain-trust-checkNative ClawHub skills use an @owner/slug reference. By default this installs into the active workspace skills/ directory; add --global to install into the shared managed directory instead. You can also install from Git with git:owner/repo, or from a local folder with ./path.
openclaw skills checkcheck reports which ready skills are actually visible to the agent's prompt surface, which is the quickest way to catch a skill that installed but did not load.
Commands follow the official OpenClaw documentation. Placeholders such as <owner> are filled in by the search step, because registry references are publisher-scoped.
Integrated VirusTotal API, improved domain reputation scoring, faster checks
Since February 2026 ClawHub screens submitted skills with VirusTotal: each bundle is hashed and looked up, new bundles are scanned with Code Insight, and results drive an approve, warn or block decision with daily re-scanning. This materially reduces supply-chain risk but does not eliminate it, and independent research has found that different scanners frequently disagree about the same skill. Read the SKILL.md of anything you install, especially if it requests shell access or credentials.
Deploy OpenClaw, Hermes, or PicoClaw on Bluehost with the right template for the job.
Clawaudit is the official automated security audit skill for OpenClaw gateway hosts — currently in active development. It performs threat modelling on your OpenClaw installation, audits skill configurations for dangerous patterns, checks for exposed environment variables, and produces a structured security report. Given thousands of unvetted community skills exist, having an automated auditor on your gateway is increasingly important.
Firewall Security Manager gives your OpenClaw agent complete control over server firewalls — managing UFW, iptables and cloud security groups programmatically. Monitor open ports, detect unauthorized access attempts, automate rule changes and generate security reports. Unlike basic firewall skills that only list rules, this skill provides real-time threat detection, automatic blocking of suspicious IPs and integration with threat intelligence feeds.
Manages firewall rules for your server so Hermes can safely open ports, close risky access and whitelist trusted IPs. Built for admins who need fast but controlled network changes with real-time threat detection and automatic blocking of suspicious IPs.