slowmist-agent-security: A Markdown Review Framework for Agent Install Decisions
SlowMist Agent Security Skill: A comprehensive security review framework for AI agents operating in adversarial environments. Core principle: Every external input is untrusted until verified.
At a glance
- What is it?
- SlowMist's agent security skill is a set of review guides, pattern lists and report templates that an LLM agent loads before installing a skill, auditing a repository or acting on an external URL. It is documentation with a directory layout, not a scanner, and that distinction decides whether it fits your setup.
- Who is it for?
- Adopt it if you run an LLM agent that installs skills or reads untrusted URLs and you currently have no written review step at all; the risk rating table and the templates give that step a shape. Do not adopt it if you expect automated detection: nothing in the repository runs on its own, and pattern matching is performed by the model reading patterns/red-flags.md.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 152 days ago.
- What is it written in?
- GitHub does not report a main language for this repository.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The Problem: Agents Install First and Ask Never
An LLM agent that can install skills, clone repositories, fetch URLs and read documents has no instinct for provenance. It treats a README instruction and a user instruction as the same kind of text. SlowMist's framing puts this plainly: every external input is untrusted until verified. The repository is aimed at that gap, and its scope is wider than skill installation. The README lists six review areas: skill and MCP installation, GitHub repository review, URL and document analysis, on-chain address review, product and service evaluation, and social share review. The intended user is not a security engineer running a scanner. It is an agent operator who wants the agent itself to pause and produce a structured assessment before acting. The framework is written for OpenClaw and Hermes Agent and, per the README, other LLM-based agent systems, which is a claim about the format (Markdown files the model reads) rather than about any integration code. Nothing in the repository layout suggests a runtime component, an API, or a hook into an agent's tool-calling loop.
What Is Actually in the Repository
The layout is the product. SKILL.md holds the main framework documentation. Six review guides sit in reviews/: skill-mcp.md, repository.md, url-document.md, onchain.md, product-service.md and message-share.md. Three pattern files sit in patterns/: red-flags.md with 11 categories of code-level dangerous patterns, social-engineering.md with 8 categories, and supply-chain.md with 7 categories. Five report templates sit in templates/: report-skill.md, report-repo.md, report-url.md, report-onchain.md and report-product.md. A _meta.json file carries ClawHub metadata. That is the whole surface. There is no executable, no dependency manifest, no test directory and no configuration file described in the material. The consequence is worth stating directly: detection quality depends on the model reading red-flags.md and applying it, so two agents given the same repository can produce different verdicts. The framework supplies vocabulary and a report shape, not a deterministic check.
How a Review Actually Flows
The README's two usage examples describe the flow. For a skill review, the agent references reviews/skill-mcp.md, scans files using patterns/red-flags.md, and outputs a report using templates/report-skill.md. For an on-chain address, it validates the address format, queries AML risk data through available tools, and outputs a report using templates/report-onchain.md. Each example is a three-step path: pick the guide, apply the pattern list, fill the template. The trigger is the interesting part. The Quick Start section states the agent will automatically reference the framework when it encounters skill or MCP installation requests, unknown GitHub repositories, external URLs or documents, blockchain addresses, or product and service recommendations. That automatic behaviour is an assumption about the host agent, not a feature the repository enforces. If your agent does not load skill files on those triggers, the framework is inert. The on-chain example also exposes a dependency: step two requires AML data from tools the repository does not contain, and the README points to MistTrack Skills as the external source.
The Risk Table and the Trust Hierarchy
Two tables carry most of the decision weight. The risk rating has four levels. LOW means information-only, no execution, no data collection, trusted source; the agent informs the user and proceeds if requested. MEDIUM means limited capability, clear scope, known source, some risk; the agent produces a full report and recommends caution. HIGH means credentials, funds or system modification, or an unknown source; the agent produces a detailed report and must have human approval. REJECT means the input matches red-flag patterns, is confirmed malicious, or has an unacceptable design; the agent refuses and explains why. The trust hierarchy runs from tier 1, official project or exchange organisations, through known security teams and researchers at tier 2, ClawHub entries with high downloads and multiple versions at tier 3, GitHub repositories with high stars and active maintenance at tier 4, down to unknown sources and new accounts at tier 5. Note what the hierarchy does with tier 4: it sets scrutiny to High and instructs the agent to verify code. Popularity raises the bar rather than lowering it, which is the opposite of how most agents treat a familiar repository name.
Installation and the Commands the README Gives
The installation section is short and honest about its own example. It uses OpenClaw for demonstration and then says you can hand the repository URL to your agent and let it handle the installation. Option 1 is a direct clone into the workspace skills directory: cd ~/.openclaw/workspace/skills followed by git clone https://github.com/slowmist/slowmist-agent-security.git. Option 2 is ClawHub, marked as available when it is: clawhub install slowmist-agent-security. Those are the only two commands in the material. There are no environment variables, no config keys and no registration step, because there is nothing to configure. That is a low adoption cost and also the ceiling on what the tool can do. Upgrades are equally light: the repository has no releases retrieved, so the practical update path is a git pull inside the cloned directory or a reinstall through ClawHub. The MIT licence permits use, modification and distribution, and the README states that directly. If you fork the pattern files and ship them inside a commercial product, the licence text still needs to travel with the copy; that is a general property of MIT, not legal advice for your situation.
Where the Framework Stops
The sharpest limitation is that this is a review framework, not a review engine. Nothing enforces the REJECT verdict. An agent that reads red-flags.md and then decides a repository looks fine can proceed, and the repository contains no mechanism to stop it. The trust hierarchy compounds this: tier 3 treats high download counts and multiple versions on ClawHub as grounds for moderate-high scrutiny, which is a heuristic about distribution, not about the code in the package. The pattern lists themselves are static Markdown. A new attack technique requires a human to write it into patterns/red-flags.md, social-engineering.md or supply-chain.md and push a commit. There is no feed, no signature update and no version pin an agent can check. The on-chain path is the clearest case of the wrong tool: the repository holds a review guide and a report template for addresses, but the AML data comes from MistTrack Skills, so installing slowmist-agent-security alone gives you a form to fill in without the numbers to put in it. If your need is automated scanning of a dependency tree, this is not that.
Compared With skill-vetter
The README credits skill-vetter by spclaudehome as the inspiration and links to it on ClawHub. Both live in the same place in an agent's workflow: they are skill files that a model reads before installing something else. The difference visible in this material is breadth. skill-vetter is named as a skill vetting tool; slowmist-agent-security spreads across six review areas, three pattern files and five report templates, and adds a four-level risk rating with a defined agent action per level and a five-tier trust hierarchy. That breadth costs context. An agent that loads SKILL.md plus the relevant guide plus the relevant pattern file plus the relevant template is holding four documents to answer one question, and the framework gives no guidance in the material about trimming that set. A narrower vetting skill may fit a small context budget better. The other comparison the README invites is with the OpenClaw Security Practice Guide, which it names as the source for the attack patterns. That guide is prose for humans; this repository is the version shaped for an agent to apply.
Who Should Load This, and What to Check First
The fit is an operator running an agent that installs third-party skills, clones unfamiliar repositories, or processes external URLs and documents, with no existing review step. The risk table alone gives that operator a decision vocabulary: proceed, report and caution, require human approval, refuse. The mismatch is anyone expecting detection. There is no code to run and no test to pass. Before adopting, read SKILL.md and one guide such as reviews/skill-mcp.md in full, then confirm that your agent actually loads skill files when it sees an install request or an unknown repository. If it does not, the clone into ~/.openclaw/workspace/skills changes nothing about its behaviour. For on-chain work, install MistTrack Skills alongside it or skip the onchain.md path entirely. The framework's own last line calls security a prerequisite rather than a feature, and the honest reading of this repository is that it supplies the checklist, not the enforcement.
Editorial conclusion
Adopt it if you run an LLM agent that installs skills or reads untrusted URLs and you currently have no written review step at all; the risk rating table and the templates give that step a shape. Do not adopt it if you expect automated detection: nothing in the repository runs on its own, and pattern matching is performed by the model reading patterns/red-flags.md. Do not adopt it for on-chain work without MistTrack Skills, since the README lists that as an external tool for AML data. Before trusting it, read SKILL.md and one review guide end to end and check whether the agent you use actually loads them on the triggers the README names.
Community notes