zeroclaw-labs/zeroclaw · error · anyhow::Error

cli-skills-audit-failed

cli-skills-audit-failed

Error message

Skill audit failed.

What it means

`skills audit <source>` runs audit_skill_directory_with_options over a skill directory — an explicit path, or an installed skill located by name. When the report is not clean, each finding is printed as a '- finding' line under a red '✗ Skill audit failed' header, then the command bails with the generic cli-skills-audit-failed message. The actionable detail lives in stdout above the error, not in the error itself.

Source

Thrown at src/skills/mod.rs:230

            if report.is_clean() {
                println!(
                    "  {} Skill audit passed for {} ({} files scanned).",
                    console::style("✓").green().bold(),
                    target.display(),
                    report.files_scanned
                );
                return Ok(());
            }

            println!(
                "  {} Skill audit failed for {}",
                console::style("✗").red().bold(),
                target.display()
            );
            for finding in report.findings {
                println!("    - {finding}");
            }
            anyhow::bail!(get_required_cli_string("cli-skills-audit-failed"));
        }
        crate::SkillCommands::Install {
            source,
            agent,
            bundle,
            no_tier_banner,
            skill,
        } => {
            println!(
                "{}",
                get_required_cli_string_with_args(
                    "cli-skills-install-start",
                    &[("source", &source)]
                )
            );

            let location = resolve_install_location(config, agent.as_deref(), bundle.as_deref())?;
            let skills_path = location.dir().to_path_buf();

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Read the printed findings block first — each line names the concrete problem and file
2. If the findings are script-related and the scripts are trusted, set skills.allow_scripts = true in the config and re-run
3. Otherwise remove or fix the offending files (delete setup scripts, repair frontmatter) and re-audit
4. For third-party skills, prefer deleting the script over enabling scripts globally

Example fix

# before (config)
[skills]
allow_scripts = false

# after — only when the audited scripts are trusted
[skills]
allow_scripts = true

let output = std::process::Command::new("zeroclaw")
    .args(["skills", "audit", target])
    .output()?;
if !output.status.success() {
    let stdout = String::from_utf8_lossy(&output.stdout);
    let findings: Vec<&str> = stdout.lines().filter(|l| l.trim_start().starts_with("- ")).collect();
    // act on `findings`; the error message itself is generic
}

When it happens

Trigger: Auditing a skill whose directory ships executable scripts while skills.allow_scripts = false (scripts_blocked findings); malformed SKILL.md frontmatter or disallowed content patterns; running audit as a CI gate over third-party or cloned skills.

Common situations: Installing a community skill that bundles setup.sh/hooks; allow_scripts turned off after the skill was already present; auditing a cloned repo path directly instead of an installed skill.

Related errors

• Skill security audit failed: {}
• Invalid skill name: {name}
• Skill path escapes skills directory: {name}
• cli-skills-multiple-locations-path
• ZEROCLAW_AUDIT_SIGNING_KEY must be 32 bytes (64 hex chars),

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/2145a444ede37354. Report an issue: GitHub.