A security-focused static analysis tool designed to audit Openclaw Skills for malicious patterns and vulnerabilities before they are installed.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install ai-skill-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install ai-skill-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Security Scanner?
The Skill Security Scanner is a specialized utility for developers and users within the OpenBot and Clawdbot ecosystem. It serves as a defensive layer by analyzing the source code of Openclaw Skills to detect critical red flags such as hardcoded credentials, suspicious network calls, and obfuscated logic. By performing static analysis on a skill folder, the scanner helps prevent the execution of malicious scripts that could compromise sensitive data or system integrity.
This tool is essential for anyone integrating third-party components into their workflow. It provides a structured way to verify trust and ensure that any Openclaw Skills you deploy meet high security standards. By identifying potential prompt injection risks and malware patterns early, you can maintain a safe environment for your AI-driven automations.
Skill Security Scanner Use Cases
- Auditing a third-party skill downloaded from an external repository before execution.
- Verifying the safety of new Openclaw Skills listed on ClawHub to ensure they are clean.
- Detecting potential credential exfiltration or suspicious network activity in agent workflows.
- Automating security checks within a CI/CD pipeline for newly developed agent capabilities.
- Identifying prompt injection risks or malicious patterns in skill logic during a manual security audit.
How Skill Security Scanner Works
- The user points the scanner to the local directory containing the source code for the Openclaw Skills.
- The tool performs a pattern-based static analysis against a comprehensive rules reference.
- Findings are categorized by severity levels, including CLEAN, INFO, REVIEW, SUSPICIOUS, and DANGEROUS.
- Detailed logs are generated, optionally highlighting the specific lines where suspicious code was detected.
- The scanner returns an exit code that can be used by automation tools to allow or block the installation of the Openclaw Skills.
Skill Security Scanner Setup
To begin using the security scanner for your Openclaw Skills, you can run the following commands in your terminal:
# Scan a specific local skill folder
python3 scripts/scan.py /path/to/skill
# Run a scan with detailed verbose output to see matched lines
python3 scripts/scan.py /path/to/skill --verbose
# Generate JSON output for integration with security automation tools
python3 scripts/scan.py /path/to/skill --json
Skill Security Scanner Data Schema & Taxonomy
The scanner evaluates Openclaw Skills based on a specific scoring system and returns results that can be interpreted via exit codes or JSON objects. Below is the interpretation of the scoring and exit codes:
| Score | Severity | Recommendation | Exit Code |
|---|---|---|---|
| CLEAN | Low | Safe to install | 0 |
| INFO | Low | Safe to install | 0 |
| REVIEW | Medium | Review manually before installing | 1 |
| SUSPICIOUS | High | Do NOT install without thorough review | 2 |
| DANGEROUS | Critical | Do NOT install — likely malicious | 3 |
Skill Security Scanner Advanced Features
- Verbose output mode to highlight the exact lines matching suspicious security patterns.
- Full JSON output support for seamless integration into custom security dashboards or automation scripts.
- Standardized exit codes (0-3) to facilitate automated decision-making in deployment pipelines.
- Comprehensive rules reference allowing users to see the specific logic used to flag Openclaw Skills.
- Support for identifying a wide range of threats including obfuscated code and malicious network calls.
SKILL.md
Loading
Related Openclaw Skills
Memory PARA
A hybrid memory management system that transforms raw episodic logs into structured semantic knowledge using the PARA method.
Private Chat
An encrypted communication layer for AI agents that secures sensitive data using AES-256-CBC and stealth activation.
Ichiro-Mind
Ichiro-Mind is a sophisticated unified memory architecture that provides AI agents with persistent, hierarchical recall through a 4-layer system of hot, warm, cold, and archive storage.
Chichi Speech
A FastAPI-based REST service for Qwen3 text-to-speech optimized for consistent voice cloning and high-speed audio synthesis.
Deploy Kit
An automated deployment utility that simplifies launching web applications to Vercel, Railway, and Supabase via integrated CLI workflows.
Freelance Toolkit
A lightweight Python-based command-line toolkit for French freelancers to manage clients, track time, and generate professional HTML invoices.
Featured*
