A comprehensive security vulnerability scanner for identifying prompt injection, malware, and dependency risks in AI agent skills and MCP servers.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install aiclude-security-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install aiclude-security-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is AIclude Security Scanner?
AIclude Security Scanner is a robust security tool built to safeguard the ecosystem of Openclaw Skills and Model Context Protocol (MCP) servers. It provides developers and security teams with the ability to instantly audit AI integrations for specialized threats that traditional scanners often miss. By focusing on AI-native vulnerabilities such as tool poisoning and prompt injection, it ensures that your automated workflows remain secure and trustworthy.
This skill functions by analyzing both local source code and remote packages, leveraging a multi-engine architecture to provide a deep-dive assessment of a target's risk profile. Whether you are building new Openclaw Skills or integrating third-party tools, this scanner provides the visibility needed to mitigate supply chain attacks, permission abuse, and malicious code execution before they reach production.
AIclude Security Scanner Use Cases
- Auditing third-party MCP servers before deployment to ensure they don't contain hidden backdoors or data stealers.
- Scanning local development projects for new Openclaw Skills to detect potential command injection points.
- Performing supply chain analysis on AI agent dependencies to identify known CVEs or typosquatting attempts.
- Verifying that an AI skill adheres to the principle of least privilege by analyzing its filesystem and network permission requests.
How AIclude Security Scanner Works
- The user triggers the scan via the
/security-scancommand, specifying a package name or a local directory path. - The skill performs an initial lookup against the AIclude database to retrieve existing results for known Openclaw Skills, providing near-instant feedback.
- If a new target is detected, it registers the entity and initiates seven parallel scanning engines, including SAST, DAST, and a specialized Tool Analyzer.
- The engines analyze the target for various threat vectors such as prompt injection patterns, malicious tool descriptions, and unvalidated inputs.
- A comprehensive security report is generated, categorizing risks from CRITICAL to INFO and providing specific remediation advice.
AIclude Security Scanner Setup
To use the security scanner within your environment supporting Openclaw Skills, simply invoke the command. No manual installation of the engines is required as they are managed via the AIclude cloud or sandbox environment.
# Scan a remote package by name
/security-scan --name <package-name>
# Scan your current local directory
/security-scan .
AIclude Security Scanner Data Schema & Taxonomy
The scanner generates a detailed report structure to help developers understand and fix vulnerabilities. The data is organized as follows:
| Component | Details |
|---|---|
| Risk Level | Categorized as CRITICAL, HIGH, MEDIUM, LOW, or INFO. |
| Vulnerability List | Precise code locations, descriptions, and severity levels. |
| Risk Assessment | A summary of the potential impact of found vulnerabilities on Openclaw Skills. |
| Remediation | Step-by-step instructions on how to patch or mitigate the identified risks. |
| Metadata | Includes auto-detected target type (mcp-server or skill) and used engines. |
AIclude Security Scanner Advanced Features
- 7-Engine Parallel Analysis: Combines SAST, SCA, DAST, and behavioral monitoring for exhaustive coverage.
- Sandbox Profiles: Choose between strict, standard, or permissive isolation profiles to customize the scanning environment depth.
- AI-Specific Detection: Specialized logic for detecting tool poisoning, prompt injection, and rug-pull patterns in AI tool definitions.
- Flexible Output Formats: Generate reports in Markdown for human review or JSON for integration into CI/CD pipelines for Openclaw Skills.
- Web Dashboard Integration: Synchronization with a web-based dashboard for long-term tracking and historical scan results.
SKILL.md
Loading
Related Openclaw Skills
Gork Legacy Skill
A powerful productivity engine that synchronizes Slack, Strava, and Harvest data into automated daily notes and a local SQLite database.
Abstract Onboard
A comprehensive toolkit for AI agents to deploy contracts, bridge assets, and interact with the Abstract ZK Stack Layer 2 network.
Clawd Modifier
A creative customization toolkit for personalizing the Claude Code mascot's appearance and color schemes within your terminal.
Task Supervisor
A self-supervising manager for long-running AI agent tasks with progress tracking and periodic reporting.
AICLUDE Vulnerability Scanner Skill
A specialized security auditing skill designed to scan and report vulnerabilities within MCP servers and AI agent packages.
OpenSoul Agent Skill
OpenSoul provides AI agents with an immutable, blockchain-based audit log for persistent memory, self-reflection, and economic autonomy.
Featured*
