A comprehensive security auditing tool designed to detect credential stealers, data exfiltration, and malicious code within Openclaw Skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install arc-skill-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install arc-skill-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Scanner?
Skill Scanner serves as a critical security layer for developers and users interacting with the OpenClaw ecosystem. As third-party marketplaces expand, the risk of encountering malicious Openclaw Skills increases significantly. This tool performs deep static analysis of skill directories, scripts, and documentation to identify high-risk patterns such as prompt injection, unauthorized network calls, and obfuscated payloads.
By prioritizing security before installation, Skill Scanner helps prevent supply chain attacks, credential harvesting, and remote code execution. It provides a transparent risk assessment for every scanned skill, allowing developers to maintain a clean and safe automation environment without sacrificing the extensibility offered by new Openclaw Skills.
Skill Scanner Use Cases
- Evaluating the safety of new Openclaw Skills found on public marketplaces like ClawHub.
- Performing a security audit on all currently installed Openclaw Skills to ensure no hidden vulnerabilities exist.
- Verifying the integrity of binary assets and prebuilt executables using SHA-256 checksums.
- Detecting typosquatting attempts where malicious developers use names similar to popular Openclaw Skills to trick users.
How Skill Scanner Works
- The scanner accepts a path to a skill directory, a specific SKILL.md file, or a command to audit all installed Openclaw Skills.
- It parses the metadata and markdown content to identify suspicious URLs, non-HTTPS links, and prompt injection attempts.
- The engine analyzes script files for dangerous operations, including file system writes outside expected paths, environment variable access, and shell command execution.
- Binary files are checked against generated SHA-256 manifests to detect unauthorized tampering or library injection.
- A risk level is assigned—ranging from CLEAN to CRITICAL—providing a detailed report of findings to the user.
Skill Scanner Setup
Ensure you have python3 installed on your system. To scan a local directory containing Openclaw Skills, use the following command:
python3 {baseDir}/scripts/scanner.py scan --path ~/.openclaw/skills/target-skill/
To perform a comprehensive audit of all currently active Openclaw Skills, run:
python3 {baseDir}/scripts/scanner.py scan-all
Skill Scanner Data Schema & Taxonomy
Skill Scanner organizes its security analysis based on the following taxonomy:
| Analysis Type | Focus Area | Specific Checks |
|---|---|---|
| SKILL.md | Documentation | Suspicious URLs, prompt injection, credential requests |
| Script Analysis | Logic & Code | Network calls, shell=True, env variable harvesting |
| Name Analysis | Identity | Typosquatting, edit distance to popular Openclaw Skills |
| Binary Assets | Integrity | SHA-256 checksum verification, tampering detection |
Skill Scanner Advanced Features
- Binary/Asset checksum verification to ensure the security of prebuilt executables within Openclaw Skills.
- JSON output support for integrating security scan results into automated DevSecOps workflows.
- Deep script analysis capable of identifying cryptocurrency wallet patterns and hidden telemetry leaks.
- Detailed risk level reporting that categorizes vulnerabilities into Critical, High, Medium, and Low priorities.
- Support for scanning dynamic instruction fetching and fetch-and-execute patterns in complex Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
Skill Health Monitor
A proactive monitoring utility designed to track performance drift, error rates, and resource usage for deployed AI skills.
Agent GitOps
Automated deployment, rollback, and version management for AI agent workflows and skills.
Skill Differ
A specialized security utility to compare different versions of Openclaw Skills and detect new, potentially dangerous capabilities before updating.
ARC Security MCP Server
A high-fidelity security intelligence service providing real-time auditing, static analysis, and semantic threat detection for the AI agent ecosystem.
Trust Verifier
A security auditing tool that assesses the provenance, integrity, and publisher reputation of Openclaw Skills to ensure safe installation and execution.
Wake State
A persistence layer for AI agents to maintain state, tasks, and checkpoints across crashes and context window resets.
METADATA
Featured*
