A specialized security tool designed to analyze and verify the safety of AI agent skills, protecting against malware, prompt injection, and data exfiltration.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install aura-security-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install aura-security-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is AURA Security Scanner?
The AURA Security Scanner acts as a critical security layer for the AI agent ecosystem, specifically designed to audit Openclaw Skills before they are integrated into a workflow. By leveraging the AURA (Agent Universal Reputation & Assurance) infrastructure, it provides developers and users with the peace of mind that their skills are free from malicious code, backdoors, or suspicious network connections.
This skill performs a comprehensive analysis of the target codebase, checking for everything from obfuscated JavaScript patterns to overly broad filesystem permissions. Whether you are downloading a new tool from a public repository or building your own, this scanner ensures that every addition to your agent's repertoire is safe and trustworthy.
AURA Security Scanner Use Cases
- Scanning third-party Openclaw Skills from GitHub or Clawhub before local deployment.
- Auditing Claude MCP and LangChain tools for potential credential theft or exfiltration patterns.
- Detecting and preventing prompt injection attacks designed to hijack agent system instructions.
- Verifying the reputation and safety status of new skills within a CI/CD development pipeline.
How AURA Security Scanner Works
- The user provides a URL or path to a skill that needs to be analyzed.
- The scanner communicates with the AURA Security API to initiate a deep-code scan.
- The skill evaluates the source for malware signatures, suspicious domain connections, and risky permissions.
- A detailed security report is generated, assigning a Risk Score and a final Verdict (SAFE, WARNING, DANGEROUS, or BLOCKED).
- The user receives a clear recommendation on whether to proceed with the installation of the specific Openclaw Skills based on the findings.
AURA Security Scanner Setup
To enable the AURA Security Scanner, you must configure your environment with the AURA API endpoint.
- Set the required environment variable in your terminal or configuration file:
export AURA_API_URL="https://api.aurasecurity.io"
- Integrate the skill into your agent framework to begin scanning Openclaw Skills immediately.
AURA Security Scanner Data Schema & Taxonomy
The AURA Security Scanner produces a structured security report following this data model:
| Field | Type | Description |
|---|---|---|
| Verdict | String | The final security classification (SAFE to BLOCKED) |
| Risk Score | Integer | A score from 0-100 indicating the severity of found issues |
| Findings | List | Specific details on detected threats like SSH key access or SSH injection |
| AURA Verified | Boolean | Indicates if the skill has passed all safety checks for the verified badge |
| Recommendation | String | Plain-text guidance on installation safety |
AURA Security Scanner Advanced Features
- Comprehensive support for various formats including Openclaw Skills, MCP tools, and LangChain integrations.
- Advanced detection of obfuscated code including Base64 and Hex-encoded execution patterns.
- Real-time monitoring of network requests to known malicious exfiltration sites like webhook.site.
- Detailed permission auditing to flag unnecessary access to sensitive filesystem paths like ~/.ssh/id_rsa.
- Access to the AURA Verified Badge program for developers to prove their skills are secure.
SKILL.md
Loading
Related Openclaw Skills
coda-ai
A specialized CLI tool designed to allow AI agents to list, browse, and read content from Coda.io documents in LLM-optimized formats.
Spec Kit
A framework for Spec-Driven Development that transforms natural language specifications into executable implementation plans for AI agents.
Trawl: Autonomous Agent Lead Generation
Trawl is an autonomous SDR agent that sweeps social networks to discover, score, and qualify business leads through semantic search and automated DMs.
Content Repurposer
Automatically transform long-form articles, transcripts, and notes into platform-optimized social media threads, posts, and newsletters while maintaining a consistent brand voice.
Arxiv Paper Reader
An intelligent LLM-powered agent that classifies and performs deep technical reading of Arxiv papers to generate comprehensive study notes.
Agent Spawner
A conversational utility for cloning and deploying new OpenClaw agents with existing configurations, keys, and tools.
Featured*
