A pre-execution security linter that audits Openclaw Skills for malicious patterns and assigns safety risk scores.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install claw-lint
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install claw-lint using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawLint Security Scanner?
ClawLint is a dedicated security auditing tool designed specifically for Openclaw Skills. It performs deep static code analysis on installed skills without ever executing the code, making it safe to use on untrusted third-party contributions. By scanning both workspace and system directories, it identifies dangerous behaviors like remote execution, credential theft, and unauthorized file system access.
With a significant percentage of community-contributed tools potentially containing flaws, ClawLint serves as a critical defense layer. It provides developers and system administrators with a transparent risk assessment through numeric scoring and integrity monitoring, ensuring that every skill in your environment is verified and secure.
ClawLint Security Scanner Use Cases
- Audit Openclaw Skills from untrusted community sources before their first execution.
- Detect hidden backdoors, credential harvesters, or malicious remote execution patterns in scripts.
- Monitor file integrity of mission-critical skills using SHA256 hashing to identify unauthorized tampering.
- Integrate security gating into CI/CD pipelines to automatically block high-risk skills from production environments.
How ClawLint Security Scanner Works
- The scanner performs a static analysis of the skill directory to locate shell scripts and binaries.
- It searches for specific high-risk patterns such as piping remote content to a shell or accessing sensitive SSH directories.
- Based on the detected flags, it calculates a weighted risk score from 0 (safe) to 100 (critical).
- If requested, it generates SHA256 checksums for every file within the skill to create a security baseline.
- The final report is rendered as a human-readable table or a machine-readable JSON object for automated processing.
ClawLint Security Scanner Setup
ClawLint requires Bash 4.0+ and standard Unix utilities. Follow these steps to begin auditing your Openclaw Skills:
# Run a summary scan of all installed skills
./bin/claw-lint.sh
# Audit a specific skill by name
./bin/claw-lint.sh --skill hashnode-publisher
# Generate a full security inventory with SHA256 hashes
./bin/claw-lint.sh --full --format json > security-audit.json
ClawLint Security Scanner Data Schema & Taxonomy
ClawLint organizes its security findings into a structured format. The JSON output includes a root object with scan metadata and a detailed results array:
| Attribute | Type | Description |
|---|---|---|
skill_name |
String | The identifier for the analyzed skill. |
risk_score |
Integer | Calculated threat level from 0 to 100. |
flags |
Array | List of detected patterns (e.g., pipes_remote_to_shell). |
files |
Array | Metadata for each file including SHA256 hashes and size. |
total_size |
String | Cumulative size of all files in the skill directory. |
ClawLint Security Scanner Advanced Features
- Automated CI/CD integration scripts to fail builds when Openclaw Skills exceed specific risk thresholds.
- Baseline comparison mode to detect file-level changes or tampering in production environments.
- Configurable risk filtering using the
--min-scoreflag to focus on high-priority threats. - Strict auditing mode that prioritizes high-severity patterns and skips large binary files to optimize scan performance.
SKILL.md
Loading
Related Openclaw Skills
COS Upload
A streamlined utility for uploading files to Tencent Cloud Object Storage with automatic URL and signed link generation.
OpenClaw Guardrails
A deterministic security layer for AI agents that classifies command risks and enforces safety policies before execution.
wip-x
A comprehensive X Platform interface for reading tweet data and performing automated posting actions via API.
wip-grok
A comprehensive xAI Grok integration for real-time web and social search combined with multi-modal AI media generation.
Clinical Trials Search
A powerful AI skill for querying and analyzing real-time clinical trial data from ClinicalTrials.gov.
Medical Research Toolkit
A unified MCP endpoint to query 14+ major biomedical databases for drug discovery, clinical trials, and literature research.
Featured*
