A security auditing tool designed to detect malware, credential theft, and prompt injection within Openclaw Skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawhub-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawhub-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawHub Scanner?
ClawHub Scanner is an essential security utility for developers and power users who want to ensure their automation environment remains secure. As the ecosystem for Openclaw Skills grows, so does the risk of malicious actors deploying obfuscated payloads or data exfiltration scripts. This tool specifically targets the ClawHavoc campaign and other known threats by scanning skill source code for suspicious behaviors.
By integrating this scanner into your workflow, you can proactively identify risks such as command-and-control (C2) infrastructure connections, unauthorized filesystem access, and credential harvesting. It provides a vital layer of defense, ensuring that the Openclaw Skills you install are trustworthy and safe for production use.
ClawHub Scanner Use Cases
- Scanning newly installed Openclaw Skills for potential malware or backdoors.
- Auditing local skill development for security vulnerabilities before distribution.
- Automated security gating in CI/CD pipelines using JSON output and exit codes.
- Identifying prompt injection risks and broad filesystem permissions that could lead to data leaks.
How ClawHub Scanner Works
- The scanner is executed via the command line, targeting either all installed Openclaw Skills or a specific local directory.
- It performs a pattern-based analysis of the skill's source code, looking for known malicious IPs, domains, and obfuscation techniques.
- The tool identifies high-risk functions such as eval() or unauthorized access to sensitive directories like SSH or AWS configurations.
- Findings are categorized by severity (Critical, High, Medium, Low) to help users prioritize remediation.
- The process concludes with a detailed report and a specific exit code, allowing for automated security enforcement.
ClawHub Scanner Setup
To install the scanner, ensure you have Node.js installed and run the following command:
npm install -g @elvatis_com/clawhub-scanner
Once installed, you can scan all your Openclaw Skills using:
clawhub-scanner scan
ClawHub Scanner Data Schema & Taxonomy
The scanner categorizes security findings into a structured hierarchy of risk levels:
| Severity | Detection Category | Description |
|---|---|---|
| Critical | C2 Infrastructure | Detects known malicious IPs and domains linked to the ClawHavoc campaign. |
| High | Credential Theft | Identifies attempts to harvest SSH, AWS, browser, or wallet credentials. |
| Medium | System Integrity | Flags prompt injection, broad filesystem access, and clipboard harvesting. |
| Low | Network Indicators | Reports generic outbound HTTP or WebSocket connections for manual review. |
ClawHub Scanner Advanced Features
- Multi-format output including human-readable reports and machine-parseable JSON for advanced Openclaw Skills automation.
- Verbose mode to surface low-severity findings and network activity logs.
- Targeted scanning parameters to audit specific skill paths during the development lifecycle.
- Exit code signaling (0 for clean, 1 for high-risk, 2 for critical) for integration with shell scripts and security monitors.
SKILL.md
Loading
Related Openclaw Skills
snipit
A secure utility for sharing encrypted code snippets and sensitive files with automated expiration and password protection.
Echo - Perplexity Ultimate Async Researcher
A high-performance AI agent skill for executing concurrent, deep-dive web research using the Perplexity Search API.
OpenClaw Manager
A professional-grade operations toolkit for deploying, hardening, and managing OpenClaw environments with production-safe defaults.
MCP App Builder
A specialized developer tool for scaffolding and implementing MCP servers that feature integrated React-based user interfaces.
OpenClaw Docker Plugin
A powerful plugin for managing Docker environments and Compose projects through AI agent commands.
Openclaw GPU Bridge
A high-performance bridge for offloading BERTScore and embedding calculations to remote GPU infrastructure.
Featured*
