A pre-publish security auditing tool designed to identify and fix code patterns that trigger security flags on ClawHub.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawhub-security-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawhub-security-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawHub Security Scan?
ClawHub Security Scan is a specialized developer utility created to help creators of Openclaw Skills audit their code before submission. It targets code patterns that frequently trigger automated security flags, such as those from VirusTotal Code Insight, which can lead to agents being marked as suspicious. By analyzing scripts for high-risk behaviors like hard-coded credentials or dangerous function usage, this tool helps maintain the reputation and reliability of your published agents.
This security suite provides developers with clear, actionable feedback, allowing them to refactor code using safer alternatives or document why certain patterns are necessary. Integrating this tool into your development workflow ensures that your Openclaw Skills are perceived as trustworthy and professional by the end-user community.
ClawHub Security Scan Use Cases
- Detecting hard-coded API keys or tokens in source code before they are leaked.
- Identifying dangerous execution functions like eval() or exec() that could be exploited.
- Reducing false positive security flags by auditing environment variable access and network requests.
- Preparing high-quality Openclaw Skills for publication by following the interactive pre-publish checklist.
How ClawHub Security Scan Works
- The developer runs the scan script against the local directory containing their Openclaw Skills code.
- The scanner parses the code for patterns categorized into High Risk (sensitive file access, dynamic code) and Medium Risk (env vars, HTTP requests).
- A risk rating (High/Medium/Low/Good) is assigned to each file based on the severity of the findings.
- Developers use the review command to receive specific line-by-line modification suggestions.
- The interactive wizard guides the developer through a final checklist to ensure all security best practices are met.
ClawHub Security Scan Setup
To begin auditing your project, ensure you have Python installed and access to the script folder. Run the following command to scan your specific skill directory:
python scripts/scan.py --path ./my-skill
For a guided experience before submission, use the pre-publish wizard:
python scripts/precheck.py
ClawHub Security Scan Data Schema & Taxonomy
The scan engine relies on a combination of regex-based pattern matching and local configuration files to organize its findings.
| Attribute | Description |
|---|---|
| Risk Rating | Categorizes files as High, Medium, Low, or Good based on security posture |
| Patterns | Matches code against a database of known suspicious function calls and file paths |
| Ignore Config | Uses a .clawhub-security file to exclude specific safe patterns from reports |
| Exit Status | Returns a non-zero exit code if high-risk issues are detected, suitable for CI/CD |
ClawHub Security Scan Advanced Features
- Custom Configuration: Create a
.clawhub-securityfile to ignore known-safe patterns such as specific environment variable lookups. - Interactive Wizard: A step-by-step pre-publish checklist that ensures no security step is missed for your Openclaw Skills.
- Automated Refactoring Advice: The review tool doesn't just find bugs; it provides specific code alternatives to improve security.
- CI/CD Integration: Programmatic exit codes allow you to block unsafe builds of Openclaw Skills during the automated testing phase.
SKILL.md
Loading
Related Openclaw Skills
Slack Assistant
A powerful command-line integration for Slack that leverages AI to summarize channels, draft responses, and manage workspace communication efficiently.
MIA-Trust Pipeline
An advanced security and memory pipeline for AI agents that ensures safe plan execution through multi-dimensional guarding and evolutionary learning.
Stock Roundtable
A sophisticated investment research skill that simulates expert multi-perspective debates to provide evidence-based stock analysis and decision support.
Video Monetization Pro
A comprehensive end-to-end automation skill for AI video creators to research, produce, publish, and track revenue automatically.
Contract Signing Workflow Assistant
A specialized assistant for designing structured eSignature workflows, approval hierarchies, and secure document signing sequences.
Travel Mapify (flyai-travelmapify)
An advanced AI skill for generating interactive, geocoded travel maps from text or images with integrated FlyAI hotel search.
Featured*
