A security auditing tool that scans SKILL.md files for permission overreach, prompt injection, and scope mismatches to ensure agent safety.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawhub-security-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawhub-security-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Clawhub Security Scanner?
The Clawhub Security Scanner is a specialized auditing tool designed to protect users within the ecosystem of Openclaw Skills. It acts as a gatekeeper by inspecting the configuration files of AI coding agent skills to identify potential security threats before they are executed. By analyzing the SKILL.md document, this tool provides a clear assessment of whether a skill's requested permissions match its stated functionality, ensuring that your Openclaw Skills remain secure and predictable.
This skill is particularly effective at identifying hidden prompt injections and excessive tool requests that could lead to unauthorized system access. Whether you are a developer building new tools or a user exploring the directory of Openclaw Skills, this scanner provides the peace of mind needed to maintain a secure development environment.
Clawhub Security Scanner Use Cases
- Screening third-party skills from unfamiliar publishers before installation.
- Auditing skills that request high-risk permissions such as exec or write.
- Performing a quick sanity check on local configuration files during development of Openclaw Skills.
- Identifying hidden instructions that might attempt to override agent safety protocols.
How Clawhub Security Scanner Works
- The user provides a path, URL, or raw text of a SKILL.md file to the agent.
- The scanner utilizes the read and web_fetch tools to ingest the configuration data.
- A logic-based audit is performed across three core categories: Permission overreach, Prompt injection, and Scope mismatch.
- A risk score is calculated and presented in a structured report format compatible with Openclaw Skills.
- The report concludes with a clear recommendation: Install with confidence, Install with caution, or Do not install.
Clawhub Security Scanner Setup
The Clawhub Security Scanner requires no external API keys. It functions by utilizing standard agent tools. Ensure your environment supports the following configuration:
# Ensure these tools are available to your agent:
# read (for local file access)
# web_fetch (for auditing remote skills)
Simply add the skill to your local Openclaw Skills library to begin auditing.
Clawhub Security Scanner Data Schema & Taxonomy
| Key Component | Description |
|---|---|
| Permission Audit | Compares requires.tools against the skill's description to flag unnecessary access. |
| Injection Check | Scans for override language or hidden instructions that bypass agent safety. |
| Scope Validation | Ensures the skill's tags and summary align with its actual capabilities. |
| Risk Verdict | Returns a structured score (SAFE, LOW, MEDIUM, or HIGH) for easy decision making. |
Clawhub Security Scanner Advanced Features
- Multi-source auditing: Scan files from local paths, web URLs, or direct text input.
- Plain-English verdicts: Provides actionable insights rather than just technical jargon within Openclaw Skills.
- Integration ready: Built to work seamlessly with the broader suite of Openclaw Skills.
- Upgrade path: Compatible with the ClawHub Security Pack for advanced 7-category deep-tissue auditing.
SKILL.md
Loading
Related Openclaw Skills
Forecast Analysis Claw
An intelligent inventory management and sales forecasting tool that leverages historical data to predict future demand and automate replenishment.
Create Psychological Counselor AI Skill
A specialized skill for building AI digital twins of psychological counselors from education, training, and consultation records to simulate therapeutic styles.
Ontology Agent Memory
A structured, typed knowledge graph system providing verifiable memory and composable state sharing for AI agents.
Comic Guide
A sophisticated AI skill that converts technical documentation, source code, and complex concepts into multi-panel, illustrated comic guides in various popular anime styles.
Markdown to PowerPoint (PPTX) Converter
A specialized conversion tool that transforms Markdown documents with slide separators into PowerPoint presentations.
IR35 Status Assessment
An AI-driven tool for assessing UK IR35 employment status using real-world case law and HMRC guidance.
UK Food Hygiene & HACCP Documentation Generator
An AI-powered documentation engine for generating inspection-ready UK food safety management systems and HACCP plans.
Featured*
