A specialized security auditing tool designed to detect malware, prompt injections, and supply chain vulnerabilities in any skill before installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install claws-security-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install claws-security-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Security Scanner?
The Skill Security Scanner is a critical defense utility developed to protect users from malicious code and compromised dependencies. It acts as a gatekeeper for your AI environment, performing deep inspections of Skill files to identify high-risk patterns such as credential harvesting, hidden exfiltration directives, and obfuscated commands. By using this tool, you can verify the integrity of various Openclaw Skills before they are granted permissions on your system.
This scanner was specifically designed to address modern AI-specific threats, including prompt injection and instruction overrides that could lead to unauthorized data access. It provides a transparent scoring system and detailed remediation advice, making it an essential part of a secure development and deployment lifecycle.
Skill Security Scanner Use Cases
- Auditing a third-party skill for malicious code before initial installation.
- Scanning internal skill directories to ensure compliance with security best practices.
- Identifying hidden prompt injection vulnerabilities in AI agent instructions.
- Detecting suspicious outbound network calls or environmental variable dumps.
- Automated security gating in CI/CD pipelines for developers creating new Openclaw Skills.
How Skill Security Scanner Works
- The user provides the file path to the skill directory or manifest file via the CLI.
- The scanner performs a multi-category analysis, beginning with malware detection for suspicious shell commands and destructive operations.
- It evaluates the AI instructions for prompt injection attempts, looking for permission bypasses or hidden directives.
- The engine checks for obfuscation techniques, such as Base64 encoding or charcode tricks, intended to hide malicious intent.
- Supply chain risks are assessed by checking post-installation scripts and dependency pinning.
- A security grade (A-F) is calculated based on a 100-point system with weighted deductions for identified issues.
Skill Security Scanner Setup
You can run the security scanner directly using npx to check any local skill path:
npx @claws-shield/cli scan <path-to-skill>
Alternatively, you can integrate the scanner programmatically into your own Node.js automation workflows:
node scripts/run-scan.mjs <path-to-skill>
Skill Security Scanner Data Schema & Taxonomy
The Skill Security Scanner generates a structured report to help users evaluate the safety of their Openclaw Skills. The output includes the following metadata:
| Attribute | Description |
|---|---|
| Security Grade | A letter grade (A through F) representing the overall safety level. |
| Confidence Score | A metric indicating the certainty of the scan results. |
| Severity Breakdown | Issues categorized by impact: Critical (-30), High (-15), Medium (-7), and Low (-3). |
| Recommendation | A clear guidance on whether the skill is safe to install. |
| Remediation | Detailed suggestions on how to fix identified vulnerabilities. |
Skill Security Scanner Advanced Features
- Composite correlation rules that identify complex attack patterns across multiple files.
- Manual review flags for patterns that require human oversight but aren't explicitly malicious.
- Detection of typosquatting and unpinned dependencies in the supply chain category.
- Comprehensive scanning for data exfiltration patterns, including secret file access and env dumps.
SKILL.md
Loading
Related Openclaw Skills
Lab2Startup Tech-Market Fit Strategy
A strategic framework for academic and technical teams to align cutting-edge technology with real-world market demands.
Coding Agent
A high-performance background execution skill that delegates software engineering tasks to autonomous agents like Codex, Claude Code, and Pi.
Agent Intelligence
A research-backed intelligence database for uncovering hidden features, model codenames, and feature flags within AI coding tools.
Buddy Gacha
A deterministic electronic pet collection system based on the original Claude Code Buddy mechanics.
TJWeather Skill
A robust weather forecasting skill providing global meteorological data with intelligent geocoding fallbacks for AI agents.
Lab2Startup Team Selector
A strategic framework designed to analyze and select the optimal leadership model for teacher-student co-creation startup teams.
Featured*
