Clawscan is a specialized security auditing tool designed to perform first-pass vulnerability checks and malicious hash detection for your deployment.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawscan-autosec-dev
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawscan-autosec-dev using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Clawscan?
Clawscan provides a critical security layer for developers and researchers utilizing the platform. It functions as a read-only auditing agent that identifies known vulnerabilities in the core platform, detects malicious hashes within installed skills, and flags potentially dangerous network listener configurations. By integrating this skill, users gain an automated security companion that ensures their local environment adheres to safety best practices without requiring manual intervention.
This security-focused addition to the ecosystem of Openclaw Skills focuses on privacy and transparency. It avoids collecting sensitive data like secrets or environment variables, instead focusing on structural metadata and version ranges. Whether you are running a single-user setup or a distributed deployment, Clawscan helps maintain a hardened posture by providing actionable evidence and clear remediation steps for identified risks.
Clawscan Use Cases
- Assess if a local deployment is vulnerable to known security exploits by checking version ranges.
- Verify the integrity of installed Openclaw Skills by matching file hashes against a known-malicious corpus.
- Audit system network ports to detect if the AI agent or its services are unintentionally exposed to non-local interfaces like 0.0.0.0.
- Automate security monitoring with scheduled scans that only alert the user when specific risks are detected, ensuring a silent but secure workflow.
How Clawscan Works
- Intent Mapping: The agent identifies the security task, such as a manual scan or a registration request.
- Local Evidence Collection: Specialized scripts gather minimal metadata, such as computing SHA-256 hashes for skill files or listing listening sockets via system tools like ss or lsof.
- API Communication: The skill submits the collected evidence (version numbers, hashes, or port bindings) to the analysis API.
- Risk Assessment: The service compares the data against vulnerability databases and malicious registries.
- Structured Reporting: Results are presented in a standardized report format including status, risk level, evidence, and specific recommended next steps.
Clawscan Setup
To get started with this security skill, ensure your environment meets the binary requirements (Python 3 and either ss or lsof).
# Verify dependencies
python3 --version
ss --version # or lsof
# Initialize the skill via your agent
# "Set up clawscan and register this client"
Clawscan Data Schema & Taxonomy
Clawscan maintains minimal local state to manage identity and automation intervals. It organizes data according to the following structure:
| File Path | Description | Key Metadata |
|---|---|---|
~/.openclaw/clawscan/client.json |
Persistent Identity | A random UUID v4 client_id |
~/.openclaw/clawscan/schedule.json |
Automation State | Interval minutes and last_run_utc timestamp |
| Skill Manifest | Analysis Payload | Skill name, relative path, and SHA-256 hash |
Clawscan Advanced Features
- Scheduled Security Audits: Configure recurring scans to monitor environment integrity automatically at user-defined intervals.
- Silence-on-Success Reporting: The scheduler only generates output when risks are found, minimizing notification fatigue while maintaining a high security posture.
- Network Exposure Analysis: Detailed auditing of bind addresses to distinguish between safe loopback services and risky public-facing interfaces.
- Integrity Verification: Deep scanning of Openclaw Skills to ensure no known malicious code has been introduced to your workspace.
SKILL.md
Loading
Related Openclaw Skills
Claude Code Controller
The Claude Code Controller is a robust integration for Openclaw Skills that enables seamless management of the Anthropic Claude Code CLI for autonomous software engineering.
Nutrition Planner
A comprehensive personal nutrition and meal planning system that automates calorie tracking and recipe recommendations based on user goals.
PCS-EPBP Data Automation
Automate the extraction of PCS table data and its seamless import into the EPBP system via Excel.
A-Share Comprehensive Analysis Tool
A sophisticated analytical suite for the Chinese A-share market that delivers real-time quotes, technical indicators, and automated financial reports.
botauth
A secure CLI-based skill for retrieving secrets and credentials from a desktop vault with human-in-the-loop approval.
Obsidian Writer
A specialized skill for generating Obsidian-compatible Markdown notes and visual Canvas diagrams with automated Git synchronization.
Featured*
