A local-first security scanner providing static analysis and threat detection for Openclaw Skills to prevent malware and credential leaks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawskillshield
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawskillshield using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawSkillShield?
ClawSkillShield is a specialized security auditing tool designed specifically for the Openclaw ecosystem. It serves as a local-first defense layer that performs deep static analysis on skills before they are executed or integrated into an agent's workflow. By scanning for malicious patterns, risky imports, and exposed secrets, it provides developers and autonomous agents with the transparency needed to maintain a secure environment.
Developed in response to emerging security threats in the AI agent space, this tool ensures that Openclaw Skills remain a safe and trusted resource. It operates with zero external dependencies and makes no network calls, ensuring that your private code and local environment remain completely isolated during the auditing process.
ClawSkillShield Use Cases
- Auditing third-party Openclaw Skills for hidden malware or hardcoded IPs before installation.
- Programmatic safety checks where an autonomous agent scans a new skill and quarantines it if the risk score is too high.
- Detecting accidental leaks of API keys, private credentials, or hardcoded secrets in development repositories.
- Identifying dangerous execution patterns such as unauthorized use of eval() or suspicious obfuscation techniques.
How ClawSkillShield Works
- The user or an automated agent points ClawSkillShield to the local directory of one or more Openclaw Skills.
- The scanner parses the source code using static analysis to identify risky imports like os, subprocess, or socket.
- It checks for known malicious patterns, including base64 obfuscation and hardcoded IP addresses.
- The system calculates a risk score between 0 and 10 based on the severity of the findings.
- A detailed threat report is generated, and high-risk skills can be automatically moved to a secure quarantine folder to prevent execution.
ClawSkillShield Setup
To get started with securing your Openclaw Skills, install the package locally using pip:
pip install -e .
# To scan a local skill directory
clawskillshield scan-local /path/to/skill
# To quarantine a suspicious skill manually
clawskillshield quarantine /path/to/skill
ClawSkillShield Data Schema & Taxonomy
ClawSkillShield organizes its security findings and metadata using a clear taxonomic structure for better integration with Openclaw Skills management:
| Field | Type | Description |
|---|---|---|
| risk_score | Integer | A value from 0 (Safe) to 10 (Critical Threat). |
| detected_threats | List | Specific code patterns or imports flagged during analysis. |
| file_path | String | The location of the scanned skill on the local filesystem. |
| status | String | Current state of the skill (Scanned, Quarantined, or Verified). |
ClawSkillShield Advanced Features
- Local-first architecture with zero external network dependencies for maximum privacy.
- Dual-use interface providing both a CLI for human developers and a Python API for autonomous AI agents.
- Automated quarantine system that isolates high-risk Openclaw Skills programmatically.
- Comprehensive threat detection including secret scanning, obfuscation checks, and dangerous syscall analysis.
SKILL.md
Loading
Related Openclaw Skills
Intel AI Search (x402)
Intel is an AI-powered search tool that uses x402 micropayments on the Base network to provide real-time, cited web information directly to your coding agent.
Obsidian Clip
A sophisticated tool to convert URLs into readable, summarized markdown notes saved directly to your Obsidian vault.
Nutrition Tracker
A professional nutrition logging system that syncs daily caloric and macronutrient data directly to your Obsidian vault using profile-based target logic.
Roofing Knowledge Mentor
A senior-level AI consultant for roofing contractors and adjusters that provides expert reasoning for measurements, insurance claims, and business operations.
GenLayer Intelligent Contracts
Build Python smart contracts that leverage LLMs and web data with blockchain consensus.
GenLayer Knowledge Skill
A technical knowledge repository for understanding GenLayer, the first AI-native blockchain enabling trustless decision-making through LLM consensus.
Featured*
