A specialized security scanner that audits AI agent skills for 69+ threat patterns, including code injection and credential theft.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install isnad-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install isnad-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is isnad-scan?
isnad-scan is a high-performance security auditing tool designed specifically for the AI agent ecosystem. It serves as a critical defense layer for developers using Openclaw Skills by scanning directories and packages for malicious code, suspicious patterns, and known vulnerabilities before they are executed in a local or production environment.
By analyzing source code for over 69 distinct threat patterns, including shell execution, path traversal, and prompt injection, this tool ensures that your agent integrations remain secure. Whether you are auditing third-party contributions or verifying your own packages, it provides the transparency needed to maintain a trusted chain of transmission for AI capabilities.
isnad-scan Use Cases
- Scanning a local directory or package before installing a new skill.
- Conducting periodic security audits on your existing library of Openclaw Skills.
- Validating community contributions and pull requests for malicious code patterns.
- Performing pre-publish checks to ensure your own skills are clean and safe for others.
- Integrating automated security gates into CI/CD pipelines to prevent supply chain attacks.
How isnad-scan Works
- The user points the scanner to a specific directory or package containing the skill code.
- The engine parses the files and matches them against a comprehensive library of 69+ security threat patterns.
- If the --cve flag is enabled, the tool queries OSV.dev to identify known vulnerabilities in the skill's dependencies.
- Findings are categorized by severity levels: CRITICAL, HIGH, MEDIUM, and LOW.
- A detailed report is generated in the console or as a JSON object, pinpointing the exact file and line number of each risk.
isnad-scan Setup
To install isnad-scan for managing Openclaw Skills, use pipx for a clean, isolated installation:
pipx install isnad-scan
To perform a basic scan of a directory:
isnad-scan <path_to_directory>
To perform a full audit including dependency vulnerabilities:
isnad-scan <path> --cve -v
isnad-scan Data Schema & Taxonomy
The scanner generates structured findings to help developers assess the safety of Openclaw Skills. Data is organized by severity and category as follows:
| Severity | Impact | Action Required |
|---|---|---|
| CRITICAL | Immediate threat | Do not install; malicious intent likely |
| HIGH | Dangerous pattern | Review source code carefully before use |
| MEDIUM | Suspicious code | Verify intent; common in some legitimate tasks |
| LOW | Informational | General awareness of code behavior |
When using the JSON output mode, the tool provides a machine-readable summary of findings, file paths, and matched code snippets.
isnad-scan Advanced Features
- CVE detection via OSV.dev integration for dependency security.
- Verbose output mode to visualize exact code lines triggering security alerts.
- Machine-readable JSON formatting for automated security reporting.
- Native Python API allowing developers to embed security scanning within their own AI agents.
- Comprehensive detection coverage including crypto risks, reverse shells, and role-override prompt injection patterns.
SKILL.md
Loading
Related Openclaw Skills
yt-digest
An efficient AI skill for extracting transcripts, summaries, and key highlights from YouTube content.
Soulmate
Soulmate is an emotionally intelligent companion skill that transforms standard AI agents into evolving life partners through dynamic personality systems and intimacy tracking.
Skill Audit
A specialized security auditing tool designed to scan and detect malicious patterns or vulnerabilities within Openclaw Skills.
Molt-Solver
An expert skill designed to automatically resolve mathematical word problem CAPTCHAs for Moltbook users.
ERCData
ERCData is a blockchain-integrated skill for storing, verifying, and managing AI data fingerprints on the Base network using the ERCData standard.
Rei Qwen3 Coder
A specialized skill for integrating Rei Qwen3 Coder as a model provider with automated setup and switching capabilities.
Featured*
