A lightweight security auditor that scans binaries and scripts for malicious patterns and suspicious API calls.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install openscan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install openscan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is OpenScan?
OpenScan is a critical security utility designed to protect developers within the Openclaw Skills ecosystem. Ported from the Harkonnen antimalware engine, it provides deep inspection capabilities for macOS and Linux systems, ensuring that binaries and scripts are safe to execute. By analyzing file structures and identifying dangerous patterns, it acts as a gatekeeper for any untrusted code or third-party dependencies you might encounter.
This skill is particularly valuable for developers who frequently install or evaluate new automated tools. By integrating OpenScan into your workflow, you add a layer of defense against process injection, keylogging, and unauthorized network communication. It ensures that every component in your Openclaw Skills library meets a baseline security standard before it is trusted.
OpenScan Use Cases
- Scanning new binaries or scripts before adding them to your Openclaw Skills collection.
- Auditing third-party tool dependencies for suspicious shell patterns like curl piped to bash.
- Detecting packed or encrypted binaries that may be hiding malicious payloads via high entropy analysis.
- Verifying code signatures and security features like PIE and NX on macOS and Linux binaries.
How OpenScan Works
- The user provides a path to a binary, script, or directory for analysis.
- OpenScan performs binary parsing for Mach-O (macOS) or ELF (Linux) formats to check for suspicious dylibs or shared objects.
- The engine scans for specific byte sequences representing shellcode or dangerous API references.
- Script analysis is performed to identify obfuscation, privilege escalation attempts, or dangerous network indicators.
- A threat score from 0 to 100 is calculated based on the cumulative severity of all findings.
- The tool outputs a detailed report and returns an exit code corresponding to the threat level.
OpenScan Setup
To get started with OpenScan as part of your Openclaw Skills toolkit, ensure you have Node.js version 18 or higher installed. Follow these steps to set up the scanner:
# Navigate to the OpenScan directory
# Install dependencies
npm install
# Perform a test scan on a local file
node bin/scan.js /path/to/binary
OpenScan Data Schema & Taxonomy
OpenScan provides structured feedback to help users evaluate the safety of their files. The data is organized into threat levels and scoring categories:
| Score | Threat Level | Action Required |
|---|---|---|
| 0-20 | CLEAN | No significant findings; safe to use. |
| 21-40 | LOW | Minor concerns detected; proceed with caution. |
| 41-60 | MEDIUM | Suspicious patterns found; manual review recommended. |
| 61-100 | HIGH/CRITICAL | Malicious patterns detected; do not execute. |
When using the --json flag, the tool returns a schema containing the threatScore, an array of findings, and file metadata for integration with other Openclaw Skills.
OpenScan Advanced Features
- Programmatic API support allowing for automated security gates within custom Openclaw Skills.
- Entropy-based detection to identify obfuscated code that traditional signature scanners might miss.
- Automated JSON output for seamless integration into security monitoring and CI/CD pipelines.
- Quiet mode execution to streamline automated auditing workflows without verbose console output.
SKILL.md
Loading
Related Openclaw Skills
Moltbook Validator
A specialized validation tool to ensure Moltbook API requests are correctly formatted and protected against spam bots.
Eidolon Search
A high-performance SQLite FTS5 search tool for AI Agent memory that reduces token consumption by over 90%.
Context Engine
A smart persistence layer that maintains conversation state and project continuity across multiple AI agent sessions.
ii-IRC: Event-Driven IRC for AI Agents
A minimalist, file-based IRC integration for AI agents that enables persistent presence and event-driven mention detection.
Scrapling MCP
An advanced web scraping skill for Openclaw that provides MCP-native guidance for data extraction, crawling, and anti-bot handling.
Scrapling MCP
An advanced web scraping skill for AI agents that provides strategy, anti-bot handling, and high-performance data extraction via the Model Context Protocol.
Featured*
