A lightweight tool to scan Node.js dependencies and Linux packages for known vulnerabilities using the Google OSV API.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install osv-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install osv-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is NPM & Node.js OSV Vulnerability Scanner?
The NPM & Node.js OSV Vulnerability Scanner is a specialized utility designed to audit project dependencies against the Google Open Source Vulnerabilities (OSV) database. By integrating this tool into your development workflow, you can proactively identify and mitigate security risks within your NPM packages and Linux system libraries. As a robust addition to your library of Openclaw Skills, it provides a streamlined interface for security auditing that bridges the gap between coding and production safety.
This skill is particularly valuable for developers who need to maintain high security standards without manual lookup of every individual dependency. It automates the extraction of package data and cross-references it with live vulnerability databases to return actionable CVE information.
NPM & Node.js OSV Vulnerability Scanner Use Cases
- Scanning package.json files for known security vulnerabilities in Node.js projects.
- Auditing Linux package lists to identify outdated or insecure system dependencies.
- Generating security reports before deploying code to production environments.
- Integrating automated security checks into local developer workflows using Openclaw Skills.
How NPM & Node.js OSV Vulnerability Scanner Works
- The scanner reads package definitions from the packages/ directory, specifically looking for package.json or packages.txt.
- It extracts the exact names and version numbers for all declared dependencies.
- The skill queries the Google OSV API with the collected package metadata.
- It processes the API response to identify specific CVEs and vulnerability details.
- The results are output to the user, providing a clear overview of any security risks detected.
NPM & Node.js OSV Vulnerability Scanner Setup
Prerequisites
Ensure you have Python 3 and pip installed on your system.
Installation
# Create and activate a virtual environment
python3 -m venv .venv
source .venv/bin/activate # Windows: .\.venv\Scripts\Activate.ps1
# Install required Python libraries
pip install requests openpyxl
Configuration
- Prepare your package data:
- For Node.js: Copy your
package.jsonto the/packagesfolder and ensure it is namedpackages.json. - For Python/Linux: Run
pip freeze > packages.txtand move it to the/packagesfolder.
- For Node.js: Copy your
- Important: Navigate to the template directory and change the
ScanResultfile extension from.txtto.xlsxto ensure proper report generation. - Run the scanner:
python3 scanner.py npm
NPM & Node.js OSV Vulnerability Scanner Data Schema & Taxonomy
The skill organizes vulnerability data through a simple input/output file structure:
| File Name | Purpose | Format |
|---|---|---|
| packages.json | Input: Node.js dependency list | JSON |
| packages.txt | Input: Python or Linux package list | Plain Text |
| ScanResult.xlsx | Output: Detailed vulnerability report | Excel (XLSX) |
The output report provides a structured view of identified CVEs, linking specific package versions to known security advisories found via Openclaw Skills.
NPM & Node.js OSV Vulnerability Scanner Advanced Features
- Support for Google OSV API integration for real-time security data.
- Dual-ecosystem scanning capability for both NPM (Node.js) and Python/Linux environments.
- Automated report generation in Excel format for easy sharing and auditing.
- Cross-platform compatibility for seamless operation on both Windows and Linux systems.
- Lightweight CLI interface designed to be used alongside other Openclaw Skills for full-stack security management.
SKILL.md
Loading
Related Openclaw Skills
Django Environment Bootstrapper
A comprehensive tool for automating the setup and provisioning of standardized Django and Django REST Framework development environments.
Django Environment Provisioner
Automate the provisioning of production-ready Django and Django REST Framework environments to eliminate manual setup time.
ClawPlay
ClawPlay allows your AI agents to play competitive games like poker autonomously on the clawplay.fun platform while you watch the action live.
ClawPlay
A gaming-focused skill that empowers AI agents to autonomously compete in live games like No-Limit Hold'em poker on the clawplay.fun platform.
Elite RFC Writer
An expert AI skill for drafting precise, decision-oriented engineering RFCs and architecture proposals using a strict, high-performance template.
Restic Home Backup
A production-ready solution for automated, encrypted, and deduplicated Linux home directory backups using restic and systemd.
Featured*
