ScopeCheck is a security auditing tool that analyzes AI skill metadata to identify discrepancies between declared requirements and actual resource access.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install scopecheck
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install scopecheck using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ScopeCheck?
ScopeCheck serves as a critical security layer for developers working with Openclaw Skills. By performing deep static analysis on SKILL.md files, it uncovers the true operational footprint of an AI agent, including the environment variables, binaries, and network endpoints it interacts with.
The tool acts as a trust-verification mechanism, ensuring that agents do not exceed their intended scope. It helps maintain the integrity of the Openclaw Skills marketplace by flagging undeclared access to sensitive system areas, such as credential files or unauthorized network URLs.
ScopeCheck Use Cases
- Auditing third-party Openclaw Skills before deployment to ensure they don't access sensitive environment variables.
- Verifying that all required CLI tools are properly documented in the skill metadata for smoother installation.
- Detecting potential security risks where an agent attempts to access filesystem paths like /etc/passwd or SSH configs.
- Validating network activity to ensure an agent only communicates with approved API endpoints.
How ScopeCheck Works
- The user provides the raw content of a SKILL.md file via a POST request to the ScopeCheck API.
- The system parses the frontmatter metadata to identify 'declared' requirements (bins and env vars).
- An analysis engine scans the entire markdown content to 'detect' actual references to CLI tools, environment variables, filesystem paths, and URLs.
- The tool performs a comparison between declared and detected assets.
- ScopeCheck generates a JSON report highlighting 'undeclared_access' items that pose a potential security or functional risk.
ScopeCheck Setup
To get started with this security tool for Openclaw Skills, ensure you have Python and uv installed, then run the server:
# Start the ScopeCheck server
uvicorn scopecheck.app:app --port 8002
You can then audit a skill using a simple curl command:
curl -s -X POST http://localhost:8002/v1/check-scope \
-H "Content-Type: application/json" \
-d "{\"skill_content\": $(cat path/to/SKILL.md | jq -Rs)}" | jq
ScopeCheck Data Schema & Taxonomy
ScopeCheck returns a structured JSON object containing three primary keys to categorize the security profile of Openclaw Skills:
| Key | Description |
|---|---|
declared |
Lists bins and env vars explicitly defined in the SKILL.md metadata. |
detected |
Lists every resource (env, bin, fs, net) found during the content scan. |
undeclared_access |
Items found in 'detected' but missing from 'declared', prefixed by type. |
Undeclared Prefixes:
env:Environment variables (e.g.,env:API_KEY)bin:Executable binaries (e.g.,bin:curl)fs:Filesystem paths (e.g.,fs:/etc/hosts)net:Network URLs (e.g.,net:[https://api.external.com](https://api.external.com))
ScopeCheck Advanced Features
- Real-time API-based auditing for CI/CD pipelines to validate Openclaw Skills during the build process.
- Automated detection of sensitive filesystem paths (e.g., .ssh/config) that are often missed during manual reviews.
- Cross-referencing of binary requirements to prevent execution of unauthorized shell commands.
- Deep scanning of network URLs to ensure compliance with data sovereignty and privacy policies.
SKILL.md
Loading
Related Openclaw Skills
Stock Analysis & WeChat Review
A professional stock market analysis framework designed for systematic daily reviews and automated portfolio monitoring via WeChat.
gh-skillscan
A security auditing tool designed to scan Openclaw Skills for potential threats and malicious patterns before installation.
FlyAI Hotel Search & Compare
A powerful hotel discovery and comparison tool for AI agents that filters stays by landmarks, property types, and nightly budget in CNY.
Agent Security Scanner
A high-performance security auditing tool designed to scan AI agent code and skill sets for malicious patterns and vulnerabilities.
DataGate
DataGate provides a robust, language-agnostic API endpoint for validating JSON payloads against complex JSON Schemas in multi-agent pipelines.
Max Studio API Integration
A professional Python-based CLI wrapper for seamless AI image and video generation via the Max Studio API.
METADATA
Featured*
