A lightweight static analysis tool designed to audit AI coding agent skills for dangerous code patterns and hardcoded secrets before deployment.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Scan?
The Security Scan skill provides a streamlined security review workflow specifically tailored for Openclaw Skills and small code repositories. It acts as a primary defensive layer, allowing developers to inspect skill directories for high-risk patterns such as shell injections, hardcoded credentials, and unsafe file permissions before they are published or integrated into a production environment.
By leveraging heuristic-based scanning, this skill empowers developers to make informed go/no-go decisions. It bridges the gap between blind trust and intensive manual forensics, offering a conservative, fast, and actionable risk summary for any target directory.
Security Scan Use Cases
- Auditing third-party AI agent skills before local installation to prevent malicious execution.
- Pre-publish sanity checks for developers to ensure no sensitive API tokens are accidentally included.
- Quick static analysis of shell scripts and automation workflows for suspicious command patterns.
- Verifying file permissions within a repository to maintain a secure environment.
How Security Scan Works
- Scope Definition: The user identifies the target directory and defines the goal of the review, such as a pre-install audit or a publishing check.
- Static Scanning: The included scanner script runs a heuristic pass over the target files using grep-style patterns.
- Pattern Matching: The tool identifies suspicious function names like eval() or exec(), potential hardcoded secrets, and world-writable files.
- Manual Review: The developer inspects flagged findings to distinguish between justified code and high-risk vulnerabilities.
- Verdict Generation: The skill produces a concise summary with a risk level (Low, Medium, High) and a confidence score.
- Actionable Recommendations: The workflow concludes with specific next steps, such as rotating credentials or escalating to sandbox analysis.
Security Scan Setup
To begin using this security utility within your Openclaw Skills environment, navigate to the skill directory and execute the bundled script:
# Scan a specific directory
bash scripts/scan.sh /path/to/target
# Scan the current directory
bash scripts/scan.sh .
Security Scan Data Schema & Taxonomy
The skill organizes findings into a compact reporting structure. It does not maintain a complex database but generates metadata based on the following taxonomy:
| Attribute | Description |
|---|---|
| Target | The file path or directory currently being audited. |
| Result | Risk classification: Low risk, Needs review, or High risk. |
| Findings | A bulleted list of specific grep matches or permission flags. |
| Confidence | Assessment of the scan accuracy (Low, Medium, or High). |
| Action | Recommended path forward (e.g., 'Rotate credentials' or 'Install'). |
Security Scan Advanced Features
- Heuristic pattern matching for common exploit vectors in shell and scripting languages.
- Support for identifying world-writable file risks and directory permission issues.
- Standardized reporting format for consistent multi-agent security logging.
- Customizable triage guidance for differentiating between benign docs and malicious payloads.
SKILL.md
Loading
Related Openclaw Skills
MOSS-Transcribe-Diarize
A professional AI audio transcription skill that identifies multiple speakers and generates timestamped, structured transcripts from local or remote sources.
Alibaba Cloud Realtime ASR (Qwen)
A low-latency realtime speech recognition skill leveraging Alibaba Cloud Model Studio Qwen ASR models for streaming audio processing.
Alibaba Cloud CosyVoice Voice Clone
A professional AI integration for enrolling and cloning custom voices using Alibaba Cloud Model Studio CosyVoice models.
Crawlee
A production-grade web scraping and browser automation library for JavaScript and Python designed to handle anti-blocking and high-concurrency crawling.
Pre-Order Deposit and Ship-Date Tracker
A professional workflow engine for AI agents to manage pre-order payments, production milestones, and buyer communications for high-demand product drops.
Crypto Signal Skill
A professional-grade market analysis tool that generates high-precision trading signals for Binance pairs using technical indicators and news sentiment.
Featured*
