A security-focused tool that audits Openclaw Skills for vulnerabilities, suspicious API calls, and malicious patterns prior to installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-skill-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-skill-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Scanner?
Security Scanner is an essential utility for developers and users within the AI agent ecosystem, specifically designed to vet Openclaw Skills for potential threats. It acts as a gatekeeper, performing deep analysis on SKILL.md files to identify hidden external downloads, dangerous file system operations, and obfuscated commands that could compromise system integrity.
By providing a transparent risk assessment, this skill empowers users to make informed decisions about the tools they integrate into their workflows. It bridges the gap between automation and safety, ensuring that every addition to your local skill directory meets a high standard of security through rigorous pattern matching and behavioral auditing.
Security Scanner Use Cases
- Scanning a new Openclaw Skills package downloaded from a third-party repository.
- Auditing all existing Openclaw Skills in a local directory to detect outdated or risky patterns.
- Verifying the safety of skill prerequisites and external API endpoints before granting execution permissions.
- Identifying obfuscated or Base64-encoded commands within instructions to prevent shell injection.
How Security Scanner Works
- The AI agent initializes the Security Scanner skill to load the latest threat patterns and detection logic.
- The agent reads the target SKILL.md file or directory specified by the user.
- A multi-layered analysis is performed, checking for suspicious API calls, file operations, and known malicious signatures.
- The skill generates a comprehensive report, assigning risk scores from LOW to CRITICAL based on detected patterns.
- The user reviews the flagged items and recommendations to decide whether to proceed with installation.
Security Scanner Setup
Install the skill via ClawHub or manually add the files to your local directory for Openclaw Skills. For optional command-line usage, use the following commands:
# Clone the repository
git clone https://github.com/anikrahman0/security-skill-scanner.git
cd security-skill-scanner
# Run the scanner manually
node scanner.js path/to/SKILL.md
Security Scanner Data Schema & Taxonomy
The skill utilizes a structured configuration and produces detailed audit reports to help manage Openclaw Skills safely.
| Component | Description |
|---|---|
| Config File | .security-scanner-config.json containing whitelistedDomains and whitelistedCommands. |
| Scan Report | A Markdown-formatted output including Skill Name, Timestamp, Overall Risk, and Findings list. |
| Risk Levels | Categorized as CRITICAL, HIGH, MEDIUM, or LOW based on pattern severity. |
| Findings | Details including location (line number), detected pattern, risk description, and recommendation. |
Security Scanner Advanced Features
- Whitelist Support to exclude trusted domains and specific shell commands from being flagged.
- Batch Scanning capabilities to audit an entire directory of Openclaw Skills simultaneously for system-wide security.
- Offline Analysis ensuring that the scanning process itself remains private and does not require an active internet connection.
- Risk Scoring Engine that provides actionable recommendations (e.g., DO NOT INSTALL) based on the severity of findings.
SKILL.md
Loading
Related Openclaw Skills
Task Review Workflow
A standardized, high-integrity PR review and merge process designed for task-driven AI agent collaboration.
Task Development Workflow
A structured, quality-first development lifecycle for AI agents involving rigorous planning, test-driven development, and pull request reviews.
Feishu Voice Skill
Empowers AI agents to send authentic, playable voice messages directly to Feishu users instead of standard file attachments.
Feishu Edge TTS
A powerful integration that uses Microsoft Edge's free text-to-speech engine to send professional voice messages directly to Feishu.
SubAgent Creator
A powerful management tool for spawning, monitoring, and steering specialized sub-intelligent entities to handle complex workflows.
Create SubAgent
A powerful orchestration skill to spawn and manage specialized subordinate agents for parallel task execution.
METADATA
Featured*
