A security-first auditing and quarantine tool designed to protect your environment from malicious or risky Openclaw Skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install securityclaw
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install securityclaw using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is SecurityClaw?
SecurityClaw serves as the essential security layer for your agent ecosystem. It provides automated static analysis and optional sandbox verification to detect prompt injection, data exfiltration, and supply-chain vulnerabilities within Openclaw Skills. By identifying high-risk patterns before they are executed, it ensures your automation workflows remain secure and compliant.
This tool is particularly useful when reviewing community-contributed content, providing a defensive barrier against unauthorized data access or malicious code execution within your AI workflows. By maintaining a clean environment for your Openclaw Skills, you can scale your automation with confidence.
SecurityClaw Use Cases
- Reviewing and validating new Openclaw Skills from unknown third-party sources.
- Automating security audits during the installation phase of various Openclaw Skills.
- Quarantining suspicious files to prevent accidental execution of potentially malicious scripts.
- Generating detailed compliance reports for organizational security reviews of AI agents.
How SecurityClaw Works
- The scanner script is initiated via CLI, targeting the specific directory containing your Openclaw Skills.
- The engine performs a static analysis of the source code and metadata based on a built-in rule catalog.
- Findings are categorized by severity levels to help developers prioritize security remediation.
- If configured, high-risk Openclaw Skills are automatically moved to a secure quarantine directory to prevent execution.
- An owner-action checklist is produced, guiding the user through deletion, reporting, or allowlisting of the audited skills.
SecurityClaw Setup
SecurityClaw is a Python-based utility that integrates directly with your local environment for fast auditing.
# Run a read-only scan to generate a security report
python3 scripts/securityclaw_scan.py --skills-dir ~/.openclaw/skills --out report.json
# Run scan with automatic quarantine for high-risk findings
python3 scripts/securityclaw_scan.py --skills-dir ~/.openclaw/skills --quarantine-dir ~/.openclaw/skills-quarantine --quarantine --out report.json
SecurityClaw Data Schema & Taxonomy
SecurityClaw organizes its auditing logic and results through the following structure:
| Component | Path | Purpose |
|---|---|---|
| Scanner Script | scripts/securityclaw_scan.py |
The main execution engine for scanning and quarantine. |
| Audit Report | report.json |
Machine-readable log of all security findings in your Openclaw Skills. |
| Rule Catalog | references/rules.md |
Documentation defining what patterns are flagged as risks and why. |
| Sandbox Guide | references/sandboxing.md |
Advanced guidelines for running dynamic checks in isolated environments. |
SecurityClaw Advanced Features
- Automated quarantine workflows that isolate risky Openclaw Skills without permanent file deletion.
- Dynamic sandbox support to test code execution without network or filesystem access for suspicious skills.
- Custom rule definitions via a central rule catalog to extend security coverage for specific threats.
- Detailed owner-action checklists for streamlined security decision-making across all Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
Webpage Screenshot
A professional browser automation tool that opens specified URLs and captures complete, full-page screenshots as PNG files.
OpenCode CLI Controller
A specialized skill to orchestrate AI-driven code generation and project management via the OpenCode CLI local API.
Villain Mint: AI-Generated NFT Agent Skill
A specialized Solana-based skill allowing AI agents to solve cryptographic challenges and mint unique 1/1 rubber hose style villain NFTs.
Chum Cloud
A specialized social and coordination network designed for AI agents to share intelligence, execute schemes, and compete in a gamified villain hierarchy.
ClawPM
A JSON-first CLI tool for managing tasks, research, and work logs across multiple developer projects.
Autonomous Brain
A proactive intelligence engine that enables AI agents to think independently, anticipate needs, and execute tasks without constant direction.
Featured*
