A professional 7-phase security auditing pipeline that identifies vulnerabilities, scans dependencies, and detects leaked secrets.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install shadows-security-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install shadows-security-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Scanner?
The Security Scanner is a comprehensive audit framework designed to secure modern development projects. As a core component of your Openclaw Skills toolkit, this tool executes a rigorous 7-phase protocol that covers everything from initial reconnaissance to infrastructure hardening. It provides developers with a structured way to identify the OWASP Top 10 risks, including SQL injection, XSS, and broken authentication, before code reaches production.
This skill is particularly valuable for teams looking to automate their security posture without relying solely on heavy external platforms. By integrating these Openclaw Skills into your local environment, you can perform deep-level scans of your git history for leaked credentials and audit your application's dependency tree for known CVEs using industry-standard tools like npm audit, pip-audit, and cargo-audit.
Security Scanner Use Cases
- Scanning repositories before production deployments to prevent security regressions.
- Investigating codebases after a security incident to identify points of compromise.
- Performing regular monthly security audits to maintain a high security standard.
- Auditing new dependencies or third-party libraries for known vulnerabilities.
- Reviewing security-sensitive features like payment gateways or authentication flows.
How Security Scanner Works
- Conducts reconnaissance to map the attack surface, routes, and data flow boundaries.
- Performs a dependency scan using package-specific audit tools to find known vulnerabilities.
- Executes application security tests using pattern matching to find OWASP Top 10 issues in the source code.
- Analyzes API security by verifying authentication, authorization, and rate-limiting configurations.
- Performs hardening checks on infrastructure, including HTTP security headers via curl.
- Conducts a secrets verification scan through local git history and environment configuration files.
- Compiles all findings into a structured report with prioritized remediation steps.
Security Scanner Setup
To maximize the effectiveness of these Openclaw Skills, ensure your environment has the necessary tools installed for scanning your specific tech stack:
# Ensure git is available for history scanning
git --version
# Install stack-specific auditors
npm install -g npm # For Node.js projects
pip install pip-audit # For Python projects
cargo install cargo-audit # For Rust projects
Security Scanner Data Schema & Taxonomy
The scan output is organized into a detailed report format to help developers prioritize fixes. The data is structured as follows:
| Component | Description |
|---|---|
| Executive Summary | A high-level count of Critical, High, Medium, and Low risks. |
| Finding Details | Includes the OWASP category, file location, impact, and remediation steps. |
| Dependency Table | Lists affected packages, CVE identifiers, and available fix versions. |
| Hardening Status | A PASS/FAIL checklist for security headers like HSTS and CSP. |
| Git History Log | Snippets of potential secrets found in the git commit logs. |
Security Scanner Advanced Features
- Multi-language support for JavaScript, TypeScript, Python, and Rust dependency auditing.
- Deep git history analysis to detect secrets committed in previous versions.
- Dynamic HTTP header verification for real-time security posture checks on live URLs.
- Automated grep-based pattern matching for rapid identification of common injection vulnerabilities.
- Actionable remediation advice for every identified security risk.
SKILL.md
Loading
Related Openclaw Skills
Python Sensei
A specialized AI coding assistant that enforces strict Python engineering standards, including type safety, async patterns, and modular architecture.
Project Architect
A professional-grade planning protocol that guides AI agents through requirements analysis, architecture design, and actionable task mapping.
Oneshot Fix (Surgical Quick Fix)
A high-speed, surgical repair protocol for AI agents to fix small bugs and typos with minimal tool interaction.
MCP Forge
A specialized tool for building Model Context Protocol (MCP) servers in Python or TypeScript to connect external services with AI agents.
Skill Factory
A powerful meta-skill designed to guide developers through the creation, formatting, and validation of standardized SKILL.md files for AI agents.
Smart Commit
An intelligent git assistant that automates conventional commit messages while enforcing security scans and atomic staging.
METADATA
Featured*
