A proactive security auditing tool designed to scan Openclaw Skills plugin directories for vulnerabilities and sensitive data leaks before deployment.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install shoofly-plugin-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install shoofly-plugin-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is shoofly-plugin-scan?
The shoofly-plugin-scan utility is a critical security layer for developers and teams integrating third-party logic into their environments. It acts as a pre-install gatekeeper, ensuring that any directory intended to function as one of your Openclaw Skills is thoroughly audited for common security anti-patterns and malicious signatures.
By running this scan, you protect your local and cloud environments from accidental credential exposure and suspicious execution patterns. This tool is essential for maintaining a high security posture when extending the capabilities of your AI agents with new Openclaw Skills.
shoofly-plugin-scan Use Cases
- Validating community-contributed Openclaw Skills before adding them to your production workflow.
- Automating security checks in CI/CD pipelines to prevent the accidental commit of API keys.
- Auditing local plugin development to ensure no sensitive file paths (like .ssh or .aws) are being accessed.
- Identifying obfuscated code or unauthorized network calls in newly downloaded Openclaw Skills.
How shoofly-plugin-scan Works
- The user provides a local path to the plugin directory as a command-line argument.
- The scanner parses all files within the directory to identify matching patterns for high-risk assets.
- It cross-references any identified network URLs against a built-in trusted allowlist of hosts.
- The tool evaluates the code for dangerous execution patterns or obfuscated strings that could hide malicious intent.
- A status report is generated, and the process terminates with a specific exit code indicating the safety level of the Openclaw Skills component.
shoofly-plugin-scan Setup
To secure your Openclaw Skills, install the scanner and run it against your target plugin directory:
# Run the scanner against a specific directory
shoofly-plugin-scan <path-to-plugin>
Ensure you check the exit code in your scripts to automate the 'Go/No-Go' decision for installation.
shoofly-plugin-scan Data Schema & Taxonomy
The shoofly-plugin-scan tool evaluates the plugin structure and returns standardized exit codes to facilitate automation within Openclaw Skills ecosystems:
| Exit Code | Classification | Meaning |
|---|---|---|
| 0 | Clean | No security findings detected. |
| 1 | Findings | Potential risks identified; manual review required before installing these Openclaw Skills. |
| 2 | Scan Error | The scanning process failed to complete (e.g., invalid path). |
Monitored Patterns:
- Credentials: API Keys (AWS, GitHub, OpenAI), Private Keys.
- Execution: child_process.exec, shell usage.
- Filesystems: Access to ~/.ssh, /etc/passwd, and ~/.aws.
shoofly-plugin-scan Advanced Features
- Support for detecting sophisticated obfuscation techniques including eval() and Function() constructors.
- Automated host validation against an integrated allowlist (GitHub, NPM, Openclaw, etc.).
- Native integration capability for multi-agent security protocols and DevSecOps workflows.
- Lightweight CLI design optimized for rapid scanning of complex Openclaw Skills architectures.
SKILL.md
Loading
Related Openclaw Skills
Cinematic Story Video Generator
A professional AI video generation skill that transforms text or images into high-fidelity cinematic scenes with advanced camera grammar and narrative lighting.
Swagger Reference Tool
A comprehensive CLI-driven reference guide for mastering Swagger implementation and troubleshooting within devtools environments.
Nmap Reference Tool
A comprehensive reference and workflow optimization tool for Nmap network discovery and security auditing.
Cheatsheet Generator
An AI-powered tool that generates structured, exportable Markdown cheatsheets for technical and lifestyle topics.
Shipping Price Monitor
A specialized monitoring tool that tracks shipping carrier price fluctuations in Excel files and sends instant alerts when rates hit your target thresholds.
Automation Consultant Skill
A professional automation agent designed to audit business processes and implement high-efficiency Python and API-based workflows.
Featured*
