Skill Cleaner is a security tool that scans Openclaw Skills for suspicious patterns and validates them against the VirusTotal reputation database.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-cleaner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-cleaner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Cleaner?
Skill Cleaner serves as an essential security layer for developers utilizing the agent ecosystem. It automates the tedious process of auditing code by performing heuristic scans on installed Openclaw Skills and comparing file hashes against globally recognized threat databases. This ensures that only safe, verified code is permitted to run in your high-privilege environment.
By integrating the VirusTotal API, this skill helps users distinguish between actual malicious threats and harmless false positives. It simplifies security management for Openclaw Skills by providing a clear path to trust through a dedicated RPC bridge, allowing developers to focus on building rather than manual security auditing.
Skill Cleaner Use Cases
- Identifying suspicious code patterns in newly added Openclaw Skills.
- Reducing security warnings by automatically allowlisting verified Openclaw Skills.
- Quarantining malicious files detected by the VirusTotal engine.
- Performing routine security audits on your entire collection of Openclaw Skills.
How Skill Cleaner Works
- The skill crawls the local directory to locate all installed Openclaw Skills.
- It executes a heuristic scan to flag any files containing sensitive or suspicious code patterns.
- For each flagged file, the skill generates a unique hash and submits it to the VirusTotal API for reputation checking.
- If the file is confirmed as clean, it is added to the safety allowlist; if it is flagged as malicious, it is automatically moved to a quarantine folder.
Skill Cleaner Setup
To configure the security scanner, you must first provide a VirusTotal API key in your environment variables. Add the following line to your .env file:
VIRUSTOTAL_API_KEY=your_api_key_here
Once configured, you can execute the cleaning scripts via the command line to manage your Openclaw Skills:
# Check for issues without making changes (Dry Run)
npx tsx ./skills/skill-cleaner/scripts/clean.ts
# Fix issues, quarantine threats, and update the allowlist
npx tsx ./skills/skill-cleaner/scripts/clean.ts --fix
Skill Cleaner Data Schema & Taxonomy
Skill Cleaner organizes security data to maintain a clear audit trail for all Openclaw Skills.
| Data Point | Description |
|---|---|
| .quarantine/ | A directory created to isolate high-risk Openclaw Skills from the main environment. |
| Bridge Allowlist | A secure registry managed via Gateway RPC for trusted Openclaw Skills. |
| Heuristic Flags | Metadata generated during the initial scan identifying potential risks within Openclaw Skills. |
Skill Cleaner Advanced Features
- Safe Bridge Integration: Communicates with the Security Core via hardened RPC to ensure no unauthorized modifications to the trust status of Openclaw Skills.
- Customizable Trust Levels: Allows users to specify how aggressive the quarantine should be when processing flagged Openclaw Skills.
- Bulk Verification: Efficiently handles reputation checks for dozens of Openclaw Skills in a single execution pass using optimized API calls.
- Heuristic Pattern Scanning: Goes beyond simple hash matching to find zero-day threats in local Openclaw Skills using the internal security module.
SKILL.md
Loading
Related Openclaw Skills
Remind Me v2
A zero-dependency scheduling tool that lets you set one-shot or recurring reminders using natural language across multiple communication channels.
gog
A powerful command-line interface for interacting with the entire Google Workspace suite, including Gmail, Sheets, and Drive.
Open Animate
Open Animate is a comprehensive creative suite that enables AI agents to design, generate, and render professional-grade motion graphics and MP4 videos.
Polaris AI DataInsight Doc Extract
A sophisticated document parsing skill that converts Office and HWP files into structured JSON for seamless AI data extraction.
Scheduler
A natural language automation tool that schedules shell commands, API health checks, and agent tasks on a one-shot or recurring cron basis.
Trash Auditor
An environmental vision agent that audits physical waste sorting and enforces digital bandwidth throttling as penance for recycling failures.
METADATA
Featured*
