A high-performance security auditing tool that scans Openclaw Skills for malicious patterns using fast, deterministic, and offline analysis.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-defender
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-defender using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Defender?
Skill Defender is a vital security utility designed to protect users and developers from malicious content within their AI agent environments. It performs deep, deterministic pattern matching against Openclaw Skills to identify risks such as prompt injection, credential theft, data exfiltration, and backdoors. Because it runs entirely offline and uses only the Python standard library, it provides a cost-effective and private way to audit code before execution.
By serving as a secondary defense layer, Skill Defender ensures that every skill added to your library is scrutinized for suspicious behavior. Whether you are installing a community-contributed tool or updating an existing one, this scanner provides a clear safety verdict, allowing you to maintain a secure and trustworthy set of Openclaw Skills without the overhead of external API dependencies.
Skill Defender Use Cases
- Automatically verify the integrity of a new skill immediately after installation.
- Conduct a security re-scan of Openclaw Skills after any updates or file changes are detected.
- Run periodic batch audits across your entire local library to ensure ongoing compliance with security best practices.
- Integrate with automated workflows to block the execution of any skill flagged as dangerous.
How Skill Defender Works
- The system triggers a scan based on user commands or automated events like a new skill installation.
- The scanner auto-detects the relevant Openclaw Skills directory or accepts a manual path provided by the user.
- Python-based scripts perform deterministic pattern matching against the skill's source files, looking for signatures of malicious intent or vulnerabilities.
- Findings are cross-referenced with an internal allowlist to account for legitimate behaviors in security-focused or administrative tools.
- The tool generates a structured verdict—Clean, Suspicious, or Dangerous—and provides a detailed JSON or human-readable report of the findings.
Skill Defender Setup
Skill Defender requires Python 3.9 or higher and has no external dependencies. To begin, navigate to the skill directory and use the following commands:
To scan a specific skill:
python3 scripts/scan_skill.py /path/to/skill-dir
To scan all installed Openclaw Skills and generate an aggregate report:
python3 scripts/aggregate_scan.py
To generate JSON output for integration with other tools:
python3 scripts/scan_skill.py /path/to/skill-dir --json
Skill Defender Data Schema & Taxonomy
Skill Defender generates detailed reporting schemas to help developers interpret security risks across their Openclaw Skills. The JSON output includes the following structure:
| Property | Description |
|---|---|
verdict |
Final status of the scan: clean, suspicious, dangerous, or error. |
findings |
An array containing the specific malicious patterns detected in the code. |
findingsCount |
The total number of flagged items identified during the scan. |
timestamp |
The exact time the audit was performed for record-keeping. |
totalSkills |
In aggregate reports, the total number of Openclaw Skills analyzed. |
Skill Defender Advanced Features
- Batch scanning capabilities to audit dozens of Openclaw Skills simultaneously in under a minute.
- Support for custom exclusion flags to reduce false positives in specific development contexts.
- Intelligent path auto-detection that finds skill directories in standard locations like ~/.openclaw/skills.
- Integration-ready exit codes for CI/CD pipelines and automated security gatekeeping.
SKILL.md
Loading
Related Openclaw Skills
Indices CLI Skill
A comprehensive CLI tool for managing browser-based automation tasks, execution runs, and secure credentials within the Indices ecosystem.
Helius API Solana Data
A powerful interface to query Solana wallet balances, transaction history, and identity labels using the Helius API.
Agent Council
A comprehensive toolkit for deploying autonomous AI agents and managing integrated Discord channels within the OpenClaw ecosystem.
PPT Generator Pro
A comprehensive AI-driven tool for transforming documents into high-resolution presentation slides and cinematic video transitions.
Content Creator
A sophisticated AI thinking partner that converts rough observations into platform-optimized, high-authority social media content.
Daily Review
A structured end-of-day automation to capture progress, document learnings, and prepare for the next day's top priorities.
Featured*
