A specialized security auditing tool designed to scan AI coding agent skills for malicious patterns, backdoors, and credential theft risks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-flag
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-flag using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Flag Security Scanner?
Skill Flag is a high-performance security auditing tool specifically engineered to protect developers using Openclaw Skills from malicious code and vulnerabilities. By performing deep static analysis on skill source code, it identifies critical risks such as reverse shells, unauthorized data exfiltration, and prompt injection attempts that could compromise your system.
Whether you are installing a new skill from a remote URL or auditing your existing local workspace, this tool provides a comprehensive risk assessment. It ensures that your AI environment remains secure and trustworthy by highlighting suspicious activities like unauthorized network calls to unknown domains or attempts to read sensitive files like SSH keys and environment variables.
Skill Flag Security Scanner Use Cases
- Auditing third-party Openclaw Skills before installation to prevent supply chain attacks.
- Performing scheduled security sweeps of global and workspace skill directories to maintain a clean environment.
- Identifying potential credential theft attempts in code that accesses ~/.ssh, ~/.aws, or .env files.
- Investigating suspicious network activity or obfuscated payloads in community-contributed automation scripts.
- Generating compliance-ready security reports for AI agent deployments.
How Skill Flag Security Scanner Works
- The user initiates a scan via the CLI or by prompting the AI agent to check specific Openclaw Skills.
- The scanner parses the source code across global (~/.clawdbot/skills/), workspace (./skills/), and npm-based skill directories.
- It applies a heuristics-based detection engine to flag malicious patterns such as curl/wget exfiltration, base64 encoded payloads, or unauthorized file access.
- A risk score from 0-100 is calculated based on the severity of findings (e.g., CRITICAL for backdoors, HIGH for code execution, LOW for suspicious imports).
- A detailed Markdown security report is generated and saved to the local reports directory for developer review and remediation.
Skill Flag Security Scanner Setup
To begin auditing your Openclaw Skills, use the following commands in your terminal:
# Scan all installed skills for security issues
python3 skills/skill-flag/scanner.py --all
# Scan a specific skill by name
python3 skills/skill-flag/scanner.py --skill <skill-name>
# Generate a quick risk report
# Ask your agent: "Give me a security report"
Skill Flag Security Scanner Data Schema & Taxonomy
The tool organizes its findings into a structured reporting system and scans specific metadata locations:
| Location | Description |
|---|---|
~/.clawdbot/skills/ |
Target directory for global Openclaw Skills analysis |
skills/skill-flag/reports/ |
Storage path for generated Markdown security audit logs |
Risk Score (0-100) |
Numerical taxonomy indicating the safety profile of a skill |
Pattern Matching |
Metadata used to identify shells, exfiltration, and injection patterns |
Skill Flag Security Scanner Advanced Features
- Pre-installation URL scanning to verify the integrity of Openclaw Skills from remote repositories before they touch your local machine.
- Deep heuristic detection for prompt injection patterns and system instruction overrides that could lead to agent hijacking.
- Multi-directory support covering global, workspace-specific, and built-in skill paths.
- Detailed reporting dashboard highlighting line-by-line code vulnerabilities and specific risk categories.
- Automated risk scoring system that prioritizes critical threats like credential theft and reverse shells for immediate action.
SKILL.md
Loading
Related Openclaw Skills
Weather NWS Skill
A high-precision weather forecasting skill for AI agents providing NWS data, winter storm tracking, and air quality metrics with global fallback support.
Mastodon Scout
A read-only utility for fetching Mastodon timelines, mentions, and search results via a dependency-free Python script.
Market Monitor
A real-time market analysis tool for monitoring crypto price trends and technical indicators across major exchanges.
System Resource Monitor
A lightweight and reliable utility for monitoring CPU load, memory usage, and disk health directly through your AI agent.
ClawHub Skill Publishing
A specialized developer workflow and toolset for the creation, validation, and lifecycle management of Openclaw Skills on the ClawHub platform.
Stremio Unwatched
A comprehensive media management tool to track unwatched episodes and sync Stremio release calendars.
Featured*
