A pre-deployment security auditor that scans Openclaw Skills for high-risk patterns before they are written to your local disk.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-pre-install-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-pre-install-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Pre-Install Scanner?
The Pre-Install Scanner serves as a critical security layer for developers using AI coding agents. It intercepts installation requests to analyze the source code of a skill for malicious patterns, such as combined shell and network execution, unauthorized external URLs, and unverified publishers. By acting as a gatekeeper, it ensures that only vetted and safe Openclaw Skills are integrated into your local development environment.
This tool is designed to catch the three most dangerous signals in a lightweight, free-to-use package. By scanning the configuration and instructions of a skill before anything lands on your disk, it mitigates the risk of executing untrusted code that could lead to data exfiltration or system compromise.
Pre-Install Scanner Use Cases
- Verifying the safety of a skill before running an installation command.
- Automating security audits during the discovery of new Openclaw Skills.
- Identifying high-risk code patterns like data exfiltration indicators in third-party tools.
- Checking the verification status of a skill publisher on the ClawHub registry.
How Pre-Install Scanner Works
- The agent intercepts a request to install a skill or a specific query regarding a skill's safety.
- It utilizes web_fetch to retrieve the SKILL.md content directly from the remote repository.
- The scanner performs a static analysis of the skill's definitions, looking for three specific high-risk signals: shell+network combinations, hardcoded external URLs, and unverified publishers.
- It assigns a risk rating of LOW, MEDIUM, or HIGH based on the findings.
- It generates a structured report and either proceeds with, warns about, or blocks the installation based on the calculated risk level.
Pre-Install Scanner Setup
To begin using the scanner to protect your Openclaw Skills, ensure your AI agent has access to the web_fetch and web_search tools. Install the scanner using the following command:
clawhub install skill-pre-install-scanner
No additional API keys or environment variables are required for this security module.
Pre-Install Scanner Data Schema & Taxonomy
The Pre-Install Scanner processes external skill metadata and generates a real-time security report with the following structure:
| Attribute | Description |
|---|---|
| Risk Signals | Identifies shell+network combos, hardcoded URLs, and publisher status |
| Risk Ratings | Categories results into LOW (Proceed), MEDIUM (Warn), or HIGH (Block) |
| Metadata Sources | Analyzes SKILL.md files and checks publisher standing via web search |
Pre-Install Scanner Advanced Features
- Automatic interception of installation commands for seamless security without manual triggers.
- Real-time publisher verification via integrated web search functionality.
- Mandatory blocking of HIGH risk signals, requiring an explicit --force flag to override for safety.
- Direct upgrade path to the full Security Pack for comprehensive 10-signal analysis of Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
United Information Portal
A comprehensive information hub for United-related data, providing deep insights into historical milestones, business scope, and global operations.
Generate Import Template Data
An intelligent agent skill that analyzes uploaded templates to generate context-aware, import-ready sample data.
American Airlines Information Specialist
An AI agent skill designed to retrieve and analyze comprehensive corporate data, market standing, and historical context for American Airlines.
DealWatch Read-only Builder
A secure, read-only integration skill for AI agents to interact with DealWatch grocery data using the Model Context Protocol.
ana Information Retrieval
A comprehensive information retrieval skill designed to provide deep insights into the ana brand, including its history, business operations, and market standing.
JAL Comprehensive Information Station
A specialized research skill providing structured corporate intelligence on Japan Airlines, including history, business scope, and global operations.
Featured*
