SkillScout is a security-focused directory and verification tool used to discover and audit Openclaw Skills before installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skillscout
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skillscout using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is SkillScout?
SkillScout serves as the essential security layer and discovery engine for the ecosystem of Openclaw Skills. It allows developers and AI agents to programmatically or manually search for new capabilities while ensuring that every skill has undergone a rigorous multi-stage review process. By providing a centralized registry of Openclaw Skills, it eliminates the guesswork involved in expanding an agent's functionality.
The core mission of SkillScout is to provide transparency. Whether you are looking for tools to handle email, research, or data processing, SkillScout categorizes these Openclaw Skills based on their potential risk levels. This ensures that users can confidently deploy new automations without exposing their systems to unverified or malicious code.
SkillScout Use Cases
- Searching for specific functionality among available Openclaw Skills using keywords like email, notes, or research.
- Verifying the trust score and security posture of a skill before running an installation command.
- Comparing multiple Openclaw Skills that perform similar tasks to find the most secure option.
- Automating the discovery and selection of capabilities for agents via the Model Context Protocol (MCP).
How SkillScout Works
- The user or AI agent queries the SkillScout registry to find relevant Openclaw Skills based on a specific requirement.
- SkillScout retrieves the skill metadata from its static API, including the author, description, and permission requirements.
- The system presents a Trust Score (Safe, Caution, or Avoid) derived from automated blocklist scans and isolated AI source code reviews.
- Detailed STRIDE threat analysis is provided for complex skills to give a clear picture of the security implications.
- Once verified, the user can proceed to install the reviewed Openclaw Skills using the standard CLI tools.
SkillScout Setup
To search for Openclaw Skills directly from your terminal, you can use a simple curl command to query the static API:
curl -s https://nashbot67.github.io/skillscout/data/skills.json | python3 -c "
import json, sys
q = sys.argv[1].lower()
data = json.load(sys.stdin)
matches = [s for s in data['skills'] if q in json.dumps(s).lower()]
for s in sorted(matches, key=lambda x: {'safe':0,'caution':1,'avoid':2}.get(x.get('trustScore',''),1)):
trust = {'safe':'🟢','caution':'🟡','avoid':'🔴'}.get(s['trustScore'],'⚪')
print(f'{trust} {s[\"name\"]} by {s[\"author\"]} — {s.get(\"plainDescription\",s.get(\"description\",\"\"))}')
" "QUERY"
For agent-to-agent discovery, initialize the MCP server:
npx @skillscout/mcp
SkillScout Data Schema & Taxonomy
SkillScout maintains a detailed registry of Openclaw Skills with a schema focused on security metadata:
| Property | Type | Description |
|---|---|---|
| name | String | The unique name of the skill. |
| trustScore | String | Safe (Green), Caution (Yellow), or Avoid (Red). |
| author | String | The verified creator of the skill. |
| permissions | Array | List of required system access (exec, network, etc.). |
| analysis | Object | Contains the STRIDE threat analysis and human approval status. |
| description | String | A clear explanation of what the skill enables. |
SkillScout Advanced Features
- Isolated Agent Review: Every skill is analyzed by a read-only AI that reviews source code without executing it.
- STRIDE Threat Analysis: Deep security audits that identify spoofing, tampering, and information disclosure risks in Openclaw Skills.
- Static API: A high-performance, lightweight JSON API that can be integrated into any developer workflow or custom dashboard.
- Automated Blocklist Scanning: Continuous cross-referencing against known malicious patterns and dangerous repositories.
SKILL.md
Loading
Related Openclaw Skills
Instaclaw
A dedicated social media platform where AI agents generate, share, and interact with image-based content using the Model Context Protocol.
ClawDirect
A specialized directory and protocol that allows AI agents to discover, interact with, and submit agent-oriented social web experiences.
ClawDirect-Dev
A development framework for building AI agent-friendly web applications featuring secure ATXP authentication and MCP tool integration.
Moltlog
A secure CLI tool designed to register AI agents and publish Markdown-formatted progress logs to the moltlog.ai platform.
Auto Security Audit
An all-in-one automated security scanner for port services, CVE vulnerabilities, and system hardening audits.
Second Brain
A personal knowledge base powered by Ensue for capturing and retrieving structured understanding that compounds over time.
Featured*
