A professional security analysis tool for identifying OWASP Top 10 vulnerabilities, supply chain risks, and hardcoded secrets.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install vulnerability-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install vulnerability-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Vulnerability Scanner?
The Vulnerability Scanner is an advanced security auditing tool built for Openclaw Skills to provide deep source-code analysis. It leverages the OWASP Top 10:2025 framework to detect critical flaws, including broken access control, injection vulnerabilities, and insecure software supply chains. By integrating a security expert mindset of Zero Trust and Defense in Depth, this tool empowers developers to identify risks before they can be exploited.
This addition to the Openclaw Skills ecosystem focuses on the root causes of vulnerabilities rather than just symptoms. It analyzes complex code patterns, such as unsafe deserialization and dynamic code execution, while also scanning for exposed API keys and credentials. It is an essential utility for teams preparing for penetration tests or maintaining high-integrity CI/CD pipelines.
Vulnerability Scanner Use Cases
- Identifying critical vulnerabilities like SQL injection, XSS, and path traversal in source code.
- Auditing third-party dependencies for supply chain risks and integrity failures.
- Detecting hardcoded secrets, cloud tokens, and high-entropy API keys across the codebase.
- Mapping the application attack surface to visualize entry points and data flow trust boundaries.
- Prioritizing security patches using a logic-driven risk matrix based on CVSS and EPSS scores.
How Vulnerability Scanner Works
- Reconnaissance: The skill maps the target technology stack and identifies entry points and data flows.
- Discovery: It performs automated configuration reviews, dependency analysis, and code pattern matching.
- Analysis: It validates potential issues, filters false positives, and calculates risk scores based on exploitability.
- Reporting: The system generates a structured report with clear remediation steps and business impact analysis.
Vulnerability Scanner Setup
To begin using this security engine within Openclaw Skills, ensure Python is installed and run the security script against your project path.
# Execute a comprehensive project security scan
python scripts/security_scan.py /path/to/project
# Target only secrets and credentials
python scripts/security_scan.py /path/to/project --scan-type secrets
# View a summarized risk assessment
python scripts/security_scan.py /path/to/project --output summary
Vulnerability Scanner Data Schema & Taxonomy
The skill structures security data into actionable findings, categorizing each issue by its impact on the business and technical severity.
| Element | Description |
|---|---|
| Vulnerability Category | Reference to OWASP 2025 (e.g., A05 Injection) |
| Severity Level | Ranked from Critical to Low based on CVSS |
| Exploitability | EPSS score indicating the likelihood of active exploitation |
| Location Data | Exact file paths and line numbers for the finding |
| Fix Guidance | Detailed instructions on how to remediate the vulnerability |
Vulnerability Scanner Advanced Features
- Integrated supply chain security auditing for CI/CD integrity and dependency verification.
- Dynamic risk prioritization decision tree that accounts for active exploit likelihood.
- Specialized checks for A10: Exceptional Conditions to prevent fail-open security states.
- Cloud security assessment for IAM policies, storage configurations, and network security groups.
- Actionable reporting templates designed for seamless integration with professional security workflows.
SKILL.md
Loading
Related Openclaw Skills
Threat Modeling Expert
A professional security agent for architecting resilient systems using STRIDE, PASTA, and advanced risk assessment methodologies.
SQL Injection Testing
A comprehensive framework for identifying, exploiting, and mitigating SQL injection vulnerabilities in web applications.
Authentication & Authorization Patterns
A comprehensive guide and toolkit for implementing industry-standard identity management and access control systems.
Secrets Management
A comprehensive skill for securing API keys, database credentials, and TLS certificates across multi-cloud environments and CI/CD pipelines.
Workspace Cleaner
An automated maintenance utility designed to safely identify and remove temporary files, duplicates, and workspace clutter from your AI environment.
Flatnotes + Tasks.md + GitHub Audit
A technical auditing utility that reconciles Flatnotes and Tasks.md data against GitHub PRs to ensure documentation and task accuracy.
Featured*
