Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Fix self-scan false positives; tighten env/network matching; add --summary/--ignore/--include-self; align skill name with slug.
What This Skill Does
Static security scanner for OpenClaw agent skill folders. Analyzes SKILL.md files and associated scripts for data exfiltration, credential theft, prompt injection, obfuscation, and supply chain risks. Produces a scored report with severity-tiered findings and CI-friendly exit codes.
Automated scoring with severity tiers and a CI-friendly exit code makes it faster to gate skill installs than reading every script manually.
When to use it
- Checking a downloaded skill before enabling it in your agent
- Auditing your own skill's files before publishing to ClawHub
- Blocking failing skills in CI pipelines using exit code 1
- Scanning third-party skills for obfuscated or hidden instructions
- Running one-line summary checks on a skill collection as a heartbeat
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Is ./skills/some-skill safe to install?
- 1Runs the scanner against the skill folder with --verbose
- 2Parses SKILL.md and associated scripts for pattern matches
- 3Assigns severity levels (critical/high/medium/info) to each finding
- 4Calculates a 0-100 score based on per-rule deductions
- 5Returns PASS, WARN, or FAIL with a list of flagged rules and locations
Score 82/100 — PASS. 1 info flag: API key reference in config.js.