Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
# Changelog ## [2.0.0] - 2026-02-16 ### Changed - Clarified that this scans skill instruction files (markdown), not executable code - Updated documentation to accurately describe how the scanner works with Claude - Removed unverified statistics about malicious skills - Added prominent false positive warnings and limitations section - Fixed network access claims to be more accurate - Improved usage examples to show correct workflow ### Fixed - Updated contact email to a7604366@gmail.com - Corrected installation instructions - Removed misleading technical prerequisites ### Added - "How It Works" section explaining the skill's operation - Detailed false positive examples - User responsibility guidelines - Stronger disclaimer about manual review requirements ## [1.0.0] - 2026-02-09 ### Added - Initial release - Pattern-based security scanning - Risk level classification - Command-line interface - Whitelist configuration support ``` --- ## Also Update the Example Output in SKILL.md In the SKILL.md file I gave you, find this line (around line 161): ``` Scanned: 2024-02-09 14:30:22 ``` **Change to:** ``` Scanned: 2026-02-16 14:30:22
What This Skill Does
Analyzes OpenClaw SKILL.md files for suspicious patterns before you install them. Detects hidden downloads, unvalidated external API calls, dangerous file operations, and obfuscated commands. Assigns a risk level (LOW to CRITICAL) and flags specific findings for manual review.
OpenClaw skills have no built-in vetting process, so this fills the gap by flagging suspicious instruction patterns before you run them.
When to use it
- Checking a new skill from ClawHub before installing it
- Batch auditing all currently installed skills
- Reviewing a community-submitted skill with unusual permission requests
- Vetting skills before deploying to a shared team environment
- Getting a structured risk report on a skill received from an untrusted source
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Scan the skill file at ~/Downloads/email-automation/SKILL.md for security issues'
- 1Reads the security-scanner skill to load detection patterns and risk criteria
- 2Reads the target SKILL.md file
- 3Checks for suspicious patterns: external binary downloads, unencrypted requests, encoded commands, unknown API endpoints, and dangerous file system operations
- 4Assigns a risk level to each finding and compiles them with line references and recommendations
A structured report listing each finding by severity, with locations, risk explanations, and an overall install or avoid recommendation