Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
**Changelog for v2.2.0** - Greatly simplified documentation and descriptions for clarity. - Added an explicit privacy statement: all code analysis is fully local with no external network calls. - Reduced marketing, internal architecture, and constitutional details; focused on practical usage. - Installation, quick start, usage examples, and supported languages now easier to understand. - Pricing and licensing instructions rewritten with direct links for user convenience.
What This Skill Does
Static code analysis tool that scans for security vulnerabilities, code smells, and complexity issues across 17 languages, including Python, TypeScript, Java, Go, and common DevOps formats like Dockerfile and Terraform. All analysis runs locally with no network calls, so source code never leaves the machine.
Because analysis is fully local, it works on proprietary or regulated codebases without sending source code to external services.
When to use it
- Scanning a repo for hardcoded API keys before a production deploy
- Blocking git pushes automatically when SQL injection risks are detected
- Auditing AI-generated code for logic changes that preserve syntax but alter intent
- Generating an HTML security report for a client or compliance review
- Failing CI builds on any HIGH or CRITICAL severity finding
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Check my project for critical security issues
- 1Run hefesto analyze on the project directory with --severity CRITICAL
- 2Parse output to identify HARDCODED_SECRET and SQL_INJECTION_RISK findings
- 3Report each issue with file path, line number, and suggested remediation
- 4Recommend adding a pre-push hook via hefesto install-hook to catch issues before future commits
List of critical findings with exact file locations and actionable fix suggestions
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.