Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Static source-code scanner covering OWASP Top 10:2025, supply chain risks, hardcoded secrets, and dangerous code patterns. Findings are ranked by exploitability and business impact using CVSS and EPSS scoring. Does not perform runtime or binary analysis.
Combines OWASP 2025 category coverage with CVSS and EPSS-based risk scoring, so findings are ranked by real exploitability rather than raw severity counts.
When to use it
- Scanning a codebase before a scheduled penetration test
- Finding hardcoded AWS keys or tokens committed to a repo
- Auditing npm or pip dependencies for supply chain compromise
- Checking a pull request for SQL injection or unsafe deserialization
- Deciding which CVEs to prioritize in the current sprint
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: scan my project for security issues and tell me what to fix first
- 1Run security_scan.py against the project directory with --scan-type all
- 2Parse findings across secrets, dependency vulnerabilities, and dangerous code patterns
- 3Score each finding using CVSS severity and EPSS exploit likelihood
- 4Map findings to OWASP Top 10:2025 categories
- 5Output a prioritized list with file locations, root cause, and remediation steps
Ranked vulnerability report with critical findings (e.g. hardcoded DB password at config.py:42), affected OWASP category, business impact, and specific fix instructions