Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
OpenScan analyzes binaries and scripts for malicious patterns on macOS and Linux. It parses Mach-O and ELF formats, checks for injection frameworks, shellcode sequences, obfuscation, and embedded network indicators. Detection logic is ported from the Harkonnen antimalware engine.
It runs entirely locally with no account, subscription, or network call required, making it practical as a quick pre-execution gate rather than a full antivirus scan.
When to use it
- Checking a downloaded CLI tool before running it
- Auditing shell scripts from unfamiliar repositories
- Scanning skill packages before installing them in OpenClaw
- Blocking high-threat binaries in an automated install pipeline
- Reviewing tool dependencies for embedded payloads
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: scan /tmp/setup.sh before running it
- 1Invoke scan on /tmp/setup.sh using node bin/scan.js
- 2Parse the script for dangerous shell patterns such as curl|bash and eval
- 3Check for obfuscation indicators and privilege escalation attempts
- 4Compute a threat score from 0-100 based on findings
- 5Return exit code and human-readable findings list
Threat score 35 (LOW) — found: curl|bash pipe pattern, base64 blob. Probably safe but review manually before executing.