Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Runs a Python-based static analysis script against a project directory to surface security issues. Checks for hardcoded secrets, dangerous function calls, SQL injection patterns, sensitive committed files, and data exfiltration patterns. Produces a severity-ranked report with file locations and remediation steps.
Combines multiple vulnerability categories (secrets, dangerous calls, SQL injection, exfiltration) into a single automated pass instead of running separate tools for each concern.
When to use it
- Scanning a codebase before opening a pull request
- Reviewing AI-generated code for accidentally embedded secrets
- Auditing third-party contributions before merging
- Checking for .env files accidentally committed to git
- Running a periodic security sweep on a growing codebase
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: audit the src/ directory for security issues
- 1Resolve the target path to src/ within the project root
- 2Run audit_code.py against src/
- 3Parse the structured output for severity-ranked findings
- 4Report file locations and remediation steps for each finding
A ranked list of findings, such as a hardcoded AWS key in config.js (high severity) and a subprocess shell=True call in deploy.py (medium severity), each with remediation guidance