Setup & Installation
openclaw skills install @itsnishi/scan-skill
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
npx clawhub install scan-skill
What This Skill Does
Analyzes a skill directory for security vulnerabilities before installation. Detects injection techniques, obfuscation, malicious shell patterns, and instruction override attempts. Produces a severity-ranked report with per-finding recommendations.
Runs a comprehensive set of AI-agent-specific checks in one pass rather than manually reading each skill file for subtle injection or obfuscation.
When to use it
- Vetting a third-party skill before adding it to your agent config
- Reviewing a skill submitted by an external contributor
- Auditing skills pulled from a public marketplace
- Checking for hidden instructions or encoded payloads in downloaded skills
- Pre-installation security gate in a team review workflow
Example Workflow
Here's how your AI assistant might use this skill in practice.
INPUT
User asks: scan the skill at ./skills/some-external-skill before I install it
AGENT
- 1Receives the target skill directory path as the argument
- 2Runs scan_skill.py against the specified directory
- 3Analyzes SKILL.md frontmatter for dangerous field combinations and hidden skills
- 4Checks scripts/ contents for remote-code-pipe-to-shell patterns, encoded payloads, and executable permissions
- 5Scans for zero-width characters, base64/hex obfuscation, and instruction override attempts
OUTPUT
Structured report listing findings by severity with specific recommendations for each issue found