Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Enhanced detection: Now catches file write operations (.write_text, .write_bytes, open for writing) in addition to existing checks. Improved security scanner to detect potential malicious file write patterns before publishing.
What This Skill Does
Static analysis tool that scans Python skill files before publishing to ClawHub. Checks for dangerous imports, hardcoded secrets, unsafe file operations, and code execution functions like eval/exec. Produces warnings and pass/fail results to guide safe publishing decisions.
Running this before every publish catches credential leaks and dangerous patterns that manual review commonly misses under time pressure.
When to use it
- Scanning a skill script for hardcoded API keys before publishing
- Catching accidental subprocess or eval usage in automation scripts
- Running as a pre-commit hook to block insecure code from being committed
- Auditing an entire skills directory before a ClawHub release
- Replacing a manual code review step with automated pattern detection
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: scan my skill at /home/user/.openclaw/workspace/skills/my-tool before I publish
- 1Runs security_scan.py against the specified skill directory
- 2Parses output for warnings and hardcoded secret alerts
- 3Reports each flagged line with the category of risk
- 4Suggests refactoring hardcoded values to environment variables
- 5Confirms scan passed or lists issues blocking publish
Scan report listing any warnings with file paths and line numbers, or a clean pass confirmation