Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Scans MCP servers and AI agent skills for security vulnerabilities using 7 parallel analysis engines. Returns cached results immediately if a prior scan exists, or triggers a new scan automatically. Covers prompt injection, supply chain risks, malware, and permission abuse.
Running 7 specialized engines in parallel, including runtime behavior monitoring and LLM-specific attack detection, covers threat categories that generic SAST tools miss entirely.
When to use it
- Checking an npm MCP server package before adding it to a project
- Auditing a local MCP server codebase before deployment
- Verifying a third-party AI skill for prompt injection patterns
- Getting a CVE report on dependencies in an agent tool
- Reviewing filesystem and network permissions of an installed skill
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: /security-scan --name @anthropic/mcp-server-fetch
- 1Checks vs.aiclude.com for existing scan results by package name
- 2Returns cached report instantly if found, otherwise registers the target
- 3Triggers parallel scan across SAST, SCA, Tool Analyzer, DAST, Permission Checker, Behavior Monitor, and Malware Detector engines
- 4Aggregates findings into a structured report with severity levels and code locations
- 5Outputs remediation recommendations for each identified vulnerability
Markdown or JSON report with risk level summary, vulnerability list, and fix recommendations