Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
v3.0.0: Standalone package, API-only, dynamic signature auth (no secrets required)
What This Skill Does
Queries the AICLUDE scan database for vulnerability reports on MCP Servers and AI Agent Skills. If no report exists for a given package, it registers the target and waits for the scan to complete. Results include risk level, vulnerability list, and remediation recommendations.
Combines lookup and on-demand scanning in one step, so you get results without needing to manually register packages or poll a separate dashboard.
When to use it
- Checking an MCP server package for known vulnerabilities before installing
- Scanning a custom AI agent skill before deploying to production
- Getting a risk assessment on a third-party npm package used in an AI pipeline
- Registering a new package for security scanning and retrieving results automatically
- Reviewing past scan reports for previously audited MCP servers
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: /security-scan --name @anthropic/mcp-server-fetch
- 1Sends the package name to the AICLUDE scan API
- 2Checks if an existing scan report is available
- 3If no report exists, registers the package for scanning
- 4Waits for the scan to complete
- 5Returns risk level, vulnerability list, and remediation recommendations
Risk Level: LOW. No critical vulnerabilities found. 2 informational findings related to dependency versions.