Setup & Installation
openclaw skills install @moenassi/osv-scanner
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
npx clawhub install osv-scanner
What This Skill Does
Scans Node.js/NPM and Python dependencies for known vulnerabilities using the Google OSV API. Reads package.json or a pip freeze output, queries OSV, and returns any CVEs affecting those packages. Results are exported as an Excel file.
Uses the Google OSV API directly, so no account or API key is required and results reflect the same database used by major dependency scanners.
When to use it
- Auditing a Node.js project before deployment
- Checking pip dependencies for CVEs in a Python service
- Running a quick security scan on an inherited codebase
- Identifying vulnerable packages before a production release
- Reviewing third-party library risk in an open source project
Example Workflow
Here's how your AI assistant might use this skill in practice.
INPUT
User asks: scan my Node.js project for vulnerabilities
AGENT
- 1Copy package.json to the packages/ folder and name it packages.json
- 2Create and activate a Python virtual environment
- 3Install requests and openpyxl via pip
- 4Run python3 scanner.py npm
- 5Receive Excel report listing any CVEs found in dependencies
OUTPUT
An .xlsx file listing each vulnerable package, version, and associated CVE identifiers