Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Pattern-based security scanner for code, files, and agent skills. Detects common vulnerabilities like SQL injection, XSS, hardcoded secrets, and path traversal using static analysis scripts. Pro tier adds continuous monitoring and professional report generation.
The basic tier requires no dependencies beyond Python 3.8 standard library and no cloud account, making it usable in air-gapped or restricted environments where SaaS scanners are not an option.
When to use it
- Scanning a codebase before a pull request for hardcoded API keys
- Auditing a third-party agent skill before adding it to a workflow
- Checking a legacy web app for SQL injection and XSS patterns
- Watching a project directory for new secrets introduced during development
- Generating a formatted security findings report to share with a client
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: scan my project directory for critical and high severity issues and show results as markdown
- 1Run threat_scan.py against the target directory with --severity critical,high and --output markdown
- 2Run secret_scan.py against the same directory to check for hardcoded credentials
- 3Collect output from both scripts
- 4Format findings into a combined markdown summary with severity counts
Markdown report listing critical and high findings grouped by type, with file paths and line references for each issue