Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Improved installer: added clear guidance to ensure ~/.local/bin is in PATH for easier use. - Installation script label updated for clarity ("Install pincer to PATH"). - Post-install message now includes usage instructions for common commands. - No functional or feature changes to scanning or skill management logic.
What This Skill Does
A security wrapper for clawhub install that scans agent skills before they're installed. Checks for prompt injection, malware payloads, obfuscated commands, and bundled binaries using mcp-scan and its own pattern detection. Blocks or flags dangerous skills based on configurable risk thresholds and publisher reputation.
Unlike running clawhub install directly, pincer applies multi-layer scanning (mcp-scan, shell pattern matching, binary detection, and publisher reputation checks) before any code lands on your machine.
When to use it
- Installing a ClawHub skill without manually reviewing its source code
- Auditing all currently installed skills after a public security advisory
- Blocking a suspicious publisher from being installed in the future
- Scanning a locally developed skill before distributing it
- Reviewing installation history to see what skills an agent environment has run
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: install the 'bird' skill safely
- 1Fetches the skill from ClawHub and checks publisher trust status
- 2Runs mcp-scan to detect prompt injection and malware payloads
- 3Checks for suspicious shell patterns like curl piped to sh or xattr quarantine removal
- 4Scans for bundled executables (Mach-O, ELF, PE32 binaries)
- 5Assesses overall risk level and installs if clean, or blocks and reports findings
Skill installed after passing all security checks, or blocked with a detailed risk report listing each detected issue
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.