Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Enforces the SEP-2026 Zero Trust protocol by auditing source code, skills, and MCP servers before integration. Runs static analysis via Shield Pro 2.0 and optionally augments findings with Bandit, Safety, NPM Audit, Trivy, and Garak. Target code is never executed during the audit.
Combines multiple specialized security scanners into a single gatekeeper workflow with a clear pass/fail decision, rather than requiring manual coordination across tools.
When to use it
- Auditing a downloaded MCP server before installing it
- Scanning a Python script for obfuscated or malicious patterns
- Checking requirements.txt for typosquatted package names
- Verifying a third-party skill file before adding it to an agent
- Running supply chain checks on Node.js dependencies
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit this downloaded Python skill before I install it
- 1Locate the target file and confirm it has not been executed
- 2Run shield_pro.py on the target with --format json
- 3Run Bandit for Python static analysis if available in the environment
- 4Run Safety to check dependencies against known CVEs if requirements.txt is present
- 5Evaluate results: reject on any Critical or High findings, halt for manual review on Medium findings
JSON report listing findings by severity with a pass/fail decision and flagged lines of code