Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Internal maintenance updates for broader standards compliance. - Added SECURITY.md with security policy disclosure. - Updated package metadata in pyproject.toml. - No changes to functionality or user-facing features.
What This Skill Does
Static analysis tool that scans OpenClaw skill files for hardcoded secrets, shell injection, dangerous permissions, and malicious code patterns. Assigns a 0-100 risk score to guide install decisions. Integrates with Clawdex to check skills against a database of known-malicious entries.
Combines static behavior analysis with Clawdex's database of 824+ known-bad skills, covering both zero-day detection and signature-based matching in a single scan.
When to use it
- Scanning a third-party skill before installing it
- Checking your own skill for leaked secrets before publishing
- Running automated skill security checks in a CI/CD pipeline
- Auditing all installed skills after a suspicious incident
- Getting a risk score breakdown for a skill shared within a team
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: scan ./suspicious-skill/ and tell me if it is safe to install
- 1Run `crabukit scan ./suspicious-skill/` in the terminal
- 2Crabukit queries the Clawdex database for known-malicious matches
- 3Static analysis inspects SKILL.md and scripts for secrets, eval/exec calls, shell risks, and dangerous permission requests
- 4Aggregates all findings into a risk score from 0 to 100
- 5Reports flagged issues by category with severity levels
Risk score (e.g., 32/100 - High) with a list of specific findings such as a hardcoded API key on line 14 and an unquoted shell variable in install.sh