Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Added LLM-powered intent analysis (analyze_skill_intent) for detecting semantic and social engineering threats, using free LLMs. - Expanded audit coverage: now 743+ real findings from 361+ skill audits and 145+ deep scans. - Increased database scope: 73+ known-dangerous skills, 25 dangerous pattern rules, 22 attack classes, 31 audit rounds. - Enhanced pattern and attack class documentation, including new types like supply chain risks and anti-safety training. - Updated threat landscape insights and included additional audit rounds and critical findings. - Improved tool descriptions and added the new intent analysis tool under Available Tools.
What This Skill Does
Security intelligence service for the AI agent ecosystem, accessed via MCP SSE endpoint. Queries a database of known-dangerous skills, scans source code against 25 pattern rules, and runs LLM-powered intent analysis on SKILL.md files to detect mismatches and social engineering. Built from 743+ findings across 361+ real ClawHub skill audits.
Combines static pattern matching with LLM-based intent analysis to catch social engineering attacks that regex scanners miss, at no cost per query.
When to use it
- Checking a ClawHub skill for known malicious behavior before installing
- Scanning skill source code for shell injection or credential exposure patterns
- Detecting capability-purpose mismatches in a SKILL.md description
- Looking up one of 22 documented agent attack classes by name
- Pulling current audit stats and active disclosures before a security review
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Is this ClawHub skill safe to install?
- 1Call check_skill_safety with the skill slug to query the known-dangerous skills database
- 2Call analyze_skill_code with the skill source to scan against 25 dangerous pattern rules
- 3Call analyze_skill_intent with the SKILL.md content to detect capability-purpose mismatches or exfiltration channels
- 4Aggregate findings by severity across all three checks
Report listing any known-dangerous matches, pattern rule violations, and intent analysis flags with recommended mitigations