agent-security-skill-scannerEnterprise AI Agent Security Scanner - 846 rules, three-layer detection architecture, risk tier classification. Detects prompt injection, credential theft, d...
Install via ClawdBot CLI:
clawdbot install caidongyun/agent-security-skill-scannerGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaSends data to undocumented external endpoint (potential exfiltration)
webhook → https://example.com/alertPotentially destructive shell commands in tool definitions
rm -rf /Accesses system directories or attempts privilege escalation
/etc/sudoersGenerated May 9, 2026
Integrate the scanner into a CI/CD pipeline to automatically detect malicious code or excessive permissions in AI skill packages before deployment. This prevents vulnerable or backdoored skills from reaching production environments.
When an organization consumes AI skills from external marketplaces or contributors, use the scanner to audit each package for security issues. This ensures only vetted skills are installed in enterprise agent ecosystems.
Security teams can schedule regular scans of all installed agent skills to catch newly discovered vulnerability patterns. This helps maintain a secure agent environment over time.
Security researchers can use the scanner to analyze suspicious skill files shared in the community, extracting indicators of compromise and behavior patterns to update detection rules.
When new developers contribute custom skills, the scanner acts as a pre-commit hook to prevent accidental inclusion of dangerous patterns like hardcoded credentials or eval statements.
Offer the scanner as a cloud-based API where customers submit skill packages for analysis and receive detailed reports. Charged per scan or via monthly subscription tiers based on volume.
Sell the scanner as a licensed product to enterprises, including custom detection rule development and integration support. Annual license fee plus optional maintenance contracts.
Release the core scanner as open-source (MIT license) and offer premium features such as advanced reporting, CI/CD plugins, and dedicated support via a paid plan.
💬 Integration Tip
To integrate into CI/CD, wrap the scanner CLI in a script that fails the pipeline if any critical issues are found. Schedule periodic full scans using the scan-all command for ongoing monitoring.
Scored Jul 2, 2026
Calls external URL not in known-safe list
https://gitee.com/caidongyun/agent-security-skill-scanner/issuesAI Analysis
The skill's definition includes high-risk signals such as accessing sensitive credential files (~/.ssh/id_rsa) and sending data to an undocumented external endpoint (https://example.com/alert), which are not justified by its stated purpose of scanning other skills. While it may be a legitimate security tool, these patterns indicate potential credential harvesting or data exfiltration capabilities that pose a risk.
Audited Apr 17, 2026 · audit v1.0
Manage and operate ClawSec Monitor v3.0, a MITM HTTP/HTTPS proxy that logs AI agent traffic, detects exfiltration and injection threats in real time.
Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data exfiltration, system modification attempts, backdoors, and obfuscation techniques.
Security scanner for ClawHub skills. Vet third-party skills before installation — detect dangerous patterns, suspicious code, and risky dependencies.
Security audit and hardening for AI agents — credential hygiene, secret scanning, prompt injection defense, data leakage prevention, and privacy zones.
Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them. Use when a user wants to audit a skill, check if a ClawHub skill is safe, scan for credential exfiltration, detect prompt injection, or review skill security. Triggers on security audit, skill safety check, malware scan, or trust verification.
OpenClaw skill discovery, security vetting & install. Searches 3000+ curated skills from ClawHub registry and awesome-openclaw-skills catalog. Scores credibility, detects prompt injection & malicious patterns, manages installations. Quick-checks GitHub for new skills.