claw-lintSecurity scanner for OpenClaw skills. Detects malware and backdoors before execution, scores risk levels, and monitors file integrity through static code analysis.
Install via ClawdBot CLI:
clawdbot install ParthGhumatkar/claw-lintGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaPotentially destructive shell commands in tool definitions
curl \| bashAccesses system directories or attempts privilege escalation
/etc/cronCalls external URL not in known-safe list
https://evil.com/script.shGenerated Mar 1, 2026
A marketplace platform for OpenClaw skills uses ClawLint to automatically scan uploaded community skills for malware and backdoors before listing them. This ensures all available skills meet security standards, protecting users from malicious code and building trust in the ecosystem.
A financial institution deploys OpenClaw agents with custom skills for data analysis. ClawLint is integrated into their CI/CD pipeline to audit all skills pre-deployment, enforcing risk score thresholds and detecting credential access patterns to comply with internal security policies and regulatory requirements.
A tech company developing proprietary OpenClaw skills uses ClawLint during development to catch security flaws early. Developers run scans locally to identify risky patterns like remote execution, enabling secure coding practices and reducing vulnerabilities before production release.
An organization procuring OpenClaw skills from external vendors employs ClawLint to evaluate security risks in supplied code. They use the JSON output to generate automated reports, comparing risk scores and flags across vendors to make informed procurement decisions and mitigate supply chain attacks.
An online learning platform teaching OpenClaw skill development incorporates ClawLint into courses. Students use it to audit their projects, learning to identify and fix security issues like symbolic links or network calls, fostering security awareness in AI programming.
Offer ClawLint as a cloud-based service where users upload skills for automated scanning via API. Charge monthly subscriptions based on scan volume, with premium tiers for advanced features like detailed JSON reports and integration support, targeting enterprises and skill marketplaces.
Sell enterprise licenses for on-premises deployment of ClawLint, including custom integrations and priority support. Revenue comes from one-time license fees and annual maintenance contracts, appealing to large organizations with strict security and compliance needs.
Provide ClawLint as a free open-source tool for basic scanning, with a premium version offering enhanced analytics, historical risk tracking, and team collaboration features. Monetize through paid upgrades, targeting developers and small teams looking to scale security practices.
💬 Integration Tip
Integrate ClawLint into CI/CD pipelines using the --format json option for automated risk scoring; set --min-score thresholds to fail builds on high-risk detections.
Scored Apr 19, 2026
AI Analysis
The skill is a security auditing tool designed to statically analyze other skills for malicious patterns. It does not execute untrusted code, exfiltrate data, or contain hidden instructions. Its stated purpose and described operations are consistent and defensive in nature.
Audited Apr 16, 2026 · audit v1.0
Control desktop applications on Windows — launch, close, focus, resize, move windows, simulate keyboard/mouse input, manage processes, control VSCode, read clipboard, and capture screen info. Use when the user wants to interact with any running program, switch windows, type text, press shortcuts, open files in VSCode, manage running processes, or get system display information.
Conduct rigorous, adversarial code reviews with zero tolerance for mediocrity. Use when users ask to "critically review" my code or a PR, "critique my code", "find issues in my code", or "what's wrong with this code". Identifies security holes, lazy patterns, edge case failures, and bad practices across Python, R, JavaScript/TypeScript, SQL, and front-end code. Scrutinizes error handling, type safety, performance, accessibility, and code quality. Provides structured feedback with severity tiers (Blocking, Required, Suggestions) and specific, actionable recommendations.
Coding style memory that adapts to your preferences, conventions, and patterns for consistent coding.
Pragmatic coding standards for writing clean, maintainable code — naming, functions, structure, anti-patterns, and pre-edit safety checks. Use when writing new code, refactoring existing code, reviewing code quality, or establishing coding standards.
Claude Code integration for OpenClaw. This skill provides interfaces to: - Query Claude Code documentation from https://code.claude.com/docs - Manage subagents and coding tasks - Execute AI-assisted coding workflows - Access best practices and common workflows Use this skill when users want to: - Get help with coding tasks - Query Claude Code documentation - Manage AI-assisted development workflows - Execute complex programming tasks
Plan, draft, version, and refine written content with enforced versioning and quality audits.