gh-skillscanScan an OpenClaw SKILL.md file for security threats before installing it. Posts the raw SKILL.md content and gets back a safety score (0-1), detected threat...
Install via ClawdBot CLI:
clawdbot install mirni/gh-skillscanGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Sends data to undocumented external endpoint (potential exfiltration)
POST → https://api.greenhelix.net/skillscan/v1/scan-skillCalls external URL not in known-safe list
https://api.greenhelix.net/skillscan/v1/scan-skillAI Analysis
The skill's primary function is to scan other skills for security risks, and its documented external API call (api.greenhelix.net) is consistent with this stated purpose. While it sends skill content to an external server for analysis, this is the core functionality and not hidden credential harvesting or unauthorized data exfiltration. The risk is low as the data transfer is expected and for the declared security analysis service.
Audited Apr 16, 2026 · audit v1.0
Generated Oct 6, 2026
Marketplace operators run every submitted SKILL.md through SkillScan before publishing, blocking credential harvesters and exfiltration payloads from reaching users. The verdict and findings are attached to each listing so buyers can see an auditable safety score.
Platform teams add a SkillScan step to their CI pipeline so any PR that adds or modifies a SKILL.md is scanned automatically. Builds fail on DANGEROUS verdicts and post findings as PR comments, catching malicious or careless skill additions before merge.
Security teams deploy SkillScan internally and log every scan result to a SIEM or compliance store, building a record of which skills were approved and why. Policy thresholds can require manual review for CAUTION verdicts on skills touching secrets or SSH directories.
Independent consultants and auditors use SkillScan to quickly triage third-party skills for clients who want assurance before adopting community agents. The structured safety_score and findings list become the basis for a written security assessment report.
Open-source community maintainers batch-scan newly submitted skills and auto-label them by risk tier, surfacing a curated 'verified safe' collection. Malicious submissions are quarantined and reported to ecosystem maintainers.
Host SkillScan as a managed API where customers send SKILL.md content and receive scored verdicts on demand, with usage-based pricing tiers. Integrates directly into marketplace submission flows and CI pipelines via a simple REST endpoint.
Sell an on-premises or VPC-deployable version of the FastAPI service to enterprises that cannot send skill content to external APIs. Includes audit logging, SIEM integration, and policy-configurable verdict thresholds.
Operate a certification service that scans submitted skills and issues a 'SkillScan Verified' badge for safe listings. Charge marketplaces and skill authors for expedited review, re-scanning, and public trust signals.
💬 Integration Tip
Run the server with uvicorn and wire the /v1/scan-skill endpoint into your install script or CI step, failing the pipeline on DANGEROUS verdicts. Use jq -Rs to safely escape the SKILL.md content and parse the verdict for automated gating.
Scored Oct 6, 2026
Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill folders with the npm-installed clawdhub CLI.
Transcribe YouTube videos to text by extracting captions and subtitles directly from the video URL using yt-dlp without audio processing.
Proactive security monitoring, threat scanning, and auto-remediation for OpenClaw deployments
Create or improve SOUL.md files for OpenClaw agents through guided conversation. Use when designing agent personality, crafting a soul, or saying "help me create a soul". Supports self-improvement.
macOS Gateway 24/7 watchdog with 4-layer health checks and auto-repair. Monitors: L1 process alive, L2 HTTP port, L3 WebSocket communication (1006 detection)...
Run ClawHub skill release workflows with clear safety gates. Use for publish, inspect, update, sync, and failure recovery with command-first steps, explicit...