pwnclaw-security-scanTest your AI agent for security vulnerabilities using PwnClaw. Runs 50+ attacks (prompt injection, jailbreaks, social engineering, MCP poisoning, and more) and provides fix instructions. Use when your agent needs a security check or hardening.
Install via ClawdBot CLI:
clawdbot install Gemini2027/pwnclaw-security-scanGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Sends data to undocumented external endpoint (potential exfiltration)
POST → https://www.pwnclaw.com/api/test/{token}`Calls external URL not in known-safe list
https://www.pwnclaw.com**AI Analysis
The skill's external API calls are consistent with its stated purpose of security testing and are directed to its own documented service (pwnclaw.com). While it sends conversation data externally, this is for analysis as part of a user-initiated security scan, not covert exfiltration. The skill definition is transparent and contains no hidden instructions or obfuscation.
Audited Apr 16, 2026 · audit v1.0
Generated Mar 1, 2026
A company deploys an AI agent for customer support handling sensitive data like account details and payment information. They use PwnClaw to test for vulnerabilities like prompt injection and data exfiltration to prevent breaches and ensure compliance with data protection regulations.
A healthcare provider integrates an AI assistant to help patients with medical queries and appointment scheduling. Running PwnClaw scans checks for social engineering and jailbreak attacks to safeguard patient privacy and maintain trust in the healthcare system.
An educational platform uses an AI tutor to interact with students and provide learning materials. They employ PwnClaw to detect vulnerabilities like MCP poisoning and refusal bypass, ensuring the agent remains safe and educational without exposing students to harmful content.
A large enterprise automates internal workflows with AI agents handling tasks like document processing and communication. PwnClaw is used to test for multi-agent attacks and privilege escalation to secure corporate data and prevent operational disruptions.
Offers a free tier with limited scans to attract individual developers and small teams, then upsells to Pro and Team plans for higher volume and advanced features. Revenue comes from monthly subscriptions, with pricing in euros to target European and global markets.
Provides customized security audits and hardening services for large organizations, leveraging PwnClaw's automated scans as a tool. Revenue is generated through project-based contracts and ongoing support, focusing on industries with high security needs like finance and healthcare.
Maintains the tool as open-source on GitHub for transparency and community trust, while monetizing through premium support, training, and integration services. This model builds credibility and drives adoption among tech-savvy users who value auditability.
💬 Integration Tip
For quick setup, use the automatic mode by providing your agent's HTTP endpoint in the PwnClaw dashboard, which requires no coding and is ideal for beginners.
Scored Apr 19, 2026
Scan networks to discover devices, gather MAC addresses, vendors, and hostnames. Includes safety checks to prevent accidental scanning of public networks.
Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews.
Perform network reconnaissance and port scanning with Nmap to find open ports, detect services, identify vulnerabilities, and enumerate targets accurately.
Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guida...
Automatically generate professional CTF writeups from solving sessions with flag detection, challenge categorization, and proper markdown formatting
Plan and orchestrate authorized Nmap host discovery, port and service enumeration, NSE profiling, and reporting artifacts for in-scope targets.