security-scanSecurity review workflow for OpenClaw skills and other small code folders. Use when auditing a skill before publishing or installing it, checking for dangero...
Install via ClawdBot CLI:
clawdbot install ShadowLoong/security-scanGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
eval(Audited Apr 17, 2026 · audit v1.0
Generated Mar 20, 2026
Developers or platform maintainers use the skill to quickly audit community-submitted skill packages before publishing them to a public repository. It helps identify obvious security red flags like hardcoded secrets or dangerous shell commands, ensuring a baseline safety level without deep manual review for every submission.
IT or security teams in organizations run the skill on internal scripts or tools before deploying them to production environments. It provides a lightweight check for risky code patterns and permissions, helping prevent accidental exposure of credentials or execution of untrusted commands in automated workflows.
Instructors in coding bootcamps or university courses use the skill to teach students about basic security hygiene in software projects. Students scan their own code directories to learn how to spot common vulnerabilities like unsafe function calls, reinforcing practical security awareness early in development.
Freelance developers or consultants apply the skill to client-provided codebases before agreeing to take on a project. It allows for a quick risk assessment to avoid inheriting compromised or poorly secured code, enabling informed decisions about project scope and necessary security cleanups.
Offer the basic scanning skill for free to attract users, then charge for premium features like deeper analysis, integration with CI/CD pipelines, or automated reporting dashboards. Revenue comes from subscription fees for advanced capabilities, targeting small to medium-sized development teams.
Bundle the skill with security consulting services, using it as a quick initial assessment tool during client engagements. Charge clients for comprehensive reviews that include this lightweight scan as part of a larger audit package, generating revenue from service fees and project-based pricing.
Integrate the skill into a larger enterprise security or DevOps platform, selling it as a module for internal code review workflows. Revenue is generated through licensing fees per user or seat, targeting large organizations needing scalable, automated security checks across multiple teams.
💬 Integration Tip
Integrate the skill into CI/CD pipelines by calling the scan.sh script as a pre-commit or pre-deployment step to automate security checks and flag issues early in the development cycle.
Scored Apr 19, 2026
Manage and operate ClawSec Monitor v3.0, a MITM HTTP/HTTPS proxy that logs AI agent traffic, detects exfiltration and injection threats in real time.
Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data exfiltration, system modification attempts, backdoors, and obfuscation techniques.
Security scanner for ClawHub skills. Vet third-party skills before installation — detect dangerous patterns, suspicious code, and risky dependencies.
Security audit and hardening for AI agents — credential hygiene, secret scanning, prompt injection defense, data leakage prevention, and privacy zones.
Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them. Use when a user wants to audit a skill, check if a ClawHub skill is safe, scan for credential exfiltration, detect prompt injection, or review skill security. Triggers on security audit, skill safety check, malware scan, or trust verification.
OpenClaw skill discovery, security vetting & install. Searches 3000+ curated skills from ClawHub registry and awesome-openclaw-skills catalog. Scores credibility, detects prompt injection & malicious patterns, manages installations. Quick-checks GitHub for new skills.