skill-bomb-dog-sniffSecurity-first skill management for OpenClaw - like a bomb-sniffing dog for skills. Sniffs out malicious payloads (crypto stealers, keyloggers, reverse shells) before installation. Quarantine → Scan → Install only the safe ones.
Install via ClawdBot CLI:
clawdbot install lvcidpsyche/skill-bomb-dog-sniffGrade Limited — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
process.env.OPENAISends data to undocumented external endpoint (potential exfiltration)
POST → https://attacker.com/stolenPotentially destructive shell commands in tool definitions
curl | bashCalls external URL not in known-safe list
https://github.com/openclaw/skills/bomb-dog-sniffGenerated Mar 21, 2026
IT teams can use this skill to perform routine security scans on internal networks, identifying vulnerabilities like open ports or outdated software. It helps maintain compliance with industry standards and prevents data breaches by proactively detecting threats.
Online retailers can deploy this skill to scan their websites and payment systems for security flaws, such as SQL injection or cross-site scripting risks. This ensures customer data protection and builds trust by safeguarding transactions against malicious attacks.
Healthcare providers can utilize this skill to scan electronic health record systems for vulnerabilities, ensuring compliance with regulations like HIPAA. It helps prevent unauthorized access to sensitive patient information and reduces the risk of cyberattacks on critical infrastructure.
Schools and universities can apply this skill to scan campus networks and student portals for security weaknesses, such as malware or phishing attempts. This protects academic data and maintains a safe digital learning environment for students and staff.
Banks and fintech companies can employ this skill to conduct security scans on their financial platforms, detecting issues like insecure APIs or data leaks. It aids in meeting regulatory requirements and preventing fraud by identifying potential entry points for attackers.
Offer this skill as part of a monthly subscription for businesses to perform regular security scans, providing automated reports and alerts. This model ensures recurring revenue and helps clients stay protected with ongoing monitoring and updates.
Provide basic scanning functionality for free to attract users, with advanced features like detailed analytics or priority support available for a fee. This model drives adoption and converts free users into paying customers for enhanced security solutions.
Sell enterprise licenses for large organizations to integrate this skill into their security infrastructure, complemented by consulting services for customization and training. This model generates high-value contracts and long-term partnerships with corporate clients.
💬 Integration Tip
Integrate this skill with existing monitoring tools via APIs to automate scan triggers and consolidate security alerts for efficient management.
Scored Apr 19, 2026
Uses known external API (expected, informational)
api.github.comAI Analysis
The skill demonstrates clear credential harvesting by accessing `process.env.OPENAI` and performs data exfiltration by sending a POST request to a confirmed malicious domain `https://attacker.com/stolen`. The use of unsafe shell commands (`curl | bash`) further elevates the risk.
Audited Apr 17, 2026 · audit v1.0
Manage and operate ClawSec Monitor v3.0, a MITM HTTP/HTTPS proxy that logs AI agent traffic, detects exfiltration and injection threats in real time.
Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data exfiltration, system modification attempts, backdoors, and obfuscation techniques.
Security scanner for ClawHub skills. Vet third-party skills before installation — detect dangerous patterns, suspicious code, and risky dependencies.
Security audit and hardening for AI agents — credential hygiene, secret scanning, prompt injection defense, data leakage prevention, and privacy zones.
Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them. Use when a user wants to audit a skill, check if a ClawHub skill is safe, scan for credential exfiltration, detect prompt injection, or review skill security. Triggers on security audit, skill safety check, malware scan, or trust verification.
OpenClaw skill discovery, security vetting & install. Searches 3000+ curated skills from ClawHub registry and awesome-openclaw-skills catalog. Scores credibility, detects prompt injection & malicious patterns, manages installations. Quick-checks GitHub for new skills.