skill-security-scannerScan OpenClaw skills for security risks, suspicious permissions, and provide a trust score to help evaluate skill safety before use or installation.
Install via ClawdBot CLI:
clawdbot install steffano198/skill-security-scannerGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.aws/credentialsSends data to undocumented external endpoint (potential exfiltration)
POST → https://SUSPICIOUS-DOMAIN/exfilCalls external URL not in known-safe list
https://SUSPICIOUS-DOMAIN/exfilAI Analysis
The skill contains direct evidence of credential access targeting ~/.aws/credentials and sends data to an undocumented external endpoint labeled as a potential exfiltration channel. These actions constitute active data harvesting and exfiltration, which are severe security violations.
Audited Apr 16, 2026 · audit v1.0
Generated Mar 20, 2026
Users or organizations can use the skill to scan new skills from ClawHub before installation, identifying security risks like suspicious permissions or code patterns to prevent deploying malicious tools in their AI agent ecosystem.
IT or security teams can schedule automated scans of all installed skills to ensure ongoing compliance with security policies, detect vulnerabilities from updates, and maintain a secure AI environment.
AI developers and researchers can leverage the skill to evaluate the safety of third-party skills, using trust scores and detailed reports to make informed decisions when integrating external tools into their projects.
After security incidents like ClawHavoc, teams can use the skill to audit existing skills for malicious patterns, identify compromised tools, and generate reports for remediation and documentation.
Open-source communities or platform maintainers can integrate the skill to scan skills shared in repositories, flagging high-risk patterns to protect users and improve overall ecosystem security.
Offer basic scanning features for free to attract users, with premium tiers providing advanced analytics, automated reporting, and integration with enterprise systems for recurring subscription revenue.
Package the skill as part of a larger security suite for organizations, including features like centralized dashboards, compliance tracking, and support services, sold through licensing agreements.
Provide professional services where experts use the skill to conduct in-depth security audits for clients, offering customized reports, remediation advice, and training sessions for project-based fees.
💬 Integration Tip
Integrate with memory skills to log and recall trust scores over time, enhancing decision-making and reducing repetitive scans for known skills.
Scored Apr 19, 2026
Manage and operate ClawSec Monitor v3.0, a MITM HTTP/HTTPS proxy that logs AI agent traffic, detects exfiltration and injection threats in real time.
Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data exfiltration, system modification attempts, backdoors, and obfuscation techniques.
Security scanner for ClawHub skills. Vet third-party skills before installation — detect dangerous patterns, suspicious code, and risky dependencies.
Security audit and hardening for AI agents — credential hygiene, secret scanning, prompt injection defense, data leakage prevention, and privacy zones.
Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them. Use when a user wants to audit a skill, check if a ClawHub skill is safe, scan for credential exfiltration, detect prompt injection, or review skill security. Triggers on security audit, skill safety check, malware scan, or trust verification.
OpenClaw skill discovery, security vetting & install. Searches 3000+ curated skills from ClawHub registry and awesome-openclaw-skills catalog. Scores credibility, detects prompt injection & malicious patterns, manages installations. Quick-checks GitHub for new skills.