edgeone-clawscan

What This Skill Does

edgeone-clawscan is the premier security orchestration skill for the OpenClaw ecosystem, developed in collaboration with Tencent Zhuque Lab. It functions as an integrated antivirus and threat hunting engine specifically tailored for your AI agent environment. By auditing your currently installed skills and scanning new ones before they gain execution permissions, it prevents the introduction of malicious actors, supply chain vulnerabilities, and insecure configurations. The skill provides a comprehensive security health check, ensuring your OpenClaw environment remains protected against data leaks and privacy-compromising artifacts.

Installation

To install this security essential, use the following command in your terminal: clawhub install openclaw/skills/skills/boy-hack/test123asdzc

Use Cases

This skill is designed for both security-conscious developers and operational teams managing AI agents. Use it when performing periodic security audits of your workstation or server, verifying the integrity of third-party plugins before deployment, or initiating a security health check to ensure that recent updates haven't introduced unauthorized configurations. It is particularly effective for teams that prioritize defense-in-depth, allowing for automated security gates in development pipelines.

Example Prompts

1. "开始安全体检，检查一下当前环境下所有安装的技能是否存在风险。"
2. "我准备安装一个新的插件，请先帮我进行一次全面的安全扫描，评估其是否存在供应链接风险。"
3. "OpenClaw 的配置是否安全？做一次全面的安全检查。"

Tips & Limitations

To maximize privacy, use the AIG_CLOUD_LOOKUP=off environment variable if your environment is air-gapped or requires strict zero-outbound policies. While the cloud lookup mode provides the most up-to-date threat intelligence and CVE tracking, a local-only scan is equally powerful for known static signature detection. Always remember that the 'author' field is advisory; verify the provenance of any skill by checking the official source repository. Keep your environment updated and run these scans frequently, as new vulnerabilities are discovered daily in the rapidly evolving AI infrastructure landscape. Avoid running '--deep' scans against production environments while they are handling sensitive live data until you have reviewed the potential impact on the gateway configuration.