agent-security-skill-scanner

What This Skill Does

The Agent Security Skill Scanner (v2.2.1) is an essential diagnostic utility designed to bolster the integrity of your AI agent ecosystem. As OpenClaw agents increasingly leverage third-party skills, the risk of supply chain attacks, unauthorized code execution, and credential exfiltration grows. This scanner performs deep static analysis on skill repositories, identifying malicious patterns such as ClawHavoc payloads, MCP backdoors, obfuscated logic, and dangerous eval/exec abuse. It maintains a robust rule-based database of over 3,000 known threat signatures, including malicious npm/Python packages and hardcoded secrets. By integrating this scanner into your deployment pipeline, you can proactively audit AI behavior and ensure that agents operate within secure parameters, reducing the attack surface of your automation infrastructure.

Installation

To integrate this security scanner into your OpenClaw environment, execute the following command in your terminal: clawhub install openclaw/skills/skills/caidongyun/agent-security-skill-scanner Alternatively, you can navigate to the local directory and run the provided shell script: cd skills/agent-security-skill-scanner && ./install.sh Ensure you have Python 3.10+ installed, as the scanner relies on advanced AST (Abstract Syntax Tree) parsing for its detection engines.

Use Cases

1. Continuous Integration (CI): Automate the scanning of internal agent skills before they are published to your team’s private registry.
2. Third-Party Auditing: Verify external skills from the ClawHub community for hardcoded API keys or unauthorized network call patterns before execution.
3. Post-Incident Forensics: If an agent displays anomalous behavior, run the scanner against suspected local skill directories to isolate potential malicious logic.
4. Compliance Monitoring: Ensure all organizational skills adhere to strict file access and execution policies through automated routine audits.

Example Prompts

1. "Scan the local directory ./skills/my-custom-assistant for any potential security backdoors or sensitive hardcoded credentials."
2. "Perform a comprehensive security audit of all installed agent skills in the standard library and generate a report in JSON format."
3. "Check if the newly downloaded 'data-fetcher' skill contains any obfuscated code or unauthorized network request patterns."

Tips & Limitations

This is a Beta version (v2.2.1), and while it boasts a 95% detection rate, it should not replace manual code review for mission-critical production environments. The tool primarily utilizes static analysis; thus, it may struggle with highly dynamic, multi-stage polymorphic payloads that only manifest behavior during runtime. We recommend running this scanner alongside a sandbox environment for maximum security coverage. Always keep your rule definitions updated to ensure the scanner can identify the latest emerging threat vectors.