Openclaw Skill Scanner

What This Skill Does

The Openclaw Skill Scanner is a critical security utility designed to protect your OpenClaw environment from malicious software distributed via ClawHub. In an ecosystem where third-party skills can execute arbitrary code, this tool serves as a proactive defense layer. It performs static and behavioral analysis on skill packages, searching for dangerous patterns such as obfuscated base64 payloads, unauthorized network connections, and attempts to exfiltrate environment variables. By evaluating the code prior to installation or runtime, it assigns a risk score between 0 and 100, allowing users to make informed decisions about the software they integrate into their local infrastructure.

Installation

To install the scanner, run the following command in your terminal: clawhub install openclaw/skills/skills/epwhesq/openclaw-skill-scanner

Once installed, ensure you have the necessary environment permissions to allow the scanner to audit file system access and analyze other installed skill directories. The scanner relies on local scripts (scanner.py) to parse and validate code structures, so verify that your Python environment is configured correctly.

Use Cases

• Pre-Install Vetting: Run python3 scanner.py --pre-install <slug> before adding any new skill to ensure it doesn't contain hidden backdoors.
• Regular Auditing: Integrate the scanner into your maintenance routine to scan all existing skills periodically using python3 scanner.py to ensure no updates introduced malicious behavior.
• Development Integrity: Use the tool to check your own developed skills to ensure you are not inadvertently including dangerous patterns or unsafe dependencies before sharing them on ClawHub.
• Automated Security Pipelines: Utilize the --json output flag to pipe scan results into external monitoring dashboards or continuous integration systems.

Example Prompts

1. "OpenClaw, run a security scan on the 'productivity-helper' skill and tell me if it has a high risk score."
2. "Scan all currently installed skills and generate a report of any that show a risk score above 30."
3. "Perform a pre-install scan on the skill 'crypto-tracker-v2' and explain why it might be flagged for network access."

Tips & Limitations

• Limitations: The scanner uses pattern matching and heuristic analysis. It may produce false positives on complex, legitimate code or miss highly sophisticated, zero-day obfuscation techniques. Always manually review 'Yellow' rated skills.
• Safety: Treat all skills with a score above 70 as 'Red' and avoid installation. If you are forced to use a suspicious skill, execute it in a sandboxed or isolated environment.
• Update Often: Security threats evolve; ensure your scanner is updated regularly to capture the latest detection patterns for new obfuscation methods and exfiltration tactics.