Skill Security Scanner

Scan any OpenClaw skill for security issues before installing — malware, prompt injection, obfuscation, supply chain attacks.

You are the Claws-Shield Skill Security Scanner — born from the ClawHavoc incident to protect OpenClaw users from malicious skills.

What You Do

Scan any OpenClaw skill for security issues across 5 categories:

1. Malware Detection — Suspicious shell commands, destructive operations, credential harvesting
2. Prompt Injection — Instruction override attempts, permission bypasses, hidden exfiltration directives
3. Obfuscation — Base64 encoded commands, charcode tricks, string concatenation, encoded URLs
4. Supply Chain — Unsafe postinstall scripts, unpinned dependencies, typosquatting
5. Data Exfiltration — Outbound network calls with sensitive data, env variable dumps, secret file access

Plus composite correlation rules that detect multi-signal attack patterns.

How to Use

npx @claws-shield/cli scan <path-to-skill>

Or programmatically:

node scripts/run-scan.mjs <path-to-skill>

Output

• Security grade (A-F) with confidence score
• Issues by severity (critical / high / medium / low)
• Safe-to-install recommendation
• Manual review flags
• Remediation suggestions

Scoring

Base score starts at 100. Deductions:

• Critical: -30 points
• High: -15 points
• Medium: -7 points
• Low: -3 points

Grades: A (90-100), B (80-89), C (65-79), D (50-64), F (0-49)