Skill Guard Pro

Security scanner for ClawHub skills. Analyze before you install.

Security Scan

The skill's code, instructions, and requirements are consistent with a static scanner for ClawHub skills; it doesn't request credentials or system privileges beyond downloading skill packages for analysis.

Purpose & Capability

Name/description (security scanner) match the included files: analyzer, patterns, reporter, downloader, and a scan CLI. The declared required binary ('uv') is used by the README/SKILL.md examples and the project expects 'uv run' to execute the provided script. Nothing in the code requires unrelated cloud credentials or unrelated binaries.

Instruction Scope

SKILL.md instructs the agent to run the included scanner (uv run scripts/scan.py) and to optionally download skills via the clawhub CLI. The scanner performs static analysis only (regex/AST) and does not execute downloaded code. This is appropriate for the stated purpose, but the downloader will fetch arbitrary third-party skill code into a temp directory for analysis — you should ensure the clawhub CLI you use is trusted and understand that downloaded code is untrusted input to be inspected, not executed.

Install Mechanism

No install script is provided (instruction-only install examples). The repository contains Python code intended to be run directly. There are no opaque remote downloads or extracted archives performed by the skill itself. The only external tool invoked programmatically is the clawhub CLI (via subprocess), which is necessary to retrieve remote skills and is consistent with purpose.

Credentials

The skill declares no required environment variables or credentials and the code does not read secrets from the runtime environment. Pattern definitions look for credential-related patterns in target code (e.g., os.getenv in scanned files) but that is detection logic, not use of the host's secrets. No disproportionate credential access is requested.

Persistence & Privilege

Flags show always:false and default invocation behavior. The skill does not attempt to modify other skills or global agent configuration. It downloads files to a temporary directory and has cleanup logic to remove them; no persistent privileged presence is requested.

Assessment

This skill appears to do exactly what it says: static analysis of ClawHub skills. Before installing, ensure you have the 'uv' runner and the 'clawhub' CLI from a trusted source, because the scanner will invoke the clawhub CLI to download third‑party skills into a temp directory for analysis. The scanner does not execute downloaded code, it only inspects it. Review the scanner's code if you want additional assurance (the repo is small and readable). If you rely on automated scanning for security decisions, remember static analysis has limits — follow the tool's own advice to manually review any CAUTION/DANGEROUS findings.

ClawGuard 🛡️

Scan ClawHub skills for security risks before installing.

ClawGuard performs static code analysis on ClawHub skills to detect:

• 🌐 Network exfiltration (HTTP POST to external URLs)
• 🔑 Credential access (API keys, tokens, passwords)
• ⚡ Shell command execution
• 💥 File destruction (rm -rf, unlink)
• 🎭 Code obfuscation (eval, base64 decode)
• 👻 Hidden files and directories

Usage

Scan by skill name

Download and scan a skill from ClawHub:

uv run {baseDir}/scripts/scan.py --skill <skill-name>

Scan local directory

Scan a skill directory on your local filesystem:

uv run {baseDir}/scripts/scan.py --path /path/to/skill

JSON output

Get results in JSON format:

uv run {baseDir}/scripts/scan.py --skill <skill-name> --json

Examples

Scan the GitHub skill:

uv run {baseDir}/scripts/scan.py --skill github

Scan a local skill:

uv run {baseDir}/scripts/scan.py --path ~/.openclaw/skills/my-skill

Risk Levels

• 🟢 SAFE (0-30): No significant risks detected
• 🟡 CAUTION (31-60): Review flagged items before installing
• 🔴 DANGEROUS (61-100): High-risk patterns detected — DO NOT INSTALL

Exit Codes

• 0: Safe
• 1: Caution
• 2: Dangerous

Requirements

• Python 3.11+
• uv (Python package manager)
• clawhub CLI (optional, for downloading skills)

How It Works

1. Pattern Matching: Regex-based detection of dangerous code patterns
2. AST Analysis: Python AST parsing for eval/exec detection
3. URL Extraction: Identifies all network endpoints
4. Risk Scoring: Weighted severity scoring (0-100)

What It Detects

Category	Weight	Examples
Network exfiltration	25	POST to unknown URL with data
Credential access	20	Reading API keys, tokens
Shell execution	15	exec(), subprocess, system()
File destruction	15	rm -rf, unlink, rmdir
Obfuscation	15	eval(), atob(), Buffer.from
Hidden files	10	Dotfiles, hidden directories

Limitations

• Static analysis only: Cannot detect runtime behavior
• Regex-based: May have false positives/negatives
• JS/TS: Basic pattern matching (no full AST parsing)
• Encrypted/minified code: Cannot analyze obfuscated payloads

Best Practices

1. Always scan before installing untrusted skills
2. Review CAUTION-level findings manually
3. Check network endpoints for unknown domains
4. Never install DANGEROUS skills without verification
5. Report suspicious skills to ClawHub moderators

License

MIT