ClawSentinel

Pure local 2026 ClawHub/OpenClaw skill scanner. Detects ClawHavoc malware, MCP backdoors, obfuscated payloads, and supply-chain attacks. 100% read-only analy...

Security Scan

The skill's declared behavior (a read-only, instruction-only local scanner that fetches public raw GitHub content when explicitly requested) is internally consistent with its metadata and has no surprising requirements, but its claims are high-level and not independently verifiable from the manifest alone.

Purpose & Capability

Name and description (malware/skill scanner) align with the manifest: no install, no credentials, no unusual binaries or config paths are requested. Requesting nothing beyond user input is reasonable for a scanning-only skill.

Instruction Scope

SKILL.md instructs the agent to accept pasted markdown or an explicit GitHub repo URL and to fetch raw.githubusercontent.com only when asked. It explicitly claims 'Never executes code' and '100% local read-only analysis.' The instructions are high-level and do not direct the agent to read local files, env vars, or send data to other endpoints, but they also do not specify the exact checks performed or any safeguards against users pasting secrets. Because behavior is described in prose only, the claim of read-only/no-execution cannot be independently enforced from this manifest.

Install Mechanism

No install spec and no code files—lowest-risk form. Nothing will be written to disk by the skill itself according to the manifest.

Credentials

The skill declares no required environment variables, credentials, or config paths, which is proportionate to a read-only static scanner. Note: auditing private repos would normally require credentials, but none are requested here.

Persistence & Privilege

always is false and the skill does not request any persistent presence or system-level changes. Autonomous invocation is allowed by default but is not combined with other privilege escalations here.

Assessment

This skill appears coherent and low-friction, but its claims are high-level and not verifiable from an instruction-only manifest. Before trusting it: (1) do not paste any secrets or private keys into the audit input; treat pasted content as potentially transmitted. (2) Confirm how your agent/platform enforces the 'read-only' and 'no-execution' guarantees (e.g., network access policies, sandboxing). (3) If you need stronger assurance, ask the publisher for source code or a reproducible local script you can run offline, and prefer auditing public repos by manually downloading and reviewing files rather than pasting sensitive material into third-party tools.

ClawSentinel v2.3

The sharpest skill auditor in the ClawHavoc era. Scans any skill markdown or GitHub repo for malicious patterns before you install it. Never executes code. Trained on public DataClaw dataset.

Security Guarantees

• 100% local read-only analysis
• Only fetches raw.githubusercontent.com when you explicitly audit a public GitHub repo
• Zero telemetry in base version

How to use

• "audit this skill:" + paste markdown
• "audit github https://github.com/user/repo"

Output Format

Always clean JSON.

Pro Tip

Run ClawSentinel on every skill before installing. ClawHub is infested right now.