OpenClaw Skill Scanner
v1.0.0Scans ClawHub skills for malicious patterns like payloads, reverse shells, data leaks, and crypto miners before and after installation.
⭐ 1· 1.7k·3 current·3 all-time
by@epwhesq
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (skill scanner) align with the provided files: scanner.py implements regex-based detection and install-hook.sh wraps a pre-install scan + safe installation. There are no unrelated required binaries or external credentials requested.
Instruction Scope
SKILL.md and install-hook.sh instruct the agent to download a skill (via the openclaw CLI), scan the downloaded files with scanner.py, then copy the skill into ~/.openclaw/workspace/skills based on the risk score. The script reads only the local whitelist.json and the downloaded skill files; it does not attempt to read unrelated system config or environment variables beyond $HOME. Behavior stays within the scanner/install scope.
Install Mechanism
No install spec (instruction-only with helper scripts). All code is shipped with the skill; there are no external archive downloads in the skill itself. The only network action is delegated to the user's openclaw CLI (used to fetch skills), which is expected for a pre-install scanner.
Credentials
The skill requires no environment variables, no credentials, and only references local paths (its own directory and the user's ~/.openclaw workspace). This is proportionate to its purpose. It does rely on the presence of python3 and the openclaw CLI to fetch remote skills (both are reasonable requirements).
Persistence & Privilege
The installer copies scanned skills into ~/.openclaw/workspace/skills — appropriate for an install hook but worth noting because it will modify the user's skill directory. always:false (no forced global inclusion) and the skill does not try to modify other skills' config. Blacklist entries in whitelist.json are enforced locally and cannot be overridden by --force.
Assessment
This package is a local scanner + safe-install wrapper and appears coherent with that purpose. Before installing or using it: 1) Review whitelist.json (it contains local whitelist/blacklist decisions and will block blacklisted slugs). 2) Ensure you trust the openclaw CLI used to download skills (install-hook.sh delegates downloading to that tool). 3) Understand the scanner is regex-based and can produce false positives (it will flag common patterns like subprocess/os.system, long base64 strings, and network calls). 4) Because install-hook.sh copies files into ~/.openclaw/workspace/skills, run it in a sandbox or inspect scan reports before allowing suspicious installs. 5) If you need higher assurance, audit the remainder of scanner.py for any outbound network calls (none were found in the provided fragments) and run scans on known-good samples to calibrate false positive rates.Like a lobster shell, security has layers — review code before you run it.
latestvk97cs3z0pztqazhbjp4dg1p0nx80hbz3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.