PwnClaw Security Scan

Test your AI agent for security vulnerabilities using PwnClaw. Runs 50+ attacks (prompt injection, jailbreaks, social engineering, MCP poisoning, and more) and provides fix instructions. Use when your agent needs a security check or hardening.

Security Scan

The skill is an instruction-only integration that describes an external security testing service and its usage; its requirements and instructions are consistent with that purpose.

Purpose & Capability

Name/description (agent security scanner) match the SKILL.md. The instructions and endpoints all relate to running external security tests; no unrelated binaries, credentials, or capabilities are requested.

Instruction Scope

Instructions primarily guide a human to use the external PwnClaw service or to run a token-based self-test via the service's API. This is appropriate for a remote scanning service, but the instructions do recommend (a) allowing the service to send attacks to your agent endpoint (automatic mode) and (b) adding generated rules to your system prompt — both of which require careful human review before enabling in production.

Install Mechanism

No install spec or code files are present (instruction-only), so nothing is written to disk and there is no package installation risk.

Credentials

The skill requests no environment variables, credentials, or config paths. That is proportionate for an instruction-only wrapper around an external scanning service.

Persistence & Privilege

The skill is not marked always:true and does not request persistent privileges. It does recommend adding fix rules to the system prompt, but that is an action for the human operator (not an automatic install).

Assessment

This skill is internally consistent, but it relies on an external service. Before using: verify the PwnClaw website and the linked GitHub repo yourself; prefer human-mediated/manual testing or a sandboxed agent endpoint for initial runs; never give the service access to sensitive production endpoints or credentials; review any system-prompt rules generated by the service before applying them permanently; and limit scope/privileges when running tests (use staging agents or explicit test tokens). If you need higher assurance, inspect the public GitHub source or run the service in a controlled environment first.

Test your AI agent against 112 real-world attacks across 14 categories. Get a security score and actionable fix instructions.

What It Tests

• Prompt Injection & Indirect Injection
• Jailbreaks & Refusal Bypass
• Social Engineering & Sycophancy
• Data Exfiltration & Agency Hijacking
• MCP/Tool Poisoning
• Memory Poisoning
• Multi-Agent & Multi-Turn Attacks
• Privilege Escalation & Obfuscation

How To Use

Option 1: Tell Your Human

Ask your human to visit https://www.pwnclaw.com and run a free security scan:

1. Sign up at https://www.pwnclaw.com (free tier available)
2. Start a new test in the dashboard
3. Enter the agent's URL or use manual mode
4. Review results and apply the fix instructions to your system prompt

Option 2: Self-Test (Manual Mode)

If your human starts a test and gives you the test token, you can run it yourself:

1. GET https://www.pwnclaw.com/api/test/{token} → get the next prompt
2. POST https://www.pwnclaw.com/api/test/{token} with { "response": "your answer" } → submit and get next
3. Repeat until status is "completed"
4. Results are in the dashboard

Option 3: Automatic Mode (Recommended)

If your agent has an HTTP endpoint, your human just enters the URL in PwnClaw. PwnClaw sends attacks directly — no scripting needed.

Plans

Plan	Scans	Attacks	Price
Free	3/month	15 per scan	$0
Pro	30/month	50 per scan	€29/mo
Team	Unlimited	50 per scan	€99/mo

After The Test

PwnClaw generates specific security rules based on your vulnerabilities. Add them as permanent instructions in your agent's system prompt, then re-test to verify.

Links

• Website: https://www.pwnclaw.com
• GitHub: https://github.com/Gemini2027/pwnclaw (source code publicly auditable)