ClawHub

ClawShield Lite – AI Skill Security Scanner

v1.0.0

Scans AI skills for potential security risks and unsafe commands

⭐ 0· 122·0 current·0 all-time
by@thenox21

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for thenox21/clawshield-lite.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "ClawShield Lite – AI Skill Security Scanner" (thenox21/clawshield-lite) from ClawHub.
Skill page: https://clawhub.ai/thenox21/clawshield-lite
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install clawshield-lite

ClawHub CLI

Package manager switcher

npx clawhub@latest install clawshield-lite
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (static security scanner) matches the included files (main.py, rules.json, README, SKILL.md). No unrelated credentials, binaries, or install steps are requested.
✓
Instruction Scope
SKILL.md and main.py instruct the agent to read code from stdin and scan it against rules.json. The runtime only reads rules.json from the same package and does not reference other system paths, environment variables, or external endpoints.
✓
Install Mechanism
There is no install spec and the tool uses only the Python standard library. No downloads, extract steps, or third‑party packages are required.
✓
Credentials
The skill requests no environment variables, credentials, or config paths. All required inputs are provided via stdin and the local rules.json file.
✓
Persistence & Privilege
Flags show the skill is not forced-always and does not modify agent/system configuration. It runs on-demand and does not persist credentials or change other skills.
Assessment
This skill appears coherent and low-risk: it statically scans text from stdin against local patterns. Before installing, consider that pattern-based scanners have limitations — they can produce false positives and false negatives (they may miss obfuscated or novel malicious code). Review and, if needed, expand rules.json to cover patterns important to you. Because the skill's source and homepage are unknown, prefer running it in a sandbox or CI job first, manually inspect rules.json and main.py yourself, and do not rely solely on this tool for security decisions; combine it with AST-based analysis and manual review for higher assurance.

Like a lobster shell, security has layers — review code before you run it.

#security #ai #scanner #safety #analysisvk970dq95pm1m7qrrrh0zdwa6k983me1zlatestvk970dq95pm1m7qrrrh0zdwa6k983me1z
122downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0
@thenox21
#security #ai #scanner #safety #analysislatest
Download

ClawShield Lite

A lightweight security analysis skill that scans AI skill code for risky patterns and outputs a structured risk report.

How It Works

  1. Accepts code input via stdin (string or file content)
  2. Loads pattern definitions from rules.json
  3. Scans the input for dangerous and suspicious patterns
  4. Assigns a risk level: SAFE, MEDIUM RISK, or HIGH RISK
  5. Outputs a JSON report with all findings

Usage

echo "import os; os.system('rm -rf /')" | python main.py

Comments

Loading comments...