OpenClaw Skill Scanner

Scans ClawHub skills for malicious patterns like payloads, reverse shells, data leaks, and crypto miners before and after installation.

Security Scan

This package is a local skill-scanner and safe-install wrapper whose requested files and behavior match its stated purpose (scanning skills and optionally copying them into the user's skills directory).

Purpose & Capability

Name/description (skill scanner) align with the provided files: scanner.py implements regex-based detection and install-hook.sh wraps a pre-install scan + safe installation. There are no unrelated required binaries or external credentials requested.

Instruction Scope

SKILL.md and install-hook.sh instruct the agent to download a skill (via the openclaw CLI), scan the downloaded files with scanner.py, then copy the skill into ~/.openclaw/workspace/skills based on the risk score. The script reads only the local whitelist.json and the downloaded skill files; it does not attempt to read unrelated system config or environment variables beyond $HOME. Behavior stays within the scanner/install scope.

Install Mechanism

No install spec (instruction-only with helper scripts). All code is shipped with the skill; there are no external archive downloads in the skill itself. The only network action is delegated to the user's openclaw CLI (used to fetch skills), which is expected for a pre-install scanner.

Credentials

The skill requires no environment variables, no credentials, and only references local paths (its own directory and the user's ~/.openclaw workspace). This is proportionate to its purpose. It does rely on the presence of python3 and the openclaw CLI to fetch remote skills (both are reasonable requirements).

Persistence & Privilege

The installer copies scanned skills into ~/.openclaw/workspace/skills — appropriate for an install hook but worth noting because it will modify the user's skill directory. always:false (no forced global inclusion) and the skill does not try to modify other skills' config. Blacklist entries in whitelist.json are enforced locally and cannot be overridden by --force.

Assessment

This package is a local scanner + safe-install wrapper and appears coherent with that purpose. Before installing or using it: 1) Review whitelist.json (it contains local whitelist/blacklist decisions and will block blacklisted slugs). 2) Ensure you trust the openclaw CLI used to download skills (install-hook.sh delegates downloading to that tool). 3) Understand the scanner is regex-based and can produce false positives (it will flag common patterns like subprocess/os.system, long base64 strings, and network calls). 4) Because install-hook.sh copies files into ~/.openclaw/workspace/skills, run it in a sandbox or inspect scan reports before allowing suspicious installs. 5) If you need higher assurance, audit the remainder of scanner.py for any outbound network calls (none were found in the provided fragments) and run scans on known-good samples to calibrate false positive rates.

Skill Scanner

Name: skill-scanner Version: 1.0.0 Author: vrtlly.us Category: Security

Description

Scans ClawHub skills for malicious patterns before and after installation. Detects base64 payloads, reverse shells, data exfiltration, crypto miners, obfuscated URLs, and more.

Usage

Scan all installed skills

python3 scanner.py

Scan a specific skill

python3 scanner.py --skill <skill-name>

Scan a specific file

python3 scanner.py --file <path-to-file>

Pre-install scan (download → scan → report → cleanup)

python3 scanner.py --pre-install <clawhub-slug>

JSON output

python3 scanner.py --json
python3 scanner.py --skill <name> --json

Safe install hook

bash install-hook.sh <clawhub-slug>
bash install-hook.sh <clawhub-slug> --force

Detection Patterns

Category	What it catches
Base64 payloads	Long base64 strings near exec/bash/eval
Pipe to shell	curl ... | bash, wget ... | sh
Raw IP connections	http://1.2.3.4 style URLs
Dangerous functions	eval(), exec(), os.system(), subprocess(shell=True)
Hidden files	Dotfile creation in unexpected places
Env exfiltration	Reading .env, API keys sent outbound
Obfuscated URLs	rentry.co, pastebin, hastebin redirectors
Fake dependencies	References to non-existent packages
Data exfil endpoints	webhook.site, requestbin, etc.
Crypto mining	xmrig, stratum, mining pool references
Password archives	Password-protected zip/tar downloads

Risk Scores

• 0-29 (Green): Clean — no suspicious patterns found
• 30-69 (Yellow): Suspicious — review warnings before use
• 70-100 (Red): Dangerous — likely malicious, do not install

Files

• scanner.py — Main scanner engine
• install-hook.sh — Safe installation wrapper
• whitelist.json — Known-good and known-bad skill lists
• report-template.md — Markdown report template