Skill Defender
v1.0.0Scans installed OpenClaw skills for malicious patterns including prompt injection, credential theft, data exfiltration, obfuscated payloads, and backdoors. Use when installing new skills, after skill updates, or for periodic security scans. Runs deterministic pattern matching — fast, offline, no API cost.
⭐ 5· 2k·6 current·6 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (malicious-pattern scanner) align with the included artifacts: SKILL.md, a threat-patterns reference, and two Python scanner scripts. No unrelated env vars, binaries, or install steps are requested. The scripts' behavior (walking skill dirs, regex-based detections, aggregating results) is coherent with a scanner.
Instruction Scope
SKILL.md instructs scanning single skills or all installed skills and documents auto-detection of the skills directory (searching ~/.clawd/skills, ~/skills, ~/.openclaw/skills and walking up from the script). It also documents allowlisting and output handling. The SKILL.md contains explicit prompt-injection examples (e.g., "ignore previous instructions", "you are now") which triggered pre-scan flags — this is expected because the scanner documents the patterns it detects. The scanner will read skill files (required for its purpose); verify you are comfortable with a local tool reading installed skill files (these files can contain secrets).
Install Mechanism
Instruction-only with bundled Python scripts; no install spec, no downloads, no external packages required (scripts state standard library only). No evidence of downloading/executing remote payloads in the provided code.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. The code includes regexes that look for credential paths in scanned skills (expected) but the scanner itself does not request or require secrets.
Persistence & Privilege
No always:true, no automatic modification of agent configuration is described. The tool scans files and produces reports; it includes an allowlist stored in the script (normal). There is no code shown that writes to core agent files or modifies other skills' configurations.
Scan Findings in Context
[ignore-previous-instructions] expected: SKILL.md and references intentionally include 'ignore previous instructions' as an example pattern the scanner detects; pre-scan detection of this phrase is expected and appropriate.
[you-are-now] expected: SKILL.md documents 'you are now' as a prompt-injection pattern; detection of this phrase in the docs is expected and consistent with the skill's purpose.
Assessment
This skill appears internally consistent: it's an offline, deterministic pattern scanner implemented in Python that reads skill directories and reports findings. Before installing or running it, consider these points: (1) Source provenance — the skill's owner and homepage are unknown; prefer code from a trusted publisher or review the code yourself. (2) Local file access — the scanner will read all files in your skills directory (which is necessary for scanning). If your skills contain sensitive secrets, consider auditing those files separately or run the scanner in a controlled environment. (3) Allowlist/false positives — the tool includes a built-in allowlist that can suppress findings; review that allowlist to ensure it isn’t silencing legitimate issues. (4) No network I/O is visible in the provided code, but always review the full scripts before running. If you cannot inspect the code, run it in a sandboxed environment or a VM and verify behavior (stdout, exit codes) on a non-production copy of your skills directory.Like a lobster shell, security has layers — review code before you run it.
latestvk970fbfyrjsh3m7w294w3dc5h980c93y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.