Scan AI agent skills for security vulnerabilities, dangerous code patterns, and undeclared permissions. Three-layer analysis: dependency CVE scanning, static...
Security Analysis
high confidenceThe skill is internally consistent: it is a thin wrapper that sends a repo/code to the external Claw0x scanning API and only requires an API key; the main risk is that it transmits code to a third-party service, which is expected for this purpose.
Name/description state it will scan skills for vulnerabilities and undeclared permissions; the SKILL.md and handler.ts implement exactly that by calling the Claw0x Gateway API. Requested artifacts (repo_url, skill_slug, code) and the single required env var (CLAW0X_API_KEY) match the stated purpose.
Runtime instructions and examples consistently instruct the agent to POST skill data (repo URL or code) to https://api.claw0x.com/v1/call. There are no instructions to read unrelated local files or other environment variables. This is expected, but it does mean user code/metadata will be sent to a third-party service — a privacy-sensitive action that the user should be aware of.
Instruction-only skill with no install spec. The included handler.ts is a small network wrapper (uses fetch) and does not write to disk or download/extract remote archives. Low installation risk.
Only CLAW0X_API_KEY is required (declared in SKILL.md metadata and enforced by handler.ts). That single credential is proportional to a remote service wrapper. Users should still treat the key as sensitive because it authorizes requests that may transmit code to the external API.
always is false and the skill does not request elevated privileges, nor does it modify other skills or global agent config. Model invocation is allowed (the platform default), which is appropriate for a callable scanner.
Guidance
This skill forwards provided repo URLs or code to the Claw0x Gateway (https://api.claw0x.com). That behavior matches its purpose but has privacy implications: do not send secrets, credentials, or private data you cannot share. Before installing, verify you trust Claw0x (review privacy/security docs), use a dedicated/limited API key, rotate the key if leaked, and prefer a local scanner for highly sensitive code. Review the included handler.ts (it only reads CLAW0X_API_KEY and POSTs the input) and consider network controls (allowlist api.claw0x.com) and logging to detect unexpected usage.
Latest Release
v1.0.7
No user-facing changes in this release. - Version bumped to 1.0.7. - No code or documentation changes detected.
More by @kennyzir
Published by @kennyzir on ClawHub
