Scans OpenClaw skills for security vulnerabilities and suspicious patterns before installation
Security Analysis
high confidenceThe skill's code, documentation, and runtime instructions are coherent with a local, pattern-based SKILL.md scanner and do not request unrelated credentials or elevated persistent privileges.
Name/description match the provided artifacts: scanner.js, test.js, examples, and a SKILL.md that documents CLI and programmatic usage. No unrelated environment variables, binaries, or install hooks are requested. The files and examples justify the scanner purpose.
SKILL.md instructs the agent to read skill markdown and optionally run scanner.js locally; it also documents scanning an installed-skills directory (~/.openclaw/skills/). That read access is appropriate for the task, but the scanner searches arbitrary files and will surface anything it finds (including sensitive content embedded in skills). The project uses broad regexes (e.g., backticks, template string, ${...}) which the README already warns will produce false positives.
No install spec is provided (instruction-only skill for OpenClaw) and the included Node.js scripts have no external package downloads. scanner.js is a single-file, zero-dependency Node tool (shebang present). This is low-risk compared to remote downloads or executing fetched archives.
The skill requests no environment variables or credentials. It does require read access to skill files/directories to operate (explicitly documented). That file access is proportionate to its purpose but could expose secrets if those appear in scanned files — the README properly warns users to review flagged items manually.
Flags: always is false and the skill is user-invocable. The scanner declares itself read-only and the code reads files but does not attempt to persist changes or modify other skills/config. No evidence of system-wide config modification or forced persistence.
Guidance
This scanner appears to be what it claims: a local, regex-based SKILL.md scanner. Before running it, review the included scanner.js yourself (it's provided) and run it in a safe environment. Be aware: the tool intentionally uses broad regexes and will produce false positives (the README documents this). When scanning a directory, the scanner will read all files you point it at — do not scan directories that contain secrets you don't want a tool or its logs to access. If you plan to automate scans, consider running the scanner on a dedicated sandbox or CI job and review its whitelist configuration (.security-scanner-config.json). Finally, if you want higher assurance, confirm scanner.js exports and test behavior locally (node test.js) and verify the GitHub repository/commit history and maintainer identity before adopting it as part of an automated install pipeline.
Latest Release
v2.0.0
# Changelog ## [2.0.0] - 2026-02-16 ### Changed - Clarified that this scans skill instruction files (markdown), not executable code - Updated documentation to accurately describe how the scanner works with Claude - Removed unverified statistics about malicious skills - Added prominent false positive warnings and limitations section - Fixed network access claims to be more accurate - Improved usage examples to show correct workflow ### Fixed - Updated contact email to [email protected] - Corrected installation instructions - Removed misleading technical prerequisites ### Added - "How It Works" section explaining the skill's operation - Detailed false positive examples - User responsibility guidelines - Stronger disclaimer about manual review requirements ## [1.0.0] - 2026-02-09 ### Added - Initial release - Pattern-based security scanning - Risk level classification - Command-line interface - Whitelist configuration support ``` --- ## Also Update the Example Output in SKILL.md In the SKILL.md file I gave you, find this line (around line 161): ``` Scanned: 2024-02-09 14:30:22 ``` **Change to:** ``` Scanned: 2026-02-16 14:30:22
Popular Skills
Published by @anikrahman0 on ClawHub
