Security gate for OpenClaw AgentSkills. Scans folder/ClawHub skills with cisco-ai-defense/skill-scanner before installation. Supports manual scans, staged in...
Security Analysis
medium confidenceThe skill is a coherent wrapper around a third‑party 'skill-scanner' tool to scan and quarantine OpenClaw skills; it behaves as described but executes third‑party tooling (npx/uv/clawhub) and will move user skill directories when it finds High/Critical issues, so trust in the scanner and downloaded packages is required.
The name/description match the actual behavior: scripts clone/run a skill-scanner, scan user/builtin skills, and quarantine High/Critical findings. The declared runtime tooling in SKILL.md (uv, npx, git, systemctl) aligns with what the scripts call. One minor inconsistency: the registry metadata lists no required env vars, while SKILL.md references OPENCLAW_STATE_DIR and OPENCLAW_WORKSPACE_DIR (the scripts use these with sane defaults).
The scripts stay within the stated scope (scan directories, write reports, move failing skill dirs into a quarantine path). They do not read or transmit secrets or access unrelated system config. Important: they run third‑party tooling (uv run skill-scanner, npx clawhub) which executes code from the scanner repo / npm packages — this is expected for a scanner but increases the trust surface. The quarantine logic is careful to only move directories under the user's skills dir.
No formal install spec (instruction-only) — scripts instruct cloning the scanner repo from GitHub and using 'uv' and 'npx'. That means remote code (GitHub repo and npm packages) will be fetched and executed by the user. The scripts themselves do not download arbitrary binaries or use obscure URLs; they rely on widely used hosts (github.com, npm via npx).
The skill does not request credentials or secrets and only needs workspace/state paths (OPENCLAW_STATE_DIR, OPENCLAW_WORKSPACE_DIR). Those are proportional to its purpose. The registry metadata not listing them is a minor metadata omission but not a dangerous behavior. No unrelated environment variables or config paths are accessed.
always:false and normal autonomous invocation settings. The skill does not attempt to modify other skills' configuration or system-wide settings beyond recommending/using systemd --user units; the systemd unit templates are optional and run as the user. The quarantine move is limited to ~/.openclaw/skills/* and is performed only on High/Critical findings.
Guidance
This skill does what it says: it runs a scanner and can auto‑quarantine skills with High/Critical findings. Before enabling it, consider: 1) it executes third‑party code (the scanner from the GitHub repo and npm packages via npx/uv), so you must trust those upstream projects; 2) it will move (quarantine) user skill directories when High/Critical findings occur — back up your ~/.openclaw/skills if you want a safety copy; 3) it expects 'uv' and 'npx' (and optionally systemd --user) to be available — install and test those first; 4) review the scanner's code/behavior (cisco-ai-defense/skill-scanner and any npm packages used) if you need a higher assurance level. If you are uncomfortable with automated moves, run the scripts manually in a staging environment first.
Latest Release
v1.0.2
Added env declarations and confirmed references directory inclusion.
Popular Skills
Published by @jason-allen-oneal on ClawHub
