Pincer

Security-first wrapper for installing agent skills. Scans for malware, prompt injection, and suspicious patterns before installation. Use instead of `clawhub install` for safer skill management.

This skill is designed to add a safety layer around 'clawhub install' and its code matches that purpose. Before installing, note: (1) pincer requires clawhub, uvx (mcp-scan), jq and commonly 'file' at runtime — the registry metadata only listed 'pincer', so install those dependencies first; (2) pincer stores config/history in ~/.config/pincer and installs a pincer binary under ~/.local/bin (it will suggest adding that dir to PATH); (3) pincer runs uvx mcp-scan which may contact the uvx/Invariant tooling or download mcp-scan components — if you need fully offline scanning, verify uvx behavior first; (4) pincer reduces risk but cannot make installing arbitrary skills risk-free: it fetches skill files via clawhub and will call through to normal installs when you approve, so you should still review high-risk findings and trust lists. If you want extra assurance, inspect scripts/pincer.sh locally and test pincer in a controlled environment before using it as your default installer.

Type: OpenClaw Skill Name: pincer Version: 1.0.1 The 'pincer' skill is a security-first wrapper for installing OpenClaw agent skills, designed to scan for malware, prompt injection, and suspicious patterns. Its `SKILL.md` contains standard installation instructions to symlink a shell script to `~/.local/bin`, which is a benign operation. The core logic in `scripts/pincer.sh` implements various security checks, including pattern detection (e.g., base64, `curl|sh`, persistence mechanisms), external URL analysis, and integration with `uvx mcp-scan`. All file system and network operations (e.g., `clawhub inspect`, `uvx mcp-scan`) are directly aligned with its stated security purpose. There is no evidence of intentional harmful behavior, data exfiltration, persistence, or prompt injection against the agent within the skill itself; rather, it actively seeks to prevent these in other skills.