← Back to Skills Marketplace
7638
Downloads
6
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install clawdex
Description
Security check for ClawHub skills powered by Koi. Query the Clawdex API before installing any skill to verify it's safe.
Usage Guidance
Before installing, be comfortable with sending candidate or installed skill names to Koi’s Clawdex API for verdicts. Treat the verdicts as advisory and keep user approval in the loop for unknown or risky skills.
Capability Analysis
Type: OpenClaw Skill
Name: clawdex
Version: 1.0.2
The OpenClaw AgentSkills skill bundle 'clawdex' is designed to perform security checks on other ClawHub skills. Its primary function involves making `curl` requests to `https://clawdex.koi.security/api/skill/SKILL_NAME` to retrieve a security verdict, which is consistent with its stated purpose. It also uses `ls` to list installed skills in `~/.openclaw/skills/` or `~/.clawdbot/skills/` for auditing. While the `SKILL.md` contains instructions for the AI agent (e.g., to inform the user or seek approval for 'unknown' skills), these are security-positive directives that align with the skill's function and do not constitute malicious prompt injection. There is no evidence of data exfiltration, malicious execution, persistence, or other harmful behaviors.
Capability Assessment
Purpose & Capability
The artifact’s stated purpose is to check ClawHub skills for safety, and its capabilities are limited to querying a Clawdex/Koi verdict API and optionally listing installed skill names for audit.
Instruction Scope
Runtime instructions are security-focused: check a skill before installation, avoid installing malicious results, and ask the user before installing unknown results. No hidden role override, unrelated agent control, or deceptive instruction was found.
Install Mechanism
The reviewed package contains only SKILL.md and metadata; no executable install hooks, scripts, dependencies, or mutation mechanisms were present.
Credentials
The skill may list local installed-skill directories and send skill names to an external API. That data flow is disclosed and proportionate for a security-audit skill, but users should understand it.
Persistence & Privilege
No evidence of persistence, privilege escalation, credential access, destructive actions, background workers, or automatic modification of installed skills was found.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install clawdex - After installation, invoke the skill by name or use
/clawdex - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
- Updated skill name and description to reference "Koi" instead of "Koi Security."
- Changed "About Koi Security" section title to "About Koi" and updated the description, mentioning that Clawdex verdicts are powered by Wings, the agentic AI risk engine.
- Minor rewording throughout documentation for consistency and clarity.
v1.0.1
- No changes detected in this version.
- Version number updated to 1.0.1.
v1.0.0
Initial release of the Clawdex skill.
- Provides a security check for ClawHub skills using the Clawdex API.
- Returns a verdict ("benign", "malicious", or "unknown") to help users decide if a skill is safe to install.
- Guides users on interpreting verdicts and next steps for each case.
- Includes instructions for auditing already-installed skills for potential threats.
- Developed by Koi Security.
Metadata
Frequently Asked Questions
What is Clawdex by Koi?
Security check for ClawHub skills powered by Koi. Query the Clawdex API before installing any skill to verify it's safe. It is an AI Agent Skill for Claude Code / OpenClaw, with 7638 downloads so far.
How do I install Clawdex by Koi?
Run "/install clawdex" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Clawdex by Koi free?
Yes, Clawdex by Koi is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Clawdex by Koi support?
Clawdex by Koi is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Clawdex by Koi?
It is built and maintained by wearekoi (@wearekoi); the current version is v1.0.2.
More Skills