Skill Safety Scanner

Scan your installed ClawHub skills for dangerous code patterns — credential harvesting, shell injection, unauthorized network calls, and known malicious sign...

This instruction-only skill is largely consistent with its stated purpose (running the local OpenClaw scanner and formatting results), but check a few things before using it: - Confirm the CLIs: make sure `openclaw` and `clawhub` are the correct, expected local tools on your system. The SKILL.md mixes both names; verify `clawhub uninstall` will remove skills safely. - Run the scanner manually first: run `openclaw security audit --deep --json` yourself and inspect the raw JSON before using any automation from this skill. - Be careful with scheduling and memory: avoid using the example prompt that reports findings 'to memory' unless you know where memory is stored and that it never leaves your machine. Prefer local-only storage (files) for scan reports. - Review deletion commands before running: the provided `rm -rf` is destructive. Only use auto-remove after manually verifying evidence. - Understand data access: the skill will read every installed skill's source (including any secrets embedded there). That is necessary for auditing but means scan outputs may contain sensitive values — handle reports accordingly. If you want higher assurance: run the OpenClaw audit manually, inspect the SKILL.md content yourself (it is provided), and avoid enabling scheduled/automatic reporting to agent memory or remote services.

Type: OpenClaw Skill Name: skill-safety-scanner Version: 1.0.0 The skill is a security utility designed to audit other installed skills using the native 'openclaw security audit' command. It identifies dangerous patterns like credential harvesting or shell injection and provides a structured report and uninstallation options (SKILL.md). There is no evidence of data exfiltration, obfuscation, or malicious intent; all actions are local and aligned with the stated purpose of enhancing workspace security.