← Back to Skills Marketplace
178316
Downloads
38
Stars
18
Active Installs
2
Versions
Install in OpenClaw
/install skillscan
Description
Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On...
Usage Guidance
Install only if you trust the publisher and skillscan.tokauth.com with the contents of skills you scan. Avoid scanning private skills that may contain secrets, proprietary prompts, or internal code unless that upload is acceptable. Treat it as an advisory scanner unless your environment separately enforces its exit codes, and review or disable the self-update path where possible.
Capability Assessment
Purpose & Capability
The stated purpose of scanning skills is coherent with the Python scanner, cloud cache lookup, upload, polling, and risk reporting. The concern is that the skill presents itself as a mandatory no-exceptions gate, while installed high-risk skills are only offered for deletion and real blocking depends on external callers honoring exit codes.
Instruction Scope
Activation instructions are broad enough to cover installs, loads, safety questions, pasted SKILL.md content, and unknown skill mentions. That scope can cause a network-backed scan flow to run in more situations than a user may expect.
Install Mechanism
The package installs a runnable Python script and documents daily automatic update checks. The code can download an update manifest and overwrite files in its own skill directory with only manifest-provided hash checking, not an embedded signature or clear approval step.
Credentials
The scanner enumerates many local agent skill directories, zips skill contents for upload on cache misses, contacts skillscan.tokauth.com, and sends a persistent X-Client-Info header. Cloud scanning is purpose-aligned, but the data exposure and host fingerprinting are broad and under-disclosed.
Persistence & Privilege
The scanner writes hidden state files for first-run completion, update checks, and client identity, and it can delete flagged skills only after user confirmation. The persistent client identity and self-update behavior are the main privilege and persistence concerns.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skillscan - After installation, invoke the skill by name or use
/skillscan - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.6
- Major cleanup: The readme documentation was removed.
- Simplified "First Load" process in SKILL.md by removing the requirement to write Skill Security rules to SOUL.md.
- Uninstall instructions regarding SOUL.md cleanup were dropped from the SKILL.md.
- Updated metadata version to 1.1.6.
v1.0.0
SkillScan v1.1.5 introduces a strict security gate for all skill installations and updates.
- Every new skill must pass a security scan before being used. HIGH/CRITICAL risk skills are blocked with no exceptions.
- Scan triggers on any install, load, add, evaluation, or safety-related request.
- On first use, writes a Skill Security rule to SOUL.md and scans all existing skills.
- Removes the Skill Security section from SOUL.md on uninstall.
- Provides command-line and API options for scanning, with clear exit codes and user instructions.
- Supports auto-update and can use a custom update source via environment variable.
Metadata
Frequently Asked Questions
What is SkillScan?
Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On... It is an AI Agent Skill for Claude Code / OpenClaw, with 178316 downloads so far.
How do I install SkillScan?
Run "/install skillscan" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is SkillScan free?
Yes, SkillScan is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does SkillScan support?
SkillScan is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created SkillScan?
It is built and maintained by tokauthai (@tokauthai); the current version is v1.1.6.
More Skills