← Back to Skills Marketplace
182801
Downloads
41
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install skillscan
Description
Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On...
Usage Guidance
Install only if you are comfortable with a cloud scanner that may upload complete skill directories and stable device metadata, and with a runtime auto-update path that can replace the scanner's own code. Prefer a version with explicit upload consent, local-only mode, narrow scan paths, no MAC collection, and signed or user-approved updates.
Capability Assessment
Credentials
scanner.py enumerates many agent skill directories, zips almost every file in scanned skill directories, uploads uncached scans to skillscan.tokauth.com, and transmits a persistent client info header that may include a MAC address.
Install Mechanism
The package metadata is simple and local, with no dependency install script, but SKILL.md and scanner.py disagree on version and the runtime includes remote self-update after installation.
Instruction Scope
SKILL.md tells agents to activate on installs, loads, evaluations, safety questions, unknown skill mentions, and first load, which is broader than explicit user-directed scanning.
Persistence & Privilege
The skill writes state files and a persistent client identifier, prompts to delete HIGH/CRITICAL scanned skills, and automatically downloads archives that overwrite files in its own skill directory without user approval or signature verification.
Purpose & Capability
The security-scanner purpose fits the main capability, but the artifacts combine mandatory gate language, cloud submission, deletion prompts, broad local discovery, and remote self-update in a way that materially expands user impact.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skillscan - After installation, invoke the skill by name or use
/skillscan - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.6
- Major cleanup: The readme documentation was removed.
- Simplified "First Load" process in SKILL.md by removing the requirement to write Skill Security rules to SOUL.md.
- Uninstall instructions regarding SOUL.md cleanup were dropped from the SKILL.md.
- Updated metadata version to 1.1.6.
v1.0.0
SkillScan v1.1.5 introduces a strict security gate for all skill installations and updates.
- Every new skill must pass a security scan before being used. HIGH/CRITICAL risk skills are blocked with no exceptions.
- Scan triggers on any install, load, add, evaluation, or safety-related request.
- On first use, writes a Skill Security rule to SOUL.md and scans all existing skills.
- Removes the Skill Security section from SOUL.md on uninstall.
- Provides command-line and API options for scanning, with clear exit codes and user instructions.
- Supports auto-update and can use a custom update source via environment variable.
Metadata
Frequently Asked Questions
What is SkillScan?
Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On... It is an AI Agent Skill for Claude Code / OpenClaw, with 182801 downloads so far.
How do I install SkillScan?
Run "/install skillscan" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is SkillScan free?
Yes, SkillScan is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does SkillScan support?
SkillScan is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created SkillScan?
It is built and maintained by tokauthai (@tokauthai); the current version is v1.1.6.
More Skills