Security Checker

Security scanner for Python skills before publishing to ClawHub. Use before publishing any skill to check for dangerous imports, hardcoded secrets, unsafe file operations, and dangerous functions like eval/exec/subprocess. Essential for maintaining trust and ensuring published skills are safe for others to install and run.

What to consider before installing: - This tool is a local, static scanner (no network exfiltration or credential requests). It reads files you point it at and prints findings. - False positives are expected (e.g., legitimate uses of os, requests, or filesystem writes). Warnings require manual review and documentation as noted in SKILL.md. - The scanner itself is simple and readable; you can audit scripts/security_scan.py quickly to confirm behavior. - Because it flags hardcoded secrets, avoid running it in contexts where printing detected secrets to logs would leak sensitive data to others (the script avoids printing the secret contents but shows file/line info). - Complement this tool with manual review and other tools (bandit, safety) and run scans in an isolated environment when processing untrusted code.

Type: OpenClaw Skill Name: security-checker Version: 1.0.1 The OpenClaw skill 'security-checker' is a static analysis tool for Python code. The `SKILL.md` clearly describes its purpose to identify dangerous imports, functions, hardcoded secrets, and unsafe file operations, without containing any prompt injection attempts or instructions for malicious agent behavior. The `scripts/security_scan.py` script implements this functionality by reading Python files and using regular expressions to detect patterns. It strictly performs static analysis, does not execute any dangerous commands, make network calls, modify files, or attempt to exfiltrate data. Its file access is limited to reading the specified target files/directories, which is necessary for its stated purpose.