Skill-Scanner-Pro

Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data...

This package appears to be a straightforward local static scanner and UI for auditing Clawdbot/MCP skills. Before installing or running it: 1) Verify the source — confirm the GitHub repository and registry owner match and review the full repo for unexpected network calls or shell execution (the README points to a GitHub repo whose owner differs from the registry owner). 2) Run the scanner on copies of skill folders in an isolated environment (container or VM), not as root, particularly when scanning untrusted skills. 3) Expect false positives (patterns like '.env' or credential path mentions will be flagged) — review findings manually. 4) If you use the Streamlit UI, install streamlit in a controlled environment; the UI writes uploaded files to a temporary directory. 5) If you need higher assurance, review the full, untruncated source for any hidden network access or subprocess execution before trusting it with sensitive directories.

Type: OpenClaw Skill Name: skill-scanner-pro Version: 0.1.4 This skill is a security audit tool designed to scan other OpenClaw skills for malicious patterns, including data exfiltration, system modification, crypto-mining, and arbitrary code execution. The code (`skill_scanner.py`) implements a comprehensive set of regex patterns to detect these threats in target files. Crucially, it includes logic (`_is_definition_noise`) to prevent it from flagging its own pattern definitions as malicious, demonstrating clear benign intent. The `SKILL.md` and `README.md` provide accurate descriptions and usage instructions without any prompt injection attempts. The `streamlit_ui.py` frontend handles user input safely by writing it to temporary files before scanning, without executing user-provided code. All components align with the stated purpose of a security scanner and exhibit no malicious behavior themselves.