skill-scanner

✓Verified·Scanned 2/18/2026

This skill provides a static security scanner (scripts/scan.py, scripts/advanced_checks.py) for auditing OpenBot/Clawdbot skills. It instructs running python3 scripts/scan.py /path/to/skill and will read local files (including .env), so it performs local command execution and file access.

from clawhub.ai·v092efa0·72.0 KB·0 installs
Scanned from 2.1.0 at 092efa0 · Transparency log ↗
$ vett add clawhub.ai/hugosbl/skill-scanner

Skill Security Scanner

Scan skills for malicious patterns before installation. Detects credential exfiltration, suspicious network calls, obfuscated code, prompt injection, and other red flags.

Quick Start

# Scan a local skill folder
python3 scripts/scan.py /path/to/skill

# Verbose output (show matched lines)
python3 scripts/scan.py /path/to/skill --verbose

# JSON output (for automation)
python3 scripts/scan.py /path/to/skill --json

Workflow: Scan Before Install

  1. Download or locate the skill folder
  2. Run python3 scripts/scan.py <skill-path> --verbose
  3. Review findings by severity (CRITICAL/HIGH = do not install)
  4. Report results to user with recommendation

Score Interpretation

ScoreMeaningRecommendation
CLEANNo issues foundSafe to install
INFOMinor notes onlySafe to install
REVIEWMedium-severity findingsReview manually before installing
SUSPICIOUSHigh-severity findingsDo NOT install without thorough manual review
DANGEROUSCritical findings detectedDo NOT install — likely malicious

Exit Codes

  • 0 = CLEAN/INFO
  • 1 = REVIEW
  • 2 = SUSPICIOUS
  • 3 = DANGEROUS

Rules Reference

See references/rules.md for full list of detection rules, severity levels, and whitelisted domains.

Limitations

  • Pattern-based detection — cannot catch all obfuscation techniques
  • No runtime analysis — only static scanning
  • False positives possible for legitimate tools that access network/files
  • Always combine with manual review for HIGH/MEDIUM findings