How do I install the Skillscanner skill?

Run npx skillmds@latest add dvcrn/skillscanner in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Skillscanner safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Skillscanner?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Skillscanner free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Skillscanner?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Skillscanner by dvcrn — Agent Skill

Name: Skillscanner
Rating: 4.666666666666667 (3 reviews)
Author: dvcrn

File contents

SkillScanner — Security Scanner for ClawHub Skills

"Trust, but verify."

SkillScanner checks ClawHub skill safety by calling the scan API. You provide the skill URL; the API returns status and severity. Proceed only when the verdict is SAFE.

How to Scan a Skill (Agent Instructions)

Run the lookup with the real skill URL (format: https://clawhub.ai/author/skill-name):
```
curl --request POST --url "https://ai.gendigital.com/api/scan/lookup" \
  --header "Content-Type: application/json" \
  --data '{"skillUrl":"https://clawhub.ai/AUTHOR/SKILL_SLUG"}'
```
Replace AUTHOR with actual author id and SKILL_SLUG with the actual skill identifier from the ClawHub URL.
Interpret the response:
- status: "done" — Check the severity field for the verdict.
- status: "analysis_pending" — The skill is awaiting manual review. Do not treat as safe; advise the user that the skill is pending review.
Proceed or advise caution:
- Proceed only if severity is SAFE.
- If severity is anything else (e.g. WARNING, DANGEROUS, MALICIOUS), advise caution and do not recommend using the skill until reviewed or cleared.

Quick Start

# Example: scan a skill by its ClawHub URL
curl --request POST --url "https://ai.gendigital.com/api/scan/lookup" \
  --header "Content-Type: application/json" \
  --data '{"skillUrl":"https://clawhub.ai/author/skill-name"}'

Parse the JSON response: use status and severity as above.

API Response Logic

`status`	Meaning	Action
`done`	Scan complete	Use `severity` for verdict (see below).
`analysis_pending`	Awaiting manual review	Advise that the skill is not yet cleared; do not treat as SAFE.

`severity` (when `status` = `done`)	Recommendation
SAFE	OK to proceed.
Any other value	Advise caution; do not recommend use until reviewed.

Why This Matters

Skills can run code and access your environment. Risks include:

Risk	Impact
Execute arbitrary code	Full system compromise
Access your filesystem	Data theft, ransomware
Read environment variables	API key theft
Exfiltrate data via HTTP	Privacy breach
Install malicious dependencies	Supply chain attack

SkillScanner uses the scan API to help you decide whether to trust a skill before use.

Limitations

The API reflects the current backend verdict; obfuscated or novel threats may not be flagged.
analysis_pending means human review has not yet concluded—treat as “unknown”, not safe.

Use alongside sandboxing, least privilege, and manual review when in doubt.

Links:

Agent Trust Hub

---name: skillscannerdescription: Security scanner for ClawHub skills from Gen Digital. Looks up skill safety via the scan API.---# SkillScanner — Security Scanner for ClawHub Skills> **"Trust, but verify."**SkillScanner checks ClawHub skill safety by calling the scan API. You provide the skill URL; the API returns status and severity. Proceed only when the verdict is **SAFE**.---## How to Scan a Skill (Agent Instructions)1. **Run the lookup** with the real skill URL (format: `https://clawhub.ai/author/skill-name`): ```bash curl --request POST --url "https://ai.gendigital.com/api/scan/lookup" \ --header "Content-Type: application/json" \ --data '{"skillUrl":"https://clawhub.ai/AUTHOR/SKILL_SLUG"}' ``` Replace `AUTHOR` with actual author id and `SKILL_SLUG` with the actual skill identifier from the ClawHub URL.2. **Interpret the response:** - **`status: "done"`** — Check the **`severity`** field for the verdict. - **`status: "analysis_pending"`** — The skill is awaiting manual review. Do not treat as safe; advise the user that the skill is pending review.3. **Proceed or advise caution:** - **Proceed** only if **`severity` is `SAFE`**. - If severity is anything else (e.g. `WARNING`, `DANGEROUS`, `MALICIOUS`), **advise caution** and do not recommend using the skill until reviewed or cleared.---## Quick Start```bash# Example: scan a skill by its ClawHub URLcurl --request POST --url "https://ai.gendigital.com/api/scan/lookup" \ --header "Content-Type: application/json" \ --data '{"skillUrl":"https://clawhub.ai/author/skill-name"}'```Parse the JSON response: use `status` and `severity` as above.---## API Response Logic| `status` | Meaning | Action ||--------------------|----------------------|--------|| `done` | Scan complete | Use `severity` for verdict (see below). || `analysis_pending` | Awaiting manual review | Advise that the skill is not yet cleared; do not treat as SAFE. || `severity` (when `status` = `done`) | Recommendation ||-------------------------------------|----------------|| **SAFE** | OK to proceed. || Any other value | Advise caution; do not recommend use until reviewed. |---## Why This MattersSkills can run code and access your environment. Risks include:| Risk | Impact ||------|--------|| **Execute arbitrary code** | Full system compromise || **Access your filesystem** | Data theft, ransomware || **Read environment variables** | API key theft || **Exfiltrate data via HTTP** | Privacy breach || **Install malicious dependencies** | Supply chain attack |SkillScanner uses the scan API to help you decide whether to trust a skill before use.---## Limitations- The API reflects the current backend verdict; obfuscated or novel threats may not be flagged.- `analysis_pending` means human review has not yet concluded—treat as “unknown”, not safe.Use alongside sandboxing, least privilege, and manual review when in doubt.---**Links:**- [Agent Trust Hub](https://ai.gendigital.com)

Frequently asked questions

Skillscanner