SkillGuard — Skill Security Scanner
Scan OpenClaw skills for security threats before they compromise your system.
Quick Start
Scan all installed skills
python3 {scripts}/scanner.py
Scan a single skill
python3 {scripts}/scanner.py --skill <skill-name>
Check a skill name for typosquatting
python3 {scripts}/scanner.py --check-name <name>
Scan from ClawHub before installing
python3 {scripts}/scanner.py --fetch-clawhub <skill-name>
What It Detects
Critical Threats
- Reverse shells —
nc -e, bash -i >& /dev/tcp, ncat, mkfifo
- Code obfuscation —
base64 -d | bash, eval(), exec() with encoded payloads
High Threats
- Suspicious URLs —
webhook.site, glot.io, ngrok.io, pastebin.com
- Memory poisoning — Instructions to write to
SOUL.md, MEMORY.md, AGENTS.md
- Malicious prerequisites — Download instructions in docs (the ClawHavoc attack vector)
Medium Threats
- Credential access — Patterns accessing
.env, API keys, tokens, SSH keys
- Data exfiltration — Outbound HTTP POST/PUT with sensitive data
- Hardcoded IPs — Public IPs embedded in code
- Typosquatting — Skill names similar to popular/known skills (Levenshtein ≤ 2)
- Crypto wallet access — Seed phrases, private keys, wallet patterns
Low Threats
- Shell execution —
subprocess, os.system, child_process (common but worth noting)
Interpreting Results
Risk Levels
- 🔴 CRITICAL (≥50) — Do NOT install. Likely malicious.
- 🟠 HIGH (25-49) — Review manually before installing. Multiple suspicious patterns.
- 🟡 MEDIUM (10-24) — Some flags, likely false positives but worth checking.
- 🟢 LOW (1-9) — Minor flags, generally safe.
- ✅ CLEAN (0) — No issues detected.
False Positive Likelihood
Each finding includes a FP estimate (low/medium/high):
- low — Likely a real threat
- medium — Could be legitimate, review context
- high — Probably benign (e.g., security tool referencing attack patterns, search tool using fetch)
Workflow: Before Installing a Skill
- Run
python3 {scripts}/scanner.py --fetch-clawhub <skill-name> (requires clawhub CLI)
- Review the report — anything CRITICAL or HIGH with low FP = reject
- If CLEAN or LOW only → safe to install
- If MEDIUM → skim the flagged files manually
Output
- Console summary with emoji risk levels
- JSON report saved to
{baseDir}/../data/scan_results.json (configurable via --json-out)
Context: Why This Matters
As of February 2026, 341 malicious skills were found on ClawHub (Koi Security / ClawHavoc campaign), distributing Atomic Stealer malware via fake prerequisites. OpenClaw has 512 known vulnerabilities (Kaspersky audit). There is no official skill vetting process. SkillGuard fills this gap.
See references/threat-landscape.md for detailed background.
1---2name: skillguard3description: Security scanner for OpenClaw/ClawHub skills. Detects malware, reverse shells, credential theft, prompt injection, memory poisoning, typosquatting, and suspicious prerequisites before installation. Use when installing new skills, auditing existing skills, checking a skill name for typosquatting, or scanning ClawHub skills for security risks.4---56# SkillGuard — Skill Security Scanner78Scan OpenClaw skills for security threats before they compromise your system.910## Quick Start1112### Scan all installed skills13```bash14python3 {scripts}/scanner.py15```1617### Scan a single skill18```bash19python3 {scripts}/scanner.py --skill <skill-name>20```2122### Check a skill name for typosquatting23```bash24python3 {scripts}/scanner.py --check-name <name>25```2627### Scan from ClawHub before installing28```bash29python3 {scripts}/scanner.py --fetch-clawhub <skill-name>30```3132## What It Detects3334### Critical Threats35- **Reverse shells** — `nc -e`, `bash -i >& /dev/tcp`, `ncat`, `mkfifo`36- **Code obfuscation** — `base64 -d | bash`, `eval()`, `exec()` with encoded payloads3738### High Threats39- **Suspicious URLs** — `webhook.site`, `glot.io`, `ngrok.io`, `pastebin.com`40- **Memory poisoning** — Instructions to write to `SOUL.md`, `MEMORY.md`, `AGENTS.md`41- **Malicious prerequisites** — Download instructions in docs (the ClawHavoc attack vector)4243### Medium Threats44- **Credential access** — Patterns accessing `.env`, API keys, tokens, SSH keys45- **Data exfiltration** — Outbound HTTP POST/PUT with sensitive data46- **Hardcoded IPs** — Public IPs embedded in code47- **Typosquatting** — Skill names similar to popular/known skills (Levenshtein ≤ 2)48- **Crypto wallet access** — Seed phrases, private keys, wallet patterns4950### Low Threats51- **Shell execution** — `subprocess`, `os.system`, `child_process` (common but worth noting)5253## Interpreting Results5455### Risk Levels56- **🔴 CRITICAL (≥50)** — Do NOT install. Likely malicious.57- **🟠 HIGH (25-49)** — Review manually before installing. Multiple suspicious patterns.58- **🟡 MEDIUM (10-24)** — Some flags, likely false positives but worth checking.59- **🟢 LOW (1-9)** — Minor flags, generally safe.60- **✅ CLEAN (0)** — No issues detected.6162### False Positive Likelihood63Each finding includes a FP estimate (low/medium/high):64- **low** — Likely a real threat65- **medium** — Could be legitimate, review context66- **high** — Probably benign (e.g., security tool referencing attack patterns, search tool using fetch)6768## Workflow: Before Installing a Skill69701. Run `python3 {scripts}/scanner.py --fetch-clawhub <skill-name>` (requires `clawhub` CLI)712. Review the report — anything CRITICAL or HIGH with low FP = reject723. If CLEAN or LOW only → safe to install734. If MEDIUM → skim the flagged files manually7475## Output7677- Console summary with emoji risk levels78- JSON report saved to `{baseDir}/../data/scan_results.json` (configurable via `--json-out`)7980## Context: Why This Matters8182As of February 2026, 341 malicious skills were found on ClawHub (Koi Security / ClawHavoc campaign), distributing Atomic Stealer malware via fake prerequisites. OpenClaw has 512 known vulnerabilities (Kaspersky audit). There is no official skill vetting process. SkillGuard fills this gap.8384See `references/threat-landscape.md` for detailed background.
javimosch