# Skill Cleaner

> Automatically verify "suspicious" skills via VirusTotal and add them to the security allowlist via the Bridge.

- Skill: `johnalbertini14-glitch/skill-cleaner` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add johnalbertini14-glitch/skill-cleaner`
- Raw SKILL.md: https://api.skillmd.com/api/skills/johnalbertini14-glitch/skill-cleaner/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: johnalbertini14-glitch (https://skillmd.com/u/johnalbertini14-glitch)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/johnalbertini14-glitch/skill-cleaner

---


# Skill Cleaner

Scans your installed skills for suspicious patterns, verifies them against VirusTotal, and "fixes" false positives by adding them to the safety allowlist.

## Usage

Run the cleaner to automatically verify and allowlist suspicious skills:

```bash
# Dry run (safe, just shows what would happen)
npx tsx ./skills/skill-cleaner/scripts/clean.ts

# Commit trust to safety allowlist for clean files
npx tsx ./skills/skill-cleaner/scripts/clean.ts --commit

# Full Security Fix: Trust clean files AND quarantine malicious ones
npx tsx ./skills/skill-cleaner/scripts/clean.ts --fix
```

## Features

- **Heuristic Scanning**: Uses OpenClaw Core scanner to find suspicious code patterns.
- **VirusTotal Integration**: Cross-references hashes with VT for reputation.
- **Trust Bridge**: Automatically allowlists "false positives" via the Gateway.
- **Quarantine**: Moves malicious files (detects > 0 on VT) to a `.quarantine/` folder for safety.

## Security Disclosure

This skill requires high-privilege access to function as a security utility:

- **Safe Bridge**: Uses a hardened, non-shell Bridge (Gateway RPC) to verify and trust skills. This avoids direct file system mutation for the allowlist.
- **Privacy**: Only loads the `VIRUSTOTAL_API_KEY` from your `.env` file; it does not access or expose unrelated secrets.
- **Verification**: Performs a **Live Scan** of your `skills/` directory using the internal OpenClaw security module to compute hashes.

**Audit Guidance**: If you see "High Privilege" flags on the Hub, this is expected behavior for a tool that interacts with the Security Core. Always run in dry-run mode first to inspect planned changes.