Security Scanner

Security Scanner

Scan AI agent skills for security vulnerabilities across three layers: dependency CVEs, dangerous code patterns, and undeclared permissions. Returns a structured JSON risk report with an overall score (0�?00).

Free to use. This skill costs nothing. Just sign up at claw0x.com, create an API key, and start calling. No credit card, no wallet top-up required.

How It Works �?Under the Hood

This skill runs a three-layer security analysis pipeline. No LLM involved �?pure deterministic scanning logic.

Layer 1: Dependency CVE Scanning

Dependencies are extracted from package.json (npm) or requirements.txt (PyPI) and queried against the OSV.dev batch vulnerability database.

• Fetches dependency manifests from the target repository
• Queries all packages in a single batch request to OSV.dev
• Classifies each vulnerability by severity: critical, high, medium, low
• Score contribution: critical +25, high +15, medium +8, low +3 (capped at 50)

Layer 2: Static Code Analysis

Source files (.ts, .js, .py) are scanned line-by-line against 8 pre-compiled regex rules:

• Score contribution: critical +20, high +12, medium +5, low +2 (capped at 40)

Layer 3: Permission Auditing

The SKILL.md frontmatter allowed-tools field is cross-referenced against actual code behavior detected by the static analyzer.

• Parses declared permissions from SKILL.md YAML frontmatter
• Maps code findings to permission categories (e.g., child_process.exec �?Bash(*))
• Reports any permissions detected in code but not declared in frontmatter
• Score contribution: +5 per undeclared permission (capped at 10)

Risk Score

The three layer scores are summed into a total risk score (0�?00):

Three Input Modes

You can scan a skill using any of these three modes (mutually exclusive �?provide exactly one):

Mode 1: GitHub Repo URL

Provide a public GitHub repository URL. The scanner fetches dependency files, source code, and SKILL.md automatically.

{ "repo_url": "https://github.com/owner/repo" }

Mode 2: Claw0x Skill Slug

Provide a skill slug from the Claw0x platform. The scanner looks up the associated repo URL and proceeds with the standard scan.

{ "skill_slug": "validate-email" }

Mode 3: Direct Code Submission

Submit code directly along with optional dependency and SKILL.md data. No GitHub fetching needed.

{
  "code": "import os\nos.system('rm -rf /')",
  "dependencies": { "requests": "2.28.0" },
  "skill_md": "---\nname: my-skill\nallowed-tools: Bash(curl *)\n---"
}

Prerequisites

This is a free skill. Just get an API key:

1. Sign up at claw0x.com
2. Go to Dashboard �?API Keys �?Create Key
3. Store the key securely using one of these methods:
   • Add CLAW0X_API_KEY to your agent's secure environment variables
   • Use your platform's secret manager (e.g. GitHub Secrets, Vercel env vars, AWS Secrets Manager)
   • Use a .env file that is excluded from version control via .gitignore

Security note: Never embed API keys in prompts, source code, or version-controlled files.

No credit card or wallet balance needed.

When to Use

• Agent pipeline needs to vet a third-party skill before installing
• Developer wants to self-check a skill before publishing to Claw0x
• Platform review pipeline needs automated security assessment
• User asks "is this skill safe?", "scan for vulnerabilities", "check skill security"

Input

Provide exactly one of the three input modes:

Output Fields

Example

Input:

{
  "skill": "security-scanner",
  "input": {
    "code": "const { exec } = require('child_process');\nexec(userInput);",
    "dependencies": { "lodash": "4.17.20" }
  }
}

Output:

{
  "overall_risk": "high",
  "risk_score": 62,
  "input_mode": "direct",
  "repo_url": null,
  "dependency_scan": {
    "packages_scanned": 1,
    "vulnerabilities": [
      {
        "id": "GHSA-jf85-cpcp-j695",
        "summary": "Prototype Pollution in lodash",
        "severity": "high",
        "package_name": "lodash",
        "package_version": "4.17.20"
      }
    ],
    "vulnerability_counts": {
      "critical": 0,
      "high": 1,
      "medium": 0,
      "low": 0
    }
  },
  "code_scan": {
    "findings": [
      {
        "rule_id": "SHELL_INJECT",
        "name": "Shell injection",
        "severity": "critical",
        "file": "input.ts",
        "line": 1,
        "match": "require('child_process')",
        "description": "Shell command execution detected �?risk of injection attacks"
      }
    ],
    "finding_counts": {
      "critical": 1,
      "high": 0,
      "medium": 0,
      "low": 0
    },
    "rules_checked": 8
  },
  "permission_audit": {
    "declared_permissions": [],
    "detected_permissions": ["Bash(*)"],
    "undeclared_risks": ["Bash(*)"]
  },
  "recommendations": [
    "Critical: Shell injection pattern detected �?avoid passing unsanitized input to child_process",
    "High: lodash@4.17.20 has known vulnerabilities �?upgrade to latest version",
    "Undeclared permission: Bash(*) detected in code but not declared in SKILL.md"
  ],
  "scanned_at": "2025-01-15T10:30:00.000Z",
  "scan_duration_ms": 1250
}

Error Codes

• 400 — No valid input provided (need repo_url, skill_slug, or code)
• 401 — Invalid or missing API key
• 404 — Skill slug not found in catalog
• 500 — Scan failed (not billed)

Pricing

Free. Apply for an API key and use it at no cost. No credit card required.