How do I install the Skulk Skill Scanner skill?

Run npx skillmds@latest add modbender/skulk-skill-scanner in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Skulk Skill Scanner safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Skulk Skill Scanner?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Skulk Skill Scanner free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Skulk Skill Scanner?

modbender (@modbender) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Skulk Skill Scanner by modbender — Agent Skill

Name: Skulk Skill Scanner
Rating: 4.5 (4 reviews)
Author: modbender

Skulk Skill Scanner

Scan OpenClaw skill folders for security red flags before installing or publishing. Detects data exfiltration, credential theft, prompt injection, destructive commands, obfuscation, privilege escalation, and supply chain risks. Use when: evaluating a skill from ClawHub before install, auditing your own skills before publishing, or reviewing any SKILL.md for safety. NOT for: general code review or vulnerability scanning of non-skill codebases.

modbender Updated Sep 9, 2026 12 repo stars

File contents

Skill Scanner

Security scanner for OpenClaw agent skills. Static analysis for red flags.

Usage

node scripts/scanner.js <path-to-skill> [--verbose] [--json] [--summary] [--ignore <path>] [--include-self]

Examples

# Scan a downloaded skill folder before enabling it
clawhub inspect some-skill
node scripts/scanner.js ./skills/some-skill --verbose

# Scan your own skill before publishing
node scripts/scanner.js ./skills/my-skill

# JSON output for automation
node scripts/scanner.js ./skills/my-skill --json

# One-line summary output for heartbeat checks
node scripts/scanner.js ./skills/my-skill --summary

# Include scanner internals (off by default to reduce self-scan noise)
node scripts/scanner.js ./skills/skulk-skill-scanner --include-self

What It Catches

Severity	Flags
🔴 Critical	Data exfiltration, credential access, safety overrides, destructive commands
🟠 High	Obfuscation (base64/eval), unknown network access, env scanning, privilege escalation, hidden instructions
🟡 Medium	Writes outside workspace, package installs (supply chain), messaging on user's behalf, persistent timers/automation
🔵 Info	API key references, broad tool access requests

Scoring

Each unique rule deducts points: critical=30, high=15, medium=5, info=0
Score 75-100: ✅ PASS
Score 50-74: ⚠️ WARN
Score 0-49 or any critical: ❌ FAIL
Exit code 1 on FAIL (CI-friendly)

Safe Domain Allowlist

Known legitimate API domains are allowlisted to reduce false positives on network-related rules. Edit the SAFE_DOMAINS array in scripts/scanner.js to customize.

Limitations

This is static pattern matching — it catches obvious and moderately obfuscated attacks but cannot detect:

Sophisticated multi-step social engineering
Runtime-generated URLs or dynamic exfiltration
Attacks that look identical to legitimate skill behavior

It's a first line of defense, not a guarantee. Always review skills manually before granting sensitive access.

---name: skulk-skill-scannerdescription: Scan OpenClaw skill folders for security red flags before installing or publishing. Detects data exfiltration, credential theft, prompt injection, destructive commands, obfuscation, privilege escalation, and supply chain risks. Use when: evaluating a skill from ClawHub before install, auditing your own skills before publishing, or reviewing any SKILL.md for safety. NOT for: general code review or vulnerability scanning of non-skill codebases.--- # Skill Scanner Security scanner for OpenClaw agent skills. Static analysis for red flags. ## Usage ```bash node scripts/scanner.js <path-to-skill> [--verbose] [--json] [--summary] [--ignore <path>] [--include-self] ``` ## Examples ```bash # Scan a downloaded skill folder before enabling it clawhub inspect some-skill node scripts/scanner.js ./skills/some-skill --verbose # Scan your own skill before publishing node scripts/scanner.js ./skills/my-skill # JSON output for automation node scripts/scanner.js ./skills/my-skill --json # One-line summary output for heartbeat checks node scripts/scanner.js ./skills/my-skill --summary # Include scanner internals (off by default to reduce self-scan noise) node scripts/scanner.js ./skills/skulk-skill-scanner --include-self ``` ## What It Catches | Severity | Flags | |----------|-------| | 🔴 Critical | Data exfiltration, credential access, safety overrides, destructive commands | | 🟠 High | Obfuscation (base64/eval), unknown network access, env scanning, privilege escalation, hidden instructions | | 🟡 Medium | Writes outside workspace, package installs (supply chain), messaging on user's behalf, persistent timers/automation | | 🔵 Info | API key references, broad tool access requests | ## Scoring - Each unique rule deducts points: critical=30, high=15, medium=5, info=0 - Score 75-100: ✅ PASS - Score 50-74: ⚠️ WARN - Score 0-49 or any critical: ❌ FAIL - Exit code 1 on FAIL (CI-friendly) ## Safe Domain Allowlist Known legitimate API domains are allowlisted to reduce false positives on network-related rules. Edit the `SAFE_DOMAINS` array in `scripts/scanner.js` to customize. ## Limitations This is static pattern matching — it catches obvious and moderately obfuscated attacks but cannot detect: - Sophisticated multi-step social engineering - Runtime-generated URLs or dynamic exfiltration - Attacks that look identical to legitimate skill behavior It's a first line of defense, not a guarantee. Always review skills manually before granting sensitive access.

Frequently asked questions