Skill Safety Scanner#

Scans every installed skill in your OpenClaw workspace for dangerous code patterns. Produces a per-skill SAFE / WARN / DANGEROUS rating with exact evidence and removal commands.

Why this exists: ~20% of ClawHub skills have been flagged for malicious patterns including credential harvesting, shell injection, and C2 callbacks. This skill surfaces those issues before they can cause damage — using OpenClaw's own built-in scanner, not a third party.

Privacy guarantee: Runs entirely on your machine. Zero network calls. Zero data exfiltration. You can read every line of this skill — it is a single SKILL.md file.

---

How it works#

This skill uses openclaw security audit --deep --json which already scans all installed skills for dangerous patterns. It then parses, formats, and explains the findings per-skill.

No new scanning code. No dependencies. Just OpenClaw's own trusted scanner with better output.

---

Workflow#

1. Run the scanner#

bash

openclaw security audit --deep --json

Capture the full JSON output.

2. Extract skill findings#

From the JSON, find all entries where id starts with skills. — these are skill-specific findings.

Key finding IDs to look for:

Finding IDMeaningskills.code_safetyDangerous patterns detected in skill codeskills.untrusted_execSkill executes shell commandsskills.env_harvestingSkill reads env vars AND makes network callsskills.network_exfilSkill sends data to external hostsskills.permission_escalationSkill requests elevated permissions

3. Rate each skill#

For each installed skill, assign a rating:

RatingCriteria✅ SAFENo dangerous patterns found⚠️ WARNShell exec OR env access (not combined) — review source🔴 DANGEROUSEnv harvesting + network send combined, or known malicious signature

4. Format the report#

text

SKILL SAFETY SCAN — YYYY-MM-DD HH:MM
Scanned: X skills   Safe: X   Warn: X   Dangerous: X

──────────────────────────────────────
🔴 DANGEROUS — [skill-name]
   Path: ~/.openclaw/workspace/skills/[skill-name]
   Issue: [env-harvesting] Reads API keys and sends to external host
   Evidence: [filename]:[line] — [code snippet]
   Action: clawhub uninstall [skill-name]
           rm -rf ~/.openclaw/workspace/skills/[skill-name]

⚠️  WARN — [skill-name]
   Path: ~/.openclaw/workspace/skills/[skill-name]
   Issue: [dangerous-exec] Executes shell commands via child_process
   Evidence: [filename]:[line]
   Action: Review source before use. Remove if not needed:
           clawhub uninstall [skill-name]

✅ SAFE — [skill-name]   (no findings)
──────────────────────────────────────

RECOMMENDATION
[If any DANGEROUS skills]: Remove immediately — treat as compromised.
[If any WARN skills]: Review source at the path above before next use.
[If all SAFE]: Your skill set is clean. Re-scan after any new install.

5. Optional: Auto-remove dangerous skills#

If the user confirms, execute removal for DANGEROUS-rated skills:

bash

# For each DANGEROUS skill named [skill-name]:
clawhub uninstall [skill-name] 2>/dev/null
rm -rf ~/.openclaw/workspace/skills/[skill-name]

Always show the command and ask for confirmation before removing anything.

6. Re-scan to confirm#

After any removals:

bash

openclaw security audit --deep

Confirm the skills.code_safety finding is gone.

---

Scheduling#

To scan automatically after every new skill install, or on a daily schedule:

bash

openclaw cron add --name "skill-safety-scanner:daily" --cron "0 3 * * *" \
  --prompt "Run the skill-safety-scanner skill and report findings to memory."

---

What this skill does NOT do#

• Does not send any data to external servers
• Does not modify any files without explicit confirmation
• Does not connect to the internet
• Does not access credentials or API keys
• Does not install anything
• Single SKILL.md file — inspect the full source above

---

Notes#

• Run this scan after every new ClawHub skill install
• WARN ratings are not always malicious — many legitimate skills use shell exec (e.g., tools that run git or npm). Review the source and make your own judgment.
• DANGEROUS = env harvesting + network send in the same file. This combination has no legitimate use case in a passive skill.
• If OpenClaw updates its scanner signatures, re-run this skill to catch newly detected patterns.