Updated 4d ago
by openclaw
clawscan
Composable security scanning harness for agent skills
145 GitHub stars (145)
+8 in 16 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | +2 |
| Oct 3 | 0 |
| Oct 4 | +2 |
| Oct 5 | +1 |
| Oct 6 | 0 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | +1 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | +1 |
| Oct 14 | +1 |
| Oct 15 | 0 |
| Oct 16 | 0 |
- 4 skills (4 skills found in its SKILL.md files)
- 27 forks (27 forks)
- 4d ago last update (Last updated 4d ago)
Install
Skills CLI
npx skills add openclaw/clawscan
Asks which skills and agents to install. Just one: npx skills add openclaw/clawscan --skill clawscan-cli — add -g for every project.
Claude Code
git clone https://github.com/openclaw/clawscancp -r "clawscan/skills/clawscan-cli" ~/.claude/skills/
Copies the clawscan-cli skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add openclaw/clawscan
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
clawscan-cli
Use when running or explaining the ClawScan CLI, including one-off agent-skill scans, benchmark runs, scanner fixtures, judge harness commands, env var validation, and interpreting clawscan-run-v1 and clawscan-benchmark-v1 artifacts.
skills/clawscan-cli/SKILL.md on GitHub (opens in a new tab) -
report-clawhub-malicious-skill
Use when a researcher, maintainer, or contributor found or suspects a malicious skill on ClawHub and needs a private reporting workflow: opening a GitHub private vulnerability report, preparing a proposal-only PR, creating `proposals/<GHSA-ID>/clawscan.yml`, running ClawScan against the malicious skill, and explaining what evidence belongs in private versus public channels.
skills/report-clawhub-malicious-skill/SKILL.md on GitHub (opens in a new tab) -
review-clawhub-profile-proposal
Use when an OpenClaw maintainer or owner is reviewing a ClawHub malicious-skill profile proposal PR: checking `proposals/<GHSA-ID>/clawscan.yml`, reading the private vulnerability context without leaking it, running the SkillTrustBench Profile Gate or equivalent local benchmark, updating the accepted baseline, and promoting an accepted candidate into `internal/profiles/clawhub/clawscan.yml`.
skills/review-clawhub-profile-proposal/SKILL.md on GitHub (opens in a new tab) -
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
.agents/skills/autoreview/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.