Updated 1d ago
by openclaw
clawscan
Composable security scanning harness for agent skills
151 GitHub stars (151)
+9 in 30 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | +2 |
| Oct 3 | 0 |
| Oct 4 | +2 |
| Oct 5 | +1 |
| Oct 6 | 0 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | +1 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | +1 |
| Oct 14 | +1 |
| Oct 15 | 0 |
| Oct 16 | 0 |
| Oct 17 | −1 |
| Oct 18 | 0 |
| Oct 19 | 0 |
| Oct 20 | +1 |
| Oct 21 | 0 |
| Oct 22 | 0 |
| Oct 23 | +1 |
| Oct 24 | 0 |
| Oct 25 | +1 |
| Oct 26 | 0 |
| Oct 27 | 0 |
| Oct 28 | 0 |
| Oct 29 | +1 |
| Oct 30 | +1 |
| Oct 31 | +1 |
| Nov 1 | 0 |
| Nov 2 | 0 |
| Nov 3 | 0 |
| Nov 4 | +1 |
| Nov 5 | 0 |
- 7 skills (7 skills found in its SKILL.md files)
- 28 forks (28 forks)
- 1d ago last update (Last updated 1d ago)
Install
Skills CLI
npx skills add openclaw/clawscan
Asks which skills and agents to install. Just one: npx skills add openclaw/clawscan --skill clawscan-cli — add -g for every project.
Claude Code
git clone https://github.com/openclaw/clawscancp -r "clawscan/skills/clawscan-cli" ~/.claude/skills/
Copies the clawscan-cli skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add openclaw/clawscan
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
clawscan-cli
Use when running or explaining the ClawScan CLI, including one-off agent-skill scans, benchmark runs, scanner fixtures, judge harness commands, env var validation, and interpreting clawscan-run-v1 and clawscan-benchmark-v1 artifacts.
skills/clawscan-cli/ on GitHub (opens in a new tab)SKILL.md -
report-clawhub-malicious-skill
Use when a researcher, maintainer, or contributor found or suspects a malicious skill on ClawHub and needs a private reporting workflow: opening a GitHub private vulnerability report, preparing a proposal-only PR, creating `proposals/<GHSA-ID>/clawscan.yml`, running ClawScan against the malicious skill, and explaining what evidence belongs in private versus public channels.
skills/report-clawhub-malicious-skill/ on GitHub (opens in a new tab)SKILL.md -
review-clawhub-profile-proposal
Use when an OpenClaw maintainer or owner is reviewing a ClawHub malicious-skill profile proposal PR: checking `proposals/<GHSA-ID>/clawscan.yml`, reading the private vulnerability context without leaking it, running the SkillTrustBench Profile Gate or equivalent local benchmark, updating the accepted baseline, and promoting an accepted candidate into `internal/profiles/clawhub/clawscan.yml`.
skills/review-clawhub-profile-proposal/ on GitHub (opens in a new tab)SKILL.md -
autoreview
Structured code review through the shared OpenClaw agent-skills installation.
.agents/skills/ on GitHub (opens in a new tab)autoreview/ SKILL.md -
benign
No description in the SKILL.md.
internal/runner/ on GitHub (opens in a new tab)testdata/ partial-judge/ benign/ SKILL.md -
malicious
No description in the SKILL.md.
internal/runner/ on GitHub (opens in a new tab)testdata/ partial-judge/ malicious/ SKILL.md -
suspicious
No description in the SKILL.md.
internal/runner/ on GitHub (opens in a new tab)testdata/ partial-judge/ suspicious/ SKILL.md
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.