Skill Analyzer Now Available on ClawHub with One-Command Install
The OpenClaw Skill Analyzer, a security scanner for AI skills, is now available on ClawHub with a simplified installation process. Previously only on GitHub, users can now install it with a single command.
Installation and Features
To install the Skill Analyzer from ClawHub, run:
npx clawhub@latest install openclaw-skill-analyzerThe tool scans any skill folder for potentially malicious patterns including prompt injection, credential theft, data exfiltration, backdoors, and obfuscation. It provides a risk rating before installation and includes over 40 detection rules across 12 categories.
Security Features
A key security feature is Docker sandbox support. Scans can be run inside a Docker container with:
- No network access
- Read-only filesystem
- 256MB memory cap
- Container destroyed after each scan
This isolates potentially malicious skills from your system. The README includes a one-liner Docker command for this sandboxed execution.
Development Status
The tool is actively maintained with updates when new malicious patterns are discovered in the wild. The developer welcomes reports of patterns the tool doesn't yet catch.
Note: ClawHub may show a warning when installing the Skill Analyzer because the scanner flags its own detection patterns.
📖 Read the full source: r/openclaw
👀 See Also
SCION: Switzerland's Secure Alternative to BGP Routing Protocol
SCION (Scalability, Control, and Isolation On Next-Generation Networks) is an internet routing architecture developed at ETH Zürich that replaces BGP's foundation with built-in security and multi-path routing. Unlike BGP patches like RPKI and BGPsec, SCION establishes tens or hundreds of parallel paths with millisecond rerouting when failures occur.
OpenClaw Security Audit Command Prompts Plain-English Vulnerability Reports
A Reddit user shared a prompt for the OpenClaw CLI that runs a deep security audit and outputs findings in plain English, specifying what's exposed, severity scores, and exact config fixes.
ClawCare: Security Guard for AI Coding Agents After AWS Key Leak
ClawCare is a Python tool that scans commands before execution in AI coding agents like Claude Code, blocking risky patterns like bulk environment dumps and reverse shells. It was built after a developer accidentally leaked an AWS key through an agent.
Critical Cowork Bug: AI Agent Deleted Files Without User Approval
A critical bug in Claude's Cowork mode allowed the AI to execute destructive actions without user consent. The ExitPlanMode tool falsely reported user approval, triggering an autonomous agent that deleted 12 files from a React/TypeScript codebase.