clawsec-scanner

79 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By LeoYeAI/agent-master-skills (GitHub) · coding · 2,186 stars · scanned at commit 8f88f9a

Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis (Semgrep, Bandit), and agent-specific DAST hook execution testing for OpenClaw hooks.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 17 places.

skills/clawsec-scanner/SKILL.md, line 99node --version # v20+
skills/clawsec-scanner/SKILL.md, line 116npx clawhub@latest install clawsec-scanner
skills/clawsec-scanner/SKILL.md, line 122set -euo pipefail

Show 14 more

skills/clawsec-scanner/SKILL.md, line 189SCANNER_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-scanner"
skills/clawsec-scanner/SKILL.md, line 212SCANNER_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-scanner"
skills/clawsec-scanner/SKILL.md, line 228export CLAWSEC_NVD_API_KEY="your-nvd-api-key"
skills/clawsec-scanner/SKILL.md, line 284import { spawn } from 'node:child_process';
skills/clawsec-scanner/SKILL.md, line 345./scripts/runner.sh --check
skills/clawsec-scanner/SKILL.md, line 366for test in test/*.test.mjs; do
skills/clawsec-scanner/SKILL.md, line 381npx eslint . --ext .ts,.tsx,.js,.jsx,.mjs --max-warnings 0
skills/clawsec-scanner/SKILL.md, line 427npx clawhub@latest install clawsec-suite
skills/clawsec-scanner/lib/utils.mjs, line 1import { spawn } from "node:child_process";
skills/clawsec-scanner/scripts/dast_runner.mjs, line 15import { spawn } from "node:child_process";
skills/clawsec-scanner/scripts/setup_scanner_hook.mjs, line 3import { spawnSync } from "node:child_process";
skills/clawsec-scanner/scripts/setup_scanner_hook.mjs, line 17const result = spawnSync(cmd, args, {
skills/clawsec-scanner/test/dast_harness.test.mjs, line 5import { spawn } from "node:child_process";
skills/clawsec-scanner/test/reviewer_regressions.test.mjs, line 14import { spawn } from "node:child_process";

Downloads and installs other software

The author does not mention this.

Found in 8 places.

skills/clawsec-scanner/SKILL.md, line 104pip-audit --version # Install: uv pip install pip-audit
skills/clawsec-scanner/SKILL.md, line 105semgrep --version # Install: pip install semgrep OR brew install semgrep
skills/clawsec-scanner/SKILL.md, line 106bandit --version # Install: uv pip install bandit

Show 5 more

skills/clawsec-scanner/SKILL.md, line 116npx clawhub@latest install clawsec-scanner
skills/clawsec-scanner/SKILL.md, line 320- Install: `uv pip install pip-audit` or `pip install pip-audit`
skills/clawsec-scanner/SKILL.md, line 325- Install: `pip install semgrep` OR `brew install semgrep`
skills/clawsec-scanner/SKILL.md, line 381npx eslint . --ext .ts,.tsx,.js,.jsx,.mjs --max-warnings 0
skills/clawsec-scanner/SKILL.md, line 427npx clawhub@latest install clawsec-suite

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README.

Found in 5 places.

skills/clawsec-scanner/SKILL.md, line 143curl -fsSL "$BASE/$ZIP_NAME" -o "$TEMP_DIR/$ZIP_NAME"
skills/clawsec-scanner/SKILL.md, line 144curl -fsSL "$BASE/checksums.json" -o "$TEMP_DIR/checksums.json"
skills/clawsec-scanner/SKILL.md, line 145curl -fsSL "$BASE/checksums.sig" -o "$TEMP_DIR/checksums.sig"

Show 2 more

skills/clawsec-scanner/scripts/query_cve_databases.mjs, line 30const response = await globalThis.fetch(url, {
skills/clawsec-scanner/scripts/query_cve_databases.mjs, line 77const response = await globalThis.fetch(url, {

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'clawsec-scanner' ] || [ -L ~/.agents/skills/'clawsec-scanner' ]; then echo 'A skill folder named clawsec-scanner already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/LeoYeAI/agent-master-skills' "$d" && git -C "$d" checkout --quiet '8f88f9a0dd5a1075d4f0c7626f9d960844d57575' -- 'skills/clawsec-scanner' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/clawsec-scanner' ~/.agents/skills/'clawsec-scanner' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'clawsec-scanner' ~/.claude/skills/'clawsec-scanner' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for LeoYeAI/agent-master-skills shows the score of its lowest-scoring skill.

SkillTrust badge for LeoYeAI/agent-master-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/LeoYeAI/agent-master-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/LeoYeAI/agent-master-skills/)

Score history

Date	Version	Score
2026-11-08	`8f88f9a`	79
2026-11-07	`8f88f9a`	69