ClawScan CLI
ClawScan runs several security scanners on agent skills and hands their results to a judge for a combined verdict.
- 153 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- With the LLM mode enabled the scanned skill content goes to an external model provider.
- The judge runs an external agent command with broad permissions inside a Docker sandbox.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/clawscanDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- With the LLM mode enabled the scanned skill content goes to an external model provider.
- The judge runs an external agent command with broad permissions inside a Docker sandbox.
This is third-party code. Review the repository files before installing.
What it does
ClawScan, a Go CLI, combines security scanners for agent skills and plugins: NVIDIA SkillSpector, Cisco Skill Scanner, Tencent AI-Infra-Guard and others. The `clawscan --scanner skillspector --scanner cisco` command checks a `skills/` folder and writes a JSON report per scanner. Results can go to a judge, an external agent that reads scanner evidence and gives a verdict. The built-in `clawhub` profile repeats the setup ClawHub uses in production. Skill security benchmarks can run as well.
Who it is for. Authors and curators of skill catalogs who check third-party skills before installing or publishing.
Good fit when
- A curator checks a submitted skill with several scanners at once rather than one.
- An author runs a skill before publishing and gets a JSON verdict for CI.
- A researcher compares scanners on benchmarks through `clawscan benchmark`.
- A team sets up its own profile of scanners and a judge for its security policy.
Not a fit when
- Docker is unavailable, while scanners run in its runtime by default.
- A verdict is wanted without a model call, while judge mode calls an external agent.
- The target is an ordinary program with no agent skill or plugin.
Example request
Scan the skill in `skills/csv-summarizer` with the skillspector and cisco scanners and save a JSON report.Limitations
Scanner and judge commands run inside ClawScan's Docker runtime by default, so local checks need a running Docker. Some scanners use an LLM mode when provider variables such as `LLM_API_KEY` or `OPENAI_API_KEY` are set, and then the scanned skill content goes to that provider. The judge runs an external agent command, and `danger-full-access` mode applies inside the Docker sandbox. Source builds need Go 1.27.1 or newer. macOS binaries target macOS 13 and later. An automated check result does not guarantee a skill is safe.
How to disable. Remove the package with `npm uninstall -g @openclaw/clawscan` and stop related Docker containers.
FAQ
Which scanners are supported?
The README lists `aig`, `aig-mcp`, `cisco`, `relyable` and `skillspector`. Each has a repository and a launch method.
What is a profile?
A saved combination of scanners and a judge, run with the `--profile` flag. The built-in `clawhub` repeats the ClawHub configuration.
How do I hand results to a judge?
With the `--judge` flag and an external agent command such as `codex exec`. The judge gets scanner evidence and writes a verdict.
How do I scan my own skill?
Go to its folder and run `clawscan --scanner skillspector --scanner cisco`. Without a path ClawScan scans child folders of `./skills`.
Which benchmarks exist?
`clawscan benchmark list` prints them, and `clawscan benchmark <id>` runs the chosen one on the configured scanners.
Discussion
No questions or reviews yet.
Related
CLI toolsA security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
An OpenClaw skill that audits the agent itself: 230 checks, change watching and an A to F grade.
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
A security scanner for AI agent skills: static analysis, LLM review and runs of suspicious skills in a Docker sandbox.
A Claude Code skill scanner checks the whole folder, not just SKILL.md, and installs a skill only after your decision.
The SkillHawk static scanner finds dangerous instructions in SKILL.md, MCP configs and AGENTS.md and runs as a GitHub Action
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| ClawScan (this card) | no | 153 | |
| SkillSpector | no | 25,545 | a single NVIDIA scanner; ClawScan runs it alongside others and merges results |
| Skill Scanner | no | 2,724 | the Cisco skill scanner; ClawScan adds a judge, profiles and benchmarks |
README in short
The README starts with installation and running two scanners, then walks through a deliberately malicious skill. Tables of commands, scanners and profiles follow, plus a judge description.