Scan Skill
Deep security analysis of an individual skill before installation Skill: Scan Skill Owner: ItsNishi Summary: Deep security analysis of an individual skill before installation Tags: latest:1.0.0, security:1.0.0 Version history: v1.0.0 | 2026-02-07T23:21:15.290Z | user Initial release of scan-skill: an individual skill security analyzer. - Performs deep security analysis of a skill directory prior to installation. - Checks for injection techniques, hidden commands, and dangerous fiel
Rank
62
Safety
84
Downloads
860
Updated
Apr 15, 2026
Version
1.0.0
Source
CLAWHUB
About
What it does, and when to use it.
Capability contract not published. No trust telemetry is available yet. 860 downloads reported by the source. Last updated 4/15/2026.
Avoid when
- Contract metadata is missing or unavailable for deterministic execution.
Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing
Public facts
Every fact links back to the source it came from.
- Vendor
- Clawhubvendor · observed Apr 15, 2026
- Protocol compatibility
- OpenClawcompatibility · observed Apr 15, 2026
- Adoption signal
- 860 downloadsadoption · observed Apr 15, 2026
- Latest release
- 1.0.0release · observed Feb 7, 2026
- Handshake status
- UNKNOWNsecurity
Install and run
Setup complexity: low.
clawhub skill install kn7c4x4srjpbhtjhec7q71202n80phmw:scan-skill- Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.
- Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.
Contract: missing
curl -s "https://www.xpersona.co/api/v1/agents/clawhub-itsnishi-scan-skill/snapshot"
Documentation
CLAWHUB
2,724 characters of source documentation, loaded on request.
Extracted files
2 files captured from the source.
SKILL.md
--- name: scan-skill description: Deep security analysis of an individual skill before installation disable-model-invocation: true allowed-tools: Read, Glob, Grep, Bash context: fork --- # scan-skill -- Individual Skill Analyzer Perform deep security analysis of a single skill directory before installation. Checks for all known injection techniques from AI agent security research. ## What to do Run the scanner against the target skill directory: ```bash python3 "$SKILL_DIR/scripts/scan_skill.py" "$ARGUMENTS" ``` Where `$ARGUMENTS` is the path to the skill directory to analyze. If no argument is provided, prompt the user for the path to the skill they want to scan. ## What it checks - SKILL.md frontmatter analysis (dangerous field combinations, hidden skills, pre-approved tools) - Hidden HTML comments with imperative instructions - Shell command patterns (remote-code-pipe-to-shell, encoded payloads) - Description persistence triggers (forced repeated execution keywords) - Supporting files analysis (scripts/ directory contents, executable permissions) - Dynamic context injection (preprocessor command execution) - Encoding and obfuscation (base64, hex, zero-width characters) - Instruction override attempts (context manipulation, role impersonation) ## Output Structured report with severity-ranked findings and specific recommendations per finding. Includes frontmatter analysis summary and supporting file inventory. ## When to use - Before installing a skill from a public repository or marketplace - When reviewing a skill contributed by an external party - As part of security review before adding skills to your agent configuration
_meta.json
{
"ownerId": "kn7c4x4srjpbhtjhec7q71202n80phmw",
"slug": "scan-skill",
"version": "1.0.0",
"publishedAt": 1770506475290
}AionUi
Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!
activepieces
AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents
cherry-studio
AI productivity studio with smart chat, autonomous agents, and 300+ assistants.
CopilotKit
The Frontend for Agents & Generative UI. React + Angular
Machine-readable data
The same record, as JSON, for agents and crawlers.
{
"facts": [
{
"factKey": "vendor",
"category": "vendor",
"label": "Vendor",
"value": "Clawhub",
"href": "https://clawhub.ai/ItsNishi/scan-skill",
"sourceUrl": "https://clawhub.ai/ItsNishi/scan-skill",
"sourceType": "profile",
"confidence": "medium",
"observedAt": "2026-04-15T00:45:39.800Z",
"isPublic": true
},
{
"factKey": "protocols",
"category": "compatibility",
"label": "Protocol compatibility",
"value": "OpenClaw",
"href": "https://www.xpersona.co/api/v1/agents/clawhub-itsnishi-scan-skill/contract",
"sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-itsnishi-scan-skill/contract",
"sourceType": "contract",
"confidence": "medium",
"observedAt": "2026-04-15T00:45:39.800Z",
"isPublic": true
},
{
"factKey": "traction",
"category": "adoption",
"label": "Adoption signal",
"value": "860 downloads",
"href": "https://clawhub.ai/ItsNishi/scan-skill",
"sourceUrl": "https://clawhub.ai/ItsNishi/scan-skill",
"sourceType": "profile",
"confidence": "medium",
"observedAt": "2026-04-15T00:45:39.800Z",
"isPublic": true
},
{
"factKey": "latest_release",
"category": "release",
"label": "Latest release",
"value": "1.0.0",
"href": "https://clawhub.ai/ItsNishi/scan-skill",
"sourceUrl": "https://clawhub.ai/ItsNishi/scan-skill",
"sourceType": "release",
"confidence": "medium",
"observedAt": "2026-02-07T23:21:15.290Z",
"isPublic": true
},
{
"factKey": "handshake_status",
"category": "security",
"label": "Handshake status",
"value": "UNKNOWN",
"href": "https://www.xpersona.co/api/v1/agents/clawhub-itsnishi-scan-skill/trust",
"sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-itsnishi-scan-skill/trust",
"sourceType": "trust",
"confidence": "medium",
"observedAt": null,
"isPublic": true
}
],
"events": [
{
"eventType": "release",
"title": "Release 1.0.0",
"description": "Initial release of scan-skill: an individual skill security analyzer. - Performs deep security analysis of a skill directory prior to installation. - Checks for injection techniques, hidden commands, and dangerous field combinations in SKILL.md. - Analyzes scripts, permissions, encoding/obfuscation patterns, and dynamic context usage. - Produces a structured, severity-ranked report with recommendations and a file inventory. - Intended for pre-installation review of public, external, or contributed skills.",
"href": "https://clawhub.ai/ItsNishi/scan-skill",
"sourceUrl": "https://clawhub.ai/ItsNishi/scan-skill",
"sourceType": "release",
"confidence": "medium",
"observedAt": "2026-02-07T23:21:15.290Z",
"isPublic": true
}
]
}Record generated Oct 10, 2026.