domains / families / security / skill-scanner

skill-scanner

combined

Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data exfiltration, system modification attempts, backdoors, and obfuscation techniques. Scan agent skills for security issues. Use when asked to "scan a skill",

When to use

• You need to evaluate a skill for prompt injection, malicious code, over-broad permissions, or supply-chain risk before adopting it.
• You want a static scan plus manual review workflow for a skill directory.
• The task is to decide whether a skill is safe enough to trust in an agent environment.

When not to use

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Skill page

Conflict

The three copies overlap on the goal of scanning agent skills for security issues, but they are not interchangeable. getsentry/skills and sickn33/agentic-awesome-skills describe a similar multi-phase workflow with a bundled scan_skill.py, but they disagree on how the script is invoked, what the report contains, and which structural attacks to check. LeoYeAI/openclaw-master-skills is a different tool: it targets Clawdbot/MCP skills, uses a different entry point (skill_scanner.py), adds a Streamlit Web UI, and focuses on malware/spyware/crypto-mining rather than the prompt-injection and agent-behavior phases in the other two. Crowning one copy would hide real alternatives and conflicting parameters.