Skill Sentinel - Skill Security Scanner

Published on ClawHub as skill-sentinel.

Protect your OpenClaw environment from malicious Skills.

The Problem

ClawHub is open for anyone to upload Skills. This creates a supply chain attack surface:

• Malicious scripts disguised as helpful tools
• Social engineering tricks ("please copy and run this command")
• Hidden network callbacks
• Obfuscated code

The Solution

Skill Sentinel scans Skills before installation:

1. Static Analysis - Examine SKILL.md and scripts without execution
2. Pattern Detection - Match against known attack signatures
3. Risk Scoring - Clear Safe/Caution/Avoid ratings
4. Evidence - Specific line numbers and explanations

Risk Categories

Level	Description	Action
🟢 Safe	No suspicious patterns found	Install freely
🟡 Caution	Some risky patterns detected	Review before install
🔴 Avoid	High-risk patterns detected	Do not install

Integration

# CLI usage
npx clawshield scan ./my-skill

# GitHub Action
- uses: bubustudio/clawshield-action@v1

Roadmap

• Core scanner engine
• CLI tool
• GitHub Action
• IDE extension
• Real-time ClawHub integration