Skill Analyzer Now Available on ClawHub with One-Command Install
The OpenClaw Skill Analyzer, a security scanner for AI skills, is now available on ClawHub with a simplified installation process. Previously only on GitHub, users can now install it with a single command.
Installation and Features
To install the Skill Analyzer from ClawHub, run:
npx clawhub@latest install openclaw-skill-analyzerThe tool scans any skill folder for potentially malicious patterns including prompt injection, credential theft, data exfiltration, backdoors, and obfuscation. It provides a risk rating before installation and includes over 40 detection rules across 12 categories.
Security Features
A key security feature is Docker sandbox support. Scans can be run inside a Docker container with:
- No network access
- Read-only filesystem
- 256MB memory cap
- Container destroyed after each scan
This isolates potentially malicious skills from your system. The README includes a one-liner Docker command for this sandboxed execution.
Development Status
The tool is actively maintained with updates when new malicious patterns are discovered in the wild. The developer welcomes reports of patterns the tool doesn't yet catch.
Note: ClawHub may show a warning when installing the Skill Analyzer because the scanner flags its own detection patterns.
📖 Read the full source: r/openclaw
👀 See Also
Coldkey: Post-Quantum Age Key Generation and Paper Backup Tool
Coldkey generates post-quantum age keys (ML-KEM-768 + X25519) and produces single-page printable HTML backups with QR codes for offline storage.
Windows Notepad App Remote Code Execution Vulnerability CVE-2026-20841
CVE-2026-20841 is a remote code execution vulnerability in the Windows Notepad app. Details and mitigation steps are available in the Microsoft Security Response Center update guide.
Mass NPM & PyPI Supply Chain Attack Hits TanStack, Mistral AI, and 170+ Packages
A coordinated attack compromised 170+ npm packages and 2 PyPI packages, targeting TanStack (42 packages), Mistral AI SDKs, UiPath, OpenSearch, and Guardrails AI. Malicious versions execute a dropper that exfiltrates credentials and probes cloud metadata.
ClawSecure: Security Platform for OpenClaw Ecosystem
ClawSecure is a security platform built specifically for the OpenClaw ecosystem, featuring a 3-layer audit protocol, continuous monitoring, and coverage of OWASP ASI categories. It has audited 3,000+ popular skills and is available free with no signup.