Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them. Use when a user wants to audit a skill, check if a ClawHub skill is safe, scan for credential exfiltration, detect prompt injection, or review skill security. Triggers on security audit, skill safety check, malware scan, or trust verification.
Follow the repository instructions for this skill and your agent. Review the files and dependencies before adding it to your workflow.
SkillHub CLI
skillhub install hugosbl/ai-skill-scannerInspect the source and compatibility requirements, then follow its installation steps.
Give your agent the source link and ask it to inspect instructions and dependencies before explaining the installation steps.
Scan skills for malicious patterns before installation. Detects credential exfiltration, suspicious network calls, obfuscated code, prompt injection, and other red flags.
# Scan a local skill folder
python3 scripts/scan.py /path/to/skill
# Verbose output (show matched lines)
python3 scripts/scan.py /path/to/skill --verbose
# JSON output (for automation)
python3 scripts/scan.py /path/to/skill --json
python3 scripts/scan.py <skill-path> --verbose
| Score | Meaning | Recommendation |
|---|---|---|
| CLEAN | No issues found | Safe to install |
| INFO | Minor notes only | Safe to install |
| REVIEW | Medium-severity findings | Review manually before installing |
| SUSPICIOUS | High-severity findings | Do NOT install without thorough manual review |
| DANGEROUS | Critical findings detected | Do NOT install — likely malicious |
0 = CLEAN/INFO1 = REVIEW2 = SUSPICIOUS3 = DANGEROUSSee references/rules.md for full list of detection rules, severity levels, and whitelisted domains.
These signals come from indexed source analysis and may lag behind changes. Check the current source files.
# Skill Security Scanner Scan skills for malicious patterns before installation. Detects credential exfiltration, suspicious network calls, obfuscated code, prompt injection, and other red flags. ## Quick Start ```bash # Scan a local skill folder python3 scripts/scan.py /path/to/skill # Verbose output (show matched lines) python3 scripts/scan.py /path/to/skill --verbose # JSON output (for automation) python3 scripts/scan.py /path/to/skill --json ``` ## Workflow: Scan Before Install 1. Download or locate the skill folder 2. Run `python3 scripts/scan.py <skill-path> --verbose` 3. Review findings by severity (CRITICAL/HIGH = do not install) 4. Report results to user with recommendation ## Score Interpretation | Score | Meaning | Recommendation | |-------|---------|----------------| | CLEAN | No issues found | Safe to install | | INFO | Minor notes only | Safe to install | | REVIEW | Medium-severity findings | Review manually before installing | | SUSPICIOUS | High-severity findings | Do NOT install without thorough manual review | | DANGEROUS | Critical findings detected | Do NOT install — likely malicious | ## Exit Codes - `0` = CLEAN/INFO - `1` = REVIEW - `2` = SUSPICIOUS - `3` = DANGEROUS ## Rules Reference See `references/rules.md` for full list of detection rules, severity levels, and whitelisted domains. ## Limitations - Pattern-based detection — cannot catch all obfuscation techniques - No runtime analysis — only static scanning - False positives possible for legitimate tools that access network/files - Always combine with manual review for HIGH/MEDIUM findings
Bambu Lab 3D printer control and automation. Activate when user mentions: printer status, 3D printing, slice, analyze model, generate 3D, AMS filament, print monitor, Bambu Lab, or any 3D printing task. Full pi...
Generative Engine Optimization (GEO) for AI search visibility. Optimize content to appear in ChatGPT, Perplexity, Claude, and Google AI Overviews. Use when optimizing websites, pages, or content for LLM discove...
Agents can sign plugins, rotate credentials without losing identity, and publicly attest to behavior.
Send and receive P2P messages using disposable numbers and PINs. No servers, no accounts. Use for human notifications, approval flows, and agent-to-agent communication.