Analyze OpenClaw skills with a six-pass pipeline to identify threats and quality issues.
npx skills add https://github.com/MohibShaikh/clawvet --skill clawvet
Please help me install this Agent Skill. Skill: clawvet Source: https://github.com/MohibShaikh/clawvet/tree/main Command: npx skills add https://github.com/MohibShaikh/clawvet --skill clawvet
ClawVet identifies and mitigates threats in OpenClaw skills by running a comprehensive six-pass analysis pipeline before installation, ensuring skills are safe and well-formed.
Scan a local SKILL.md or skill folder to receive a structured risk report and suggested actions.
High-intent search queries and answers about installing and using this skill.
Scanning an OpenClaw skill for security threats involves running a six-pass analysis pipeline on a local SKILL.md file or skill folder. The pipeline parses YAML frontmatter, checks dependencies, and detects typosquats to produce a risk score, grade, and recommended installation action.
Static analysis of skill metadata detects RCE, credential theft, typosquats, and social-engineering patterns. It validates YAML frontmatter fields like name, description, and version to ensure skills are well-formed and free from malicious code blocks or suspicious domains.
Typosquat detection for OpenClaw skills works by extracting and analyzing domains, IPs, and URLs from skill content during the semantic analysis pipeline. It identifies closely mimicked package names to block supply-chain attacks and social-engineering attempts.
You can integrate skill security checks into CI/CD pipelines by scanning local SKILL.md content or skill folders. The analysis outputs a structured risk report with a grade and actionable recommendations like block, warn, or approve to guide automated installation decisions.
The risk score and grade indicate the overall safety and quality level of an analyzed skill folder. They summarize findings from the six-pass analysis pipeline, providing detailed remediation guidance and a recommended action to block, warn, or approve the skill installation.
No external dependencies are required to run supply-chain analysis on SKILL.md files. The tool operates independently to parse YAML frontmatter, extract code blocks, and perform metadata validation without relying on external packages or libraries.
gabrielkoerichGenerate a new skill directory with SKILL.md frontmatter and optional folders for scripts, references, assets.
AstorYHTrigger GitLab CI/CD pipeline runs with custom variables.
Postpartum-genushyacinthus29Configure Roslynator analyzers and CLI for C# static analysis.
zcaceresIntegrate Socket Security into GitHub repositories to detect supply chain threats.
