skulk-skill-scanner

To scan an OpenClaw skill for security risks, run node scripts/scanner.js <path-to-skill> against the target directory. The static analysis identifies data exfiltration, prompt injection, and privilege escalation threats, providing actionable remediation steps to ensure safe integration.

Static analysis for SKILL.md folders detects multiple security risks including credential access, destructive commands, code obfuscation, and supply-chain threats. The scanner evaluates the entire skill directory and reports findings with severity levels and recommended mitigations for engineers.

You should run a security scanner on automation skills before installation or publication to prevent unsafe code from entering runtimes. Preflight scanning is essential during audits and when reviewing any SKILL.md file for safety to reduce deployment risks.

Yes, you can use this scanner to audit skill directories for prompt injection and data exfiltration. The scope-aware static analysis evaluates files for red flags across the skill folder and provides concrete remediation guidance to enforce safe defaults for engineers.

The skill scanner requires no external dependencies to assess supply-chain risks. It performs static analysis directly on the provided skill directory files to identify potential threats and flag obfuscation or destructive commands without needing additional environment setup.

The best way to remediate privilege escalation risks during skill security audits is to follow the scanner's actionable results. The tool reports findings with specific severity levels and indicates concrete mitigations, emphasizing safe defaults to help engineers securely publish or integrate skills.