clawsec-scanner

Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis (Semgrep, Bandit), and agent-specific static hook inspection for OpenClaw hooks.

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/clawsec-scanner/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with complete executable commands and a well-validated install workflow, and sequences its destructive operations with real checkpoints. Its main weaknesses are verbosity (explains security basics Claude knows and inlines non-essential sections) and broken/missing bundle references (lib/, hooks/, test/) alongside content that belongs in separate files.

Suggestions

Remove or trim content that explains concepts Claude already knows (shell-injection prevention rationale, generic severity-prioritization rundown) and move roadmap/contributing/license out of the core skill body.

Resolve the broken bundle references — either add the referenced lib/, hooks/clawsec-scanner-hook/, and test/ files, or correct the architecture diagram and Verification/Development sections to reflect what actually ships.

Split the ScanReport/Vulnerability schema and the long manual install script into a separate reference file referenced one level deep from SKILL.md.

Dimension	Reasoning	Score
Conciseness	Largely actionable and technical, but the ~485-line body explains concepts Claude already knows (e.g. 'Subprocess arguments use arrays to prevent shell injection', the Vulnerability Prioritization severity rundown) and inlines roadmap/contributing/license content that could be trimmed. Not a 3 due to this padding; not a 1 because it is not a wall of introductory explanation.	2 / 3
Actionability	Provides fully executable, copy-paste-ready guidance throughout — install commands, a complete checksum/signature-verified install script, runner.sh invocations with flags, env-var exports, and YAML/JS examples for custom rules — matching the 'fully executable code/commands; copy-paste ready' anchor.	3 / 3
Workflow Clarity	The destructive install (Option B) is an explicit sequence with validation checkpoints — signature verify, checksum verify with `exit 1` on mismatch, then 'Checksums verified. Installing' — plus a verification checklist and troubleshooting/error-recovery feedback loops. The primary scan flow is more implicit, but the validation and feedback-loop presence meets the score-3 anchor.	3 / 3
Progressive Disclosure	Sections are well-organized and real scripts references are one level deep, but the architecture diagram and sections reference lib/ (report.mjs, utils.mjs, types.ts), hooks/clawsec-scanner-hook/ (HOOK.md, handler.ts), and test/*.test.mjs that do not exist in the bundle, and large inline blocks (roadmap, contributing, license, full install script, security considerations) could be split out. Fits 'some structure but content that should be separate is inline'; not a 1 because it is sectioned and not deeply nested.	2 / 3
	Total	10 / 12 Passed

Description

60%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific about capabilities and tools, but it omits any 'Use when...' trigger guidance and leans on technical jargon over natural user phrasings. Distinctiveness is decent thanks to the agent-platform/OpenClaw niche but is weakened by overlap with sibling suite skills.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when scanning agent platforms for vulnerable dependencies, CVEs, or insecure hook handlers.'

Add natural trigger terms users would say ('scan for vulnerabilities', 'check dependencies', 'find CVEs') alongside the tool names.

Sharpen distinctiveness by foregrounding the OpenClaw/agent-platform hook focus to separate it from the generic clawsec-suite/feed siblings.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions with named tooling — 'dependency scanning (npm audit, pip-audit)', 'multi-database CVE lookup (OSV, NVD, GitHub Advisory)', 'SAST analysis (Semgrep, Bandit)', 'static hook inspection' — matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly states what the skill does but has no 'Use when...' clause or equivalent explicit trigger guidance, so the 'when' is only implied — the rubric caps completeness at 2 for this omission.	2 / 3
Trigger Term Quality	Contains some natural terms ('vulnerability scanner', 'dependency scanning') but is dominated by jargon (OSV, NVD, GitHub Advisory, Semgrep, Bandit, SAST) and omits common user phrasings like 'check for vulnerabilities' or 'scan my dependencies'. Not a 3 because natural-term coverage is thin; not a 1 because 'vulnerability scanner' is a plausible user phrase.	2 / 3
Distinctiveness Conflict Risk	The agent-platform/OpenClaw niche is fairly specific, but 'vulnerability scanner' framing overlaps with sibling suite skills (clawsec-suite, clawsec-feed, openclaw-audit-watchdog) and lacks explicit triggers to disambiguate, fitting 'somewhat specific but could still overlap'.	2 / 3
	Total	9 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (506 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: prompt-security/clawsec
Path: skills/clawsec-scanner/SKILL.md
Commit: c6194eb

Reviewed: 14 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.