Skill Scan

**Quick judgment** Skill Scan is a strong, specialized security scanner for OpenClaw skills. It’s well-suited as a default gate before installing any third-party skill, especially in security-conscious or production environments. **Strengths & value** - Multi-layered detection (rules + AST + prompt-injection checks + optional LLM analysis) covers a wide range of realistic threats. - ClawHub integration and clear exit codes make it easy to wire into install workflows and CI pipelines. - Usability is high: clear commands, risk bands, and recommended AGENTS.md templates for automatic or manual use. **Risks / limitations** - Detection is heuristic and rule-based; it can miss novel or highly obfuscated threats, and may sometimes flag false positives (especially around network/file access that may be legitimate). - LLM-based deep analysis depends on external model APIs (latency, cost, availability, and potential for over- or under-estimating risk). - It helps reduce risk but does not guarantee safety; high-stakes use cases still require human review and broader security practices. **Recommended scenarios** - Treat as **mandatory** for scanning any untrusted ClawHub or third-party skill before installation. - Integrate into AGENTS.md with the **Automatic Pre-Install Scanning** option when possible, so installs are blocked on HIGH/CRITICAL findings by default. - Use batch scans periodically on existing skill directories in production agents, or as a CI gate for teams publishing or updating skills.