@elvatis_com/clawhub-scanner

Scan your installed ClawHub skills for malware, credential theft, prompt injection, and security risks.

Why?

ClawHub skills run with full agent permissions. In February 2026 alone, security researchers found:

• 534 skills with critical vulnerabilities (Snyk)
• 341 skills distributing the AMOS stealer ("ClawHavoc" campaign)
• 76 confirmed malicious payloads for credential theft and data exfiltration

This scanner checks your installed skills against known malicious patterns, C2 infrastructure, and suspicious behaviors.

Install

npm install -g @elvatis_com/clawhub-scanner

Usage

# Scan all installed skills
clawhub-scanner scan

# Scan a specific skill directory (two equivalent options)
clawhub-scanner scan --skill ~/.openclaw/skills/some-skill
clawhub-scanner scan --scan-path ~/.openclaw/skills/some-skill

# JSON output for automation
clawhub-scanner scan --json

# Write report to a file (human-readable text)
clawhub-scanner scan --output report.txt

# Write JSON report to a file
clawhub-scanner scan --json --output report.json

# Include low-severity findings
clawhub-scanner scan --verbose

# Show scanned directories
clawhub-scanner paths

# Update threat intelligence feeds
clawhub-scanner update

# Update from a custom URL
clawhub-scanner update --source https://your-org.com/feeds/threat-feed.json

# Update from a local file
clawhub-scanner update --source /path/to/local-feed.json

Options

| Flag | Alias | Description | |------|-------|-------------| | --skill <path> | -s | Scan a specific skill directory | | --scan-path <path> | | Alias for --skill | | --json | -j | Output results as JSON | | --verbose | -v | Include low/info severity findings | | --quiet | -q | Suppress output when no issues found | | --output <file> | -o | Write report to file (text or JSON based on --json flag) | | --allowlist <path> | -a | Path to allowlist JSON file |

update command options

| Flag | Description | |------|-------------| | --source <url-or-path> | URL or local file path for the feed (default: GitHub raw) | | --cache <path> | Override cache file location (default: ~/.config/clawhub-scanner/threat-feed.json) | | --timeout <ms> | HTTP request timeout in milliseconds (default: 15000) |

Threat Intelligence Feed Format

The update command fetches a JSON file and merges it with built-in indicators. The feed is cached locally at ~/.config/clawhub-scanner/threat-feed.json.

{
  "version": "1.0",
  "c2IpPatterns": ["91\\.92\\.242\\.31", "185\\.215\\.113\\.\\d+"],
  "c2Domains": ["new-evil\\.com", "malware\\.io"],
  "maliciousHashes": ["sha256hexhash..."],
  "maliciousPackages": ["evil-npm-package"]
}

All fields are optional. The scanner merges these with its built-in indicators at scan time, so existing detections are never removed by an update. Pass --offline to clawhub-scanner scan to skip loading the cached feed.

What It Detects

| Category | Severity | Examples | |----------|----------|---------| | C2 Infrastructure | Critical | Known malicious IPs (91.92.242.30), ClawHavoc domains | | Code Execution | High | eval(), child_process.exec(), process.binding() | | Credential Theft | High | SSH key access, AWS creds, browser profiles, crypto wallets | | Data Exfiltration | High | Discord/Telegram webhooks, raw IP fetches, DNS tunneling | | Obfuscation | High/Med | Base64+exec combos, large encoded strings, CharCode assembly | | Prompt Injection | Medium | "Ignore previous instructions", system prompt overrides | | Network Activity | Low | Outbound HTTP to unknown domains, WebSocket connections |

Programmatic API

The scanner can be used as a library in your own tools, CI pipelines, or IDE plugins:

import { runScan, scanSkill } from '@elvatis_com/clawhub-scanner';
import type { ScanResult, SkillReport } from '@elvatis_com/clawhub-scanner';

// Scan all installed skills
const result: ScanResult = await runScan();
console.log(`Found ${result.critical} critical issues`);

// Scan a specific skill directory
const report: SkillReport = await scanSkill('/path/to/my-skill');
console.log(`Score: ${report.score}/100`);

// Scan with a custom allowlist
import { loadAllowlist } from '@elvatis_com/clawhub-scanner';
const allowlist = loadAllowlist(['/path/to/allowlist.json']);
const result2 = await runScan({ allowlist });

// Scan custom paths
const result3 = await runScan({ skillPaths: ['./skills/skill-a', './skills/skill-b'] });

Available exports:

• runScan(options?) — scan one or more skill directories, returns ScanResult
• scanSkill(path, options?) — scan a single skill directory, returns SkillReport
• getDefaultSkillPaths() — returns the default skill directories
• hashFile(path) — SHA-256 hash a file (returns null on error)
• loadAllowlist(paths) — load and merge allowlist files
• resolveAllowlistPaths(skillPath?) — resolve default allowlist locations
• applyAllowlist(findings, allowlist) — filter findings through an allowlist
• isSuppressed(finding, allowlist) — check if a single finding is suppressed
• formatJson(result) — serialize a ScanResult to JSON string
• printReport(result) — print a human-readable report to stdout
• All types: ScanResult, SkillReport, Finding, Severity, Allowlist, AllowlistEntry, DetectionRule

Exit Codes

| Code | Meaning | |------|---------| | 0 | Clean (or only low/medium findings) | | 1 | High-severity findings detected | | 2 | Critical findings detected |

Use in CI/scripts: clawhub-scanner scan --quiet || echo "Security issues found!"

Allowlist (False-Positive Suppression)

If a rule triggers on code you've reviewed and trust, you can suppress it with an allowlist file.

Create a .clawhub-allowlist.json in the skill directory, or a global config at ~/.config/clawhub-scanner/allowlist.json:

[
  { "rule": "EXEC-EVAL", "reason": "eval used for intentional templating" },
  { "rule": "NET-OUTBOUND", "file": "lib/api-client.js" },
  { "rule": "CRED-ENV-HARVEST", "file": "src/**/*.ts", "reason": "reads config from env" }
]

Each entry has:

• rule (required) - the rule ID to suppress (e.g. EXEC-EVAL), or * for all rules
• file (optional) - glob pattern to limit suppression to specific files
• reason (optional) - why this is a false positive

You can also pass a custom allowlist file via CLI:

clawhub-scanner scan --allowlist ./my-allowlist.json

Suppressed findings are counted and shown in the report output.

Scan Locations

By default, scans:

• ~/.openclaw/skills/ (user-installed skills)
• OpenClaw built-in skills directory

License

MIT - Elvatis