🛡️ ClawDefend

Scan OpenClaw skills for security threats — right from your terminal.

Install

npm install -g clawdefend

Or use directly with npx:

npx clawdefend scan <github-url>

Usage

clawdefend scan https://github.com/openclaw/skills/tree/main/skills/author/skill-name

Example Output

🛡️  ClawDefend Security Scanner
   https://github.com/openclaw/skills/tree/main/skills/fortytwode/meta-video-ad-deconstructor

✔ Scan complete

╔══════════════════════════════════════════╗
║  SCAN COMPLETE — Risk Score: 25/100      ║
╚══════════════════════════════════════════╝

Summary: Low-risk skill with standard file access patterns.

Findings (2):

  [MEDIUM] Broad file system access
           SKILL.md:14
           Skill requests read access to user files.

  [LOW] External API call
        src/index.js:42
        Makes HTTP requests to third-party service.

Full report: https://clawdefend.com/scan/abc123

Commands

| Command | Description | |---------|-------------| | clawdefend scan <url> | Scan a GitHub skill URL | | clawdefend --help | Show help | | clawdefend --version | Show version |

How It Works

ClawDefend sends the GitHub URL to the ClawDefend API, which:

1. Clones the repository
2. Analyzes skill files for dangerous patterns
3. Runs static analysis on code
4. Uses LLM-based intent detection to identify malicious behavior

Results are returned with a risk score (0–100) and detailed findings.

License

MIT — Philip Karns