_____         _        ____
|_   _|__  _ _| | __   / ___|  ___ __ _ _ __
  | |/ _ \| '_| |/ /   \___ \ / __/ _` | '_ \
  | | (_) | | |   <     ___) | (_| (_| | | | |
  |_|\___/|_| |_|\_\   |____/ \___\__,_|_| |_|

@torknetwork/scan

Free, open-source security scanner for ClawHub skills. Detect malicious patterns in AI agent tools before they compromise your system. No Tork account required.

Like npm audit for AI agent skills.

Installation

# Global install
npm install -g @torknetwork/scan

# Or run directly with npx
npx @torknetwork/scan <path-to-skill>

Usage

# Scan a specific skill directory
tork-scan ./my-skill

# Audit all installed skills
tork-scan --audit

# Machine-readable JSON output
tork-scan ./my-skill --json

# CI/CD mode — exit code only (0=safe, 1=dangerous)
tork-scan ./my-skill --quiet

Exit Codes

| Code | Meaning | |------|---------| | 0 | Score >= 50 (safe/caution/risky) | | 1 | Score < 50 (dangerous) | | 2 | Error (path not found, etc.) |

What It Checks

Critical (-30 points each)

| ID | Pattern | Description | |----|---------|-------------| | C1 | Shell execution | execSync, exec, spawn — arbitrary command execution | | C2 | Dynamic code execution | eval() — runtime code execution | | C3 | child_process import | Importing child_process module | | C4 | Reverse shell | bash -i, /dev/tcp, nc -e, Python socket patterns | | C5 | C2/exfiltration domains | webhook.site, requestbin, pipedream, ngrok, burpcollaborator | | C6 | Obfuscated payload | Large Base64-encoded strings (>100 chars) |

High (-20 points each)

| ID | Pattern | Description | |----|---------|-------------| | H1 | Sensitive file access | Reads .env, .ssh, credentials files | | H2 | Credential harvesting | Reads API_KEY, SECRET, TOKEN from env | | H3 | Hardcoded IP requests | HTTP requests to IP addresses (bypasses DNS) | | H4 | Suspicious TLDs | URLs with .tk, .ml, .ga, .cf domains | | H5 | Direct IP connections | Raw socket connections to IP addresses |

Medium (-10 points each)

| ID | Pattern | Description | |----|---------|-------------| | M1 | Overly broad permissions | full_disk_access, shell.execute, network.unrestricted | | M2 | No README.md | Missing documentation | | M3 | Hidden files | Dot-prefixed files/dirs (excluding .gitignore, etc.) | | M4 | File-sharing downloads | mega.nz, mediafire, dropbox direct links | | M5 | Obfuscated code | Single lines > 500 chars with < 5% spaces |

Low (-5 points each)

| ID | Pattern | Description | |----|---------|-------------| | L1 | No LICENSE | Missing license file | | L2 | Excessive dependencies | node_modules directory present | | L3 | No metadata | Missing package.json or skill.json |

Score Brackets

| Score | Bracket | Meaning | |-------|---------|---------| | 90-100 | SAFE | No significant issues found | | 70-89 | CAUTION | Minor issues, review recommended | | 50-69 | RISKY | Multiple concerns, manual review required | | 0-49 | DANGEROUS | Critical issues found, do not install |

CI/CD Integration

# GitHub Actions example
- name: Scan skills for security issues
  run: npx @torknetwork/scan ./skills --quiet

# Shell script
if tork-scan ./my-skill --quiet; then
  echo "Skill is safe to install"
else
  echo "DANGEROUS: Do not install this skill"
  exit 1
fi

Programmatic Usage

import { scan } from '@torknetwork/scan';

const result = scan('./my-skill');
console.log(result.score);     // 85
console.log(result.bracket);   // 'CAUTION'
console.log(result.findings);  // [{ id: 'M2', ... }]

Built by Tork Network

Tork provides independent AI agent governance — like SSL certificates for AI. This scanner is free and open-source. No account required.

For real-time governance, trust badges, and compliance receipts, visit tork.network.

License

MIT - see LICENSE