ClawHub Security Scanner

该 Skill 用于安全审计：扫描本地已安装的 ClawHub/OpenClaw 技能目录，按严重等级检测已知 C2 地址与恶意域名、eval 与凭据窃取、数据外传、混淆载荷、提示注入及宽泛文件访问等模式；支持全量扫描、指定技能扫描、JSON 输出与详细模式，并用退出码区分干净、高危和严重发现。

homeofe

热度 20.32

最近更新 2026-05-20 03:35:27

分类：安全依赖：代码执行 / 读写文件应用场景：代码审查 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add clawhub-scanner

Metadata

name: clawhub-scanner
description: Scan installed ClawHub skills for malware, credential theft, prompt injection, and security risks. Detects known C2 infrastructure, obfuscated payloads, and data exfiltration patterns from the ClawHavoc campaign.

clawhub-scanner

Security scanner for ClawHub skills. Checks installed skills against known malicious patterns, IoCs, and suspicious behaviors.

Usage

When the user asks to scan skills, check for malware, or audit their ClawHub installations:

# Scan all installed skills
clawhub-scanner scan

# Scan a specific skill
clawhub-scanner scan --skill ~/.openclaw/skills/some-skill

# JSON output for automation
clawhub-scanner scan --json

# Include low-severity findings
clawhub-scanner scan --verbose

What It Detects

Critical: Known C2 server IPs and malicious domains (ClawHavoc campaign)
High: eval(), credential harvesting (SSH/AWS/browser/wallets), data exfiltration (Discord/Telegram webhooks), obfuscated payloads
Medium: Prompt injection, broad filesystem access, clipboard harvesting
Low: Outbound HTTP, WebSocket connections

Install

Requires the npm package:

npm install -g @elvatis_com/clawhub-scanner

Exit Codes

0 = clean
1 = high-severity findings
2 = critical findings