ClawSentinel

ClawSentinel 是一个只读安全审计 Skill：用户粘贴 skill markdown 或提供公开 GitHub 仓库地址后，它按内置规则分析恶意代码、MCP 后门、混淆载荷和供应链攻击风险，并以 JSON 返回审计结果；它声称不执行被审代码，仅在显式请求时抓取公开仓库内容。

chuddyrudd

热度 72.17

最近更新 2026-05-11 17:27:43

分类：安全依赖：联网浏览搜索应用场景：代码审查

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add clawsentinel

Metadata

name: ClawSentinel
description: Pure local 2026 ClawHub/OpenClaw skill scanner. Detects ClawHavoc malware, MCP backdoors, obfuscated payloads, and supply-chain attacks. 100% read-only analysis.
version: 2.3.4
tags: ["security","auditor","clawhavoc","malware","mcp","supply-chain","zero-trust"]

ClawSentinel v2.3

The sharpest skill auditor in the ClawHavoc era. Scans any skill markdown or GitHub repo for malicious patterns before you install it. Never executes code. Trained on public DataClaw dataset.

Security Guarantees

100% local read-only analysis
Only fetches raw.githubusercontent.com when you explicitly audit a public GitHub repo
Zero telemetry in base version

How to use

"audit this skill:" + paste markdown
"audit github https://github.com/user/repo"

Output Format

Always clean JSON.

Pro Tip

Run ClawSentinel on every skill before installing. ClawHub is infested right now.