ClawHub Security Scanner

核心功能：扫描ClawHub已安装技能，检测ClawHavoc恶意IoCs、恶意软件、凭证窃取、数据泄露、prompt注入等多等级安全风险，支持全量/指定技能扫描，可输出JSON格式结果。典型场景：用户检查ClawHub技能安全性、审计安装环境时使用。输入为命令行指令，支持参数配置，输出含风险等级及对应退出码辅助判断。

homeofe

热度 20.29

最近更新 2026-05-20 03:35:27

分类：安全依赖：代码执行 / 读写文件应用场景：代码审查 / DevOps / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add clawhub-scanner

Metadata

name: clawhub-scanner
description: Scan installed ClawHub skills for malware, credential theft, prompt injection, and security risks. Detects known C2 infrastructure, obfuscated payloads, and data exfiltration patterns from the ClawHavoc campaign.

clawhub-scanner

Security scanner for ClawHub skills. Checks installed skills against known malicious patterns, IoCs, and suspicious behaviors.

Usage

When the user asks to scan skills, check for malware, or audit their ClawHub installations:

# Scan all installed skills
clawhub-scanner scan

# Scan a specific skill
clawhub-scanner scan --skill ~/.openclaw/skills/some-skill

# JSON output for automation
clawhub-scanner scan --json

# Include low-severity findings
clawhub-scanner scan --verbose

What It Detects

Critical: Known C2 server IPs and malicious domains (ClawHavoc campaign)
High: eval(), credential harvesting (SSH/AWS/browser/wallets), data exfiltration (Discord/Telegram webhooks), obfuscated payloads
Medium: Prompt injection, broad filesystem access, clipboard harvesting
Low: Outbound HTTP, WebSocket connections

Install

Requires the npm package:

npm install -g @elvatis_com/clawhub-scanner

Exit Codes

0 = clean
1 = high-severity findings
2 = critical findings