clawsec-scanner

Name: clawsec-scanner
Author: prompt-security

175installs112forks

How to install clawsec-scanner?

prompt-security/clawsec/clawsec-scanner

$npx -y skills add prompt-security/clawsec --skill clawsec-scanner

Installs into the current project.

Summary

Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis (Semgrep, Bandit), and agent-specific static hook inspection for OpenClaw hooks.

Files · 1

View on GitHub

SKILL.md

1	# ClawSec Scanner
2
3	Comprehensive security scanner for agent platforms that automates vulnerability detection across multiple dimensions:
4
5	- Dependency Scanning: Analyzes npm and Python dependencies using `npm audit` and `pip-audit` with structured JSON output parsing
6	- CVE Database Integration: Queries OSV (primary), NVD 2.0, and GitHub Advisory Database for vulnerability enrichment
7	- SAST Analysis: Static code analysis using Semgrep (JavaScript/TypeScript) and Bandit (Python) to detect hardcoded secrets, command injection, path traversal, and unsafe deserialization
8	- DAST Framework: Agent-specific static analysis of OpenClaw hook metadata and handler source without importing or invoking target code
9	- Unified Reporting: Consolidated vulnerability reports with severity classification and remediation guidance
10	- Continuous Monitoring: OpenClaw hook integration for automated periodic scanning
11
12	## Vercel Skills Installation
13
14	Install with the Vercel Skills CLI for this harness:
15
16	```bash
17	npx skills add prompt-security/clawsec --skill clawsec-scanner -a openclaw -y
18	```
19
20	## Features
21
22	### Multi-Engine Scanning
23
24	The scanner orchestrates four complementary scan types to provide comprehensive vulnerability coverage:
25
26	1. Dependency Scanning
27	- Executes `npm audit --json` and `pip-audit -f json` as subprocesses
28	- Parses structured output to extract CVE IDs, severity, affected versions
29	- Handles edge cases: missing package-lock.json, zero vulnerabilities, malformed JSON
30
31	2. CVE Database Queries
32	- OSV API (primary): Free, no authentication, broad ecosystem support (npm, PyPI, Go, Maven)
33	- NVD 2.0 (optional): Requires API key to avoid 6-second rate limiting
34	- GitHub Advisory Database (optional): GraphQL API with OAuth token
35	- Normalizes all API responses to unified `Vulnerability` schema
36
37	3. Static Analysis (SAST)
38	- Semgrep for JavaScript/TypeScript: Detects security issues using `--config auto` or `--config p/security-audit`
39	- Bandit for Python: Leverages existing `pyproject.toml` configuration
40	- Identifies: hardcoded secrets (API keys, tokens), command injection (`eval`, `exec`), path traversal, unsafe deserialization
41
42	4. Dynamic Analysis (DAST)
43	- Static hook inspection for OpenClaw hook handlers discovered from `HOOK.md` metadata
44	- Verifies coverage and source-level risk signals without importing, transpiling, or invoking target handlers
45	- Note: Traditional web DAST tools (ZAP, Burp) do not apply to agent platforms - this provides agent-specific testing
46
47	### Unified Reporting
48
49	All scan types emit a consistent `ScanReport` JSON schema:
50
51	```typescript
52	{
53	scan_id: string; // UUID
54	timestamp: string; // ISO 8601
55	target: string; // Scanned path
56	vulnerabilities: Vulnerability[];
57	summary: {
58	critical: number;
59	high: number;
60	medium: number;
61	low: number;
62	info: number;
63	}
64	}
65	```
66
67	Each `Vulnerability` object includes:
68	- `id`: CVE-2023-12345 or GHSA-xxxx-yyyy-zzzz
69	- `source`: npm-audit \| pip-audit \| osv \| nvd \| github \| sast \| dast
70	- `severity`: critical \| high \| medium \| low \| info
71	- `package`: Package name (or 'N/A' for SAST/DAST)
72	- `version`: Affected version
73	- `fixed_version`: First version with fix (if available)
74	- `title`: Short description
75	- `description`: Full advisory text
76	- `references`: URLs for more info
77	- `discovered_at`: ISO 8601 timestamp
78
79	### OpenClaw Integration
80
81	Automated continuous monitoring via hook:
82
83	- Runs scanner on configurable interval (default: 86400s / 24 hours)
84	- Triggers on `agent:bootstrap` and `command:new` events
85	- Posts findings to `event.messages` array with severity summary
86	- Rate-limited by `CLAWSEC_SCANNER_INTERVAL` environment variable
87
88	## Installation
89
90	### Prerequisites
91
92	Verify required binaries are available:
93
94	```bash
95	# Core runtimes
96	node --version # v20+
97	npm --version
98	python3 --version # 3.10+
99
100	# Scanning tools
101	pip-audit --version # Install: uv pip install pip-audit
102	semgrep --version # Install: pip install semgrep OR brew install semgrep
103	bandit --version # Install: uv pip install bandit
104
105	# Utilities
106	jq --version
107	curl --version
108	```
109
110	### Option A: Via clawhub (recommended)
111
112	```bash
113	npx clawhub@latest install clawsec-scanner
114	```
115
116	### Option B: Manual installation with verification
117
118	```bash
119	set -euo pipefail
120
121	VERSION="${SKILL_VERSION:?Set SKILL_VERSION (e.g. 0.1.0)}"
122	INSTALL_ROOT="${INSTALL_ROOT:-$HOME/.openclaw/skills}"
123	DEST="$INSTALL_ROOT/clawsec-scanner"
124	BASE="https://github.com/prompt-s

People who liked this also viewed

6 picks

Type

clawsec-scanner

175installs112forks

View on GitHub

How to install clawsec-scanner?

prompt-security/clawsec/clawsec-scanner

$npx -y skills add prompt-security/clawsec --skill clawsec-scanner

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# ClawSec Scanner
2
3	Comprehensive security scanner for agent platforms that automates vulnerability detection across multiple dimensions:
4
5	- Dependency Scanning: Analyzes npm and Python dependencies using `npm audit` and `pip-audit` with structured JSON output parsing
6	- CVE Database Integration: Queries OSV (primary), NVD 2.0, and GitHub Advisory Database for vulnerability enrichment
7	- SAST Analysis: Static code analysis using Semgrep (JavaScript/TypeScript) and Bandit (Python) to detect hardcoded secrets, command injection, path traversal, and unsafe deserialization
8	- DAST Framework: Agent-specific static analysis of OpenClaw hook metadata and handler source without importing or invoking target code
9	- Unified Reporting: Consolidated vulnerability reports with severity classification and remediation guidance
10	- Continuous Monitoring: OpenClaw hook integration for automated periodic scanning
11
12	## Vercel Skills Installation
13
14	Install with the Vercel Skills CLI for this harness:
15
16	```bash
17	npx skills add prompt-security/clawsec --skill clawsec-scanner -a openclaw -y
18	```
19
20	## Features
21
22	### Multi-Engine Scanning
23
24	The scanner orchestrates four complementary scan types to provide comprehensive vulnerability coverage:
25
26	1. Dependency Scanning
27	- Executes `npm audit --json` and `pip-audit -f json` as subprocesses
28	- Parses structured output to extract CVE IDs, severity, affected versions
29	- Handles edge cases: missing package-lock.json, zero vulnerabilities, malformed JSON
30
31	2. CVE Database Queries
32	- OSV API (primary): Free, no authentication, broad ecosystem support (npm, PyPI, Go, Maven)
33	- NVD 2.0 (optional): Requires API key to avoid 6-second rate limiting
34	- GitHub Advisory Database (optional): GraphQL API with OAuth token
35	- Normalizes all API responses to unified `Vulnerability` schema
36
37	3. Static Analysis (SAST)
38	- Semgrep for JavaScript/TypeScript: Detects security issues using `--config auto` or `--config p/security-audit`
39	- Bandit for Python: Leverages existing `pyproject.toml` configuration
40	- Identifies: hardcoded secrets (API keys, tokens), command injection (`eval`, `exec`), path traversal, unsafe deserialization
41
42	4. Dynamic Analysis (DAST)
43	- Static hook inspection for OpenClaw hook handlers discovered from `HOOK.md` metadata
44	- Verifies coverage and source-level risk signals without importing, transpiling, or invoking target handlers
45	- Note: Traditional web DAST tools (ZAP, Burp) do not apply to agent platforms - this provides agent-specific testing
46
47	### Unified Reporting
48
49	All scan types emit a consistent `ScanReport` JSON schema:
50
51	```typescript
52	{
53	scan_id: string; // UUID
54	timestamp: string; // ISO 8601
55	target: string; // Scanned path
56	vulnerabilities: Vulnerability[];
57	summary: {
58	critical: number;
59	high: number;
60	medium: number;
61	low: number;
62	info: number;
63	}
64	}
65	```
66
67	Each `Vulnerability` object includes:
68	- `id`: CVE-2023-12345 or GHSA-xxxx-yyyy-zzzz
69	- `source`: npm-audit \| pip-audit \| osv \| nvd \| github \| sast \| dast
70	- `severity`: critical \| high \| medium \| low \| info
71	- `package`: Package name (or 'N/A' for SAST/DAST)
72	- `version`: Affected version
73	- `fixed_version`: First version with fix (if available)
74	- `title`: Short description
75	- `description`: Full advisory text
76	- `references`: URLs for more info
77	- `discovered_at`: ISO 8601 timestamp
78
79	### OpenClaw Integration
80
81	Automated continuous monitoring via hook:
82
83	- Runs scanner on configurable interval (default: 86400s / 24 hours)
84	- Triggers on `agent:bootstrap` and `command:new` events
85	- Posts findings to `event.messages` array with severity summary
86	- Rate-limited by `CLAWSEC_SCANNER_INTERVAL` environment variable
87
88	## Installation
89
90	### Prerequisites
91
92	Verify required binaries are available:
93
94	```bash
95	# Core runtimes
96	node --version # v20+
97	npm --version
98	python3 --version # 3.10+
99
100	# Scanning tools
101	pip-audit --version # Install: uv pip install pip-audit
102	semgrep --version # Install: pip install semgrep OR brew install semgrep
103	bandit --version # Install: uv pip install bandit
104
105	# Utilities
106	jq --version
107	curl --version
108	```
109
110	### Option A: Via clawhub (recommended)
111
112	```bash
113	npx clawhub@latest install clawsec-scanner
114	```
115
116	### Option B: Manual installation with verification
117
118	```bash
119	set -euo pipefail
120
121	VERSION="${SKILL_VERSION:?Set SKILL_VERSION (e.g. 0.1.0)}"
122	INSTALL_ROOT="${INSTALL_ROOT:-$HOME/.openclaw/skills}"
123	DEST="$INSTALL_ROOT/clawsec-scanner"
124	BASE="https://github.com/prompt-s

People who liked this also viewed

6 picks

Type