skill-scan is an AI agent skill, created by dgriffin831 and published at openclaw/skills. ClawSecure audited skill-scan across 72 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 55 findings concentrate in Data Exfiltration, Command Injection and Code Injection, including Pattern detected: __import__( and Pattern detected: compile(. 41 were rated high or critical severity.
Is skill-scan safe?
ClawSecure audited skill-scan and assigned a security score of 0/100 (High Risk), identifying 55 findings across Data Exfiltration and Command Injection. Review the findings below before installing.
What did ClawSecure find in skill-scan?
ClawSecure identified 55 findings in skill-scan, concentrated in Data Exfiltration, Command Injection and Code Injection. 41 were rated high or critical severity. The most severe include Pattern detected: __import__( and Pattern detected: compile(.
How was skill-scan audited?
ClawSecure ran skill-scan through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 72 files from openclaw/skills.
What does a score of 0 mean?
ClawSecure assigned skill-scan a security score of 0/100, placing it in the High Risk range. This is driven by 55 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for skill-scan
ClawSecure detected 55 security findings in skill-scan, spanning Data Exfiltration, Command Injection, Code Injection and Prompt Injection.
- critical · Pattern detected: __import__(. Command Injection finding detected in
skill_scan/scanner.py:474. - critical · Pattern detected: compile(. Command Injection finding detected in
skill_scan/scanner.py:476. - critical · Pattern detected: eval(. Command Injection finding detected in
test-fixtures/command-injection-eval/calculate.py:18. - critical · Pattern detected: eval(. Command Injection finding detected in
test-fixtures/command-injection-eval/calculate.py:24. - critical · Pattern detected: eval(. Command Injection finding detected in
test-fixtures/command-injection-eval/calculate.py:25. - critical · Pattern detected: exec(. Command Injection finding detected in
test-fixtures/command-injection-eval/calculate.py:31. - critical · Pattern detected: exec(. Command Injection finding detected in
test-fixtures/command-injection-eval/calculate.py:32. - critical · Pattern detected: exec(. Command Injection finding detected in
test-fixtures/backdoor-magic-string/process.py:40. - critical · Pattern detected: exec(. Command Injection finding detected in
test-fixtures/evasive-09-python-pickle/cache.py:23. - critical · Pattern detected: compile(. Command Injection finding detected in
test-fixtures/evasive-09-python-pickle/cache.py:23. - critical · Pattern detected: __import__(. Command Injection finding detected in
test-fixtures/evasive-09-python-pickle/cache.py:26. - critical · Pattern detected: requests.post(. Data Exfiltration finding detected in
test-fixtures/data-exfil-env-secrets/get_info.py:56.
Showing the 12 highest-severity of 55 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for skill-scan
Audit external network connections
Harden command execution
Eliminate dynamic code execution
Related Security Research
ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on February 7, 2026. skill-scan is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.