clawvet

Category: Data & AI | Uploader: MohibShaikh | Downloads: 0 | Version: v1.0（Latest）

Security scanner for OpenClaw skills. Detects threats across 6 analysis passes before you install.

Changelog: Source: GitHub https://github.com/MohibShaikh/clawvet

Directory Structure

Current level: Root

📁 .clawhub/
- 📄 lock.json 214 B
📁 .github/
- 📁 workflows/
  - 📄 ci.yml 812 B
📁 apps/
- 📁 api/
  - 📁 src/
    
    📁 db/
    
    📄 index.ts 344 B
    
    📄 schema.ts 2.5 KB
    
    📁 queue/
    
    📄 scan-queue.ts 742 B
    
    📄 scan-worker.ts 3.7 KB
    
    📁 routes/
    
    📄 auth.ts 6.6 KB
    
    📄 scans.ts 7.4 KB
    
    📄 skills.ts 1.7 KB
    
    📄 webhooks.ts 3.5 KB
    
    📁 services/
    
    📄 dependency-checker.ts 53 B
    
    📄 metadata-validator.ts 52 B
    
    📄 resolve-user.ts 2.1 KB
    
    📄 scanner.ts 489 B
    
    📄 semantic-analysis.ts 4.5 KB
    
    📄 static-analysis.ts 53 B
    
    📄 tiers.ts 912 B
    
    📄 typosquat-detector.ts 52 B
    
    📁 utils/
    
    📄 risk-scorer.ts 83 B
    
    📄 skill-parser.ts 46 B
    
    📄 server.ts 1.6 KB
  - 📁 test/
    
    📁 fixtures/
    
    📁 benign-weather/
    
    📄 SKILL.md 788 B
    
    📁 leaky-creds/
    
    📄 SKILL.md 777 B
    
    📁 malicious-stealer/
    
    📄 SKILL.md 905 B
    
    📁 obfuscated-payload/
    
    📄 SKILL.md 511 B
    
    📁 sneaky-injection/
    
    📄 SKILL.md 735 B
    
    📁 typosquat-todoistt/
    
    📄 SKILL.md 388 B
    
    📄 api.test.ts 2.4 KB
    
    📄 cli-integration.test.ts 3.8 KB
    
    📄 cli-semantic-flag.test.ts 1.2 KB
    
    📄 edge-cases.test.ts 9.4 KB
    
    📄 regex-safety.test.ts 5.3 KB
    
    📄 routes.test.ts 4.6 KB
    
    📄 scanner.test.ts 1.8 KB
  - 📄 drizzle.config.ts 282 B
  - 📄 package.json 865 B
  - 📄 tsconfig.json 137 B
- 📁 web/
  - 📁 app/
    
    📁 api/
    
    📁 auth/
    
    📁 me/
    
    📄 route.ts 724 B
    
    📁 scan/
    
    📄 route.ts 774 B
    
    📁 scans/
    
    📁 [id]/
    
    📄 route.ts 659 B
    
    📄 route.ts 761 B
    
    📁 stats/
    
    📄 route.ts 582 B
    
    📁 webhooks/
    
    📄 route.ts 1.5 KB
    
    📁 dashboard/
    
    📁 scan/
    
    📁 [id]/
    
    📄 page.tsx 3.6 KB
    
    📁 settings/
    
    📄 page.tsx 11.6 KB
    
    📄 page.tsx 8.7 KB
    
    📄 globals.css 3.4 KB
    
    📄 layout.tsx 2.9 KB
    
    📄 page.tsx 19.4 KB
  - 📁 components/
    
    📄 RiskScoreGauge.tsx 2.4 KB
    
    📄 ScanResultCard.tsx 3.5 KB
    
    📄 SkillAnalysisReport.tsx 8.9 KB
    
    📄 ThreatBadge.tsx 1.3 KB
  - 📄 next-env.d.ts 228 B
  - 📄 next.config.js 161 B
  - 📄 package.json 641 B
  - 📄 postcss.config.js 83 B
  - 📄 tailwind.config.ts 1.8 KB
  - 📄 tsconfig.json 562 B
📁 benchmarks/
- 📁 benign/
  - 📁 api-client/
    
    📄 SKILL.md 332 B
  - 📁 file-organizer/
    
    📄 SKILL.md 336 B
  - 📁 git-helper/
    
    📄 SKILL.md 274 B
  - 📁 markdown-formatter/
    
    📄 SKILL.md 382 B
  - 📁 todo-app/
    
    📄 SKILL.md 626 B
- 📁 malicious/
  - 📁 credential-theft/
    
    📄 SKILL.md 574 B
  - 📁 obfuscated-shell/
    
    📄 SKILL.md 710 B
  - 📁 prompt-injection/
    
    📄 SKILL.md 581 B
  - 📁 rce-base64/
    
    📄 SKILL.md 575 B
  - 📁 typosquat/
    
    📄 SKILL.md 440 B
📁 packages/
- 📁 cli/
  - 📁 src/
    
    📁 commands/
    
    📄 audit.ts 1.8 KB
    
    📄 badge.ts 2.1 KB
    
    📄 scan.ts 5.2 KB
    
    📄 watch.ts 2.6 KB
    
    📁 output/
    
    📄 json.ts 162 B
    
    📄 sarif.ts 2.2 KB
    
    📄 terminal.ts 2.8 KB
    
    📄 index.ts 2.8 KB
    
    📄 telemetry.ts 2.6 KB
  - 📄 LICENSE 1.1 KB
  - 📄 package.json 1.2 KB
  - 📄 README.md 1.8 KB
  - 📄 tsconfig.json 137 B
  - 📄 tsup.config.ts 373 B
- 📁 shared/
  - 📁 src/
    
    📁 scanner/
    
    📄 cache.ts 877 B
    
    📄 dependency-checker.ts 1.5 KB
    
    📄 index.ts 2.6 KB
    
    📄 metadata-validator.ts 3.1 KB
    
    📄 risk-scorer.ts 802 B
    
    📄 skill-parser.ts 1.5 KB
    
    📄 static-analysis.ts 2.2 KB
    
    📄 typosquat-detector.ts 1.5 KB
    
    📄 index.ts 95 B
    
    📄 patterns.ts 25.7 KB
    
    📄 types.ts 1.8 KB
  - 📁 test/
    
    📄 benchmarks.test.ts 1.4 KB
  - 📄 package.json 718 B
  - 📄 tsconfig.json 137 B
📁 skills/
- 📁 commit/
  - 📁 .clawhub/
    
    📄 origin.json 138 B
  - 📄 _meta.json 125 B
  - 📄 SKILL.md 712 B
- 📁 frontend-design/
  - 📁 .clawhub/
    
    📄 origin.json 147 B
  - 📄 _meta.json 134 B
  - 📄 LICENSE.txt 10.5 KB
  - 📄 SKILL.md 4.2 KB
📄 .dockerignore 82 B
📄 .env.example 669 B
📄 .gitignore 99 B
📄 action.yml 761 B
📄 Caddyfile 156 B
📄 docker-compose.prod.yml 2.0 KB
📄 docker-compose.yml 329 B
📄 Dockerfile 992 B
📄 Dockerfile.web 850 B
📄 package-lock.json 239.8 KB
📄 package.json 332 B
📄 README.md 3.6 KB
📄 SKILL.md 2.1 KB
📄 tsconfig.base.json 385 B
📄 turbo.json 283 B

SKILL.md

---
name: clawvet
version: 0.5.1
description: Security scanner for OpenClaw skills. Detects threats across 6 analysis passes before you install.
author: MohibShaikh
license: MIT
homepage: https://github.com/MohibShaikh/clawvet
repository: https://github.com/MohibShaikh/clawvet
metadata:
  openclaw:
    requires:
      bins:
        - node
        - npm
      env: []
    category: security
    tags:
      - security
      - scanner
      - supply-chain
      - malware-detection
---

# clawvet

Security scanner for OpenClaw skills. Analyzes skills for threats before installation.

## Usage

Scan a local skill:

```bash
npx clawvet scan ./skill-folder/
```

JSON output for CI/CD:

```bash
npx clawvet scan ./skill-folder/ --format json --fail-on high
```

Audit all installed skills:

```bash
npx clawvet audit
```

Watch mode — auto-block risky installs:

```bash
npx clawvet watch --threshold 50
```

Submit feedback or get threat alerts:

```bash
npx clawvet feedback
```

## Analysis Passes

1. **Skill Parser** — Extracts YAML frontmatter, code blocks, URLs, IPs, domains
2. **Static Analysis** — 54 pattern rules across multiple threat categories
3. **Metadata Validator** — Checks for undeclared binaries, env vars, missing descriptions
4. **Dependency Checker** — Flags auto-install and global package installs
5. **Typosquat Detector** — Levenshtein distance against popular skill names
6. **Semantic Analysis** — AI-powered detection of social engineering and injection (Pro)

## What's New in v0.5

- **Confidence scores** — Each finding shows a confidence percentage based on context. Risk scores are weighted accordingly.
- **Fix suggestions** — Every finding includes an actionable remediation shown in terminal and SARIF output.
- **Content-hash caching** — Repeat scans of unchanged files are near-instant.
- **Feedback form** — Run `npx clawvet feedback` to share what you think.

## Risk Grades

| Score | Grade | Action |
|-------|-------|--------|
| 0-10 | A | Safe to install |
| 11-25 | B | Safe to install |
| 26-50 | C | Review before installing |
| 51-75 | D | Review carefully |
| 76-100 | F | Do not install |

Comments 0

Latest | Hot

Please login before commenting.

No comments yet. Be the first one!

clawvet

Directory Structure

SKILL.md

Report

Notice