Claude MarketplacesSubmit
prompt-security avatar

Clawsec Scanner

prompt-security/clawsec

This is a proper security scanner built specifically for agent platforms, not a wrapper around generic tools. It runs dependency checks (npm audit, pip-audit), queries multiple CVE databases (OSV, NVD, GitHub Advisory), does static analysis with Semgrep and Bandit, and includes agent-specific dynamic testing for OpenClaw hooks. The DAST piece is notable because it actually tests hook handlers with malicious inputs and timeout scenarios rather than trying to force web scanners into places they don't belong. You can run it on demand via CLI or wire it up as an OpenClaw hook for continuous monitoring. Requires a fair number of binaries installed locally (node, Python, semgrep, bandit, jq), but the install script does proper cryptographic verification of releases.

skills.sh installs
194
GitHub stars
1.1K
last updated
Aug 21, 2026
View on GitHub

Install

$ npx -y skills add prompt-security/clawsec --skill clawsec-scanner --agent claude-code

Installs into .claude/skills of the current project.

Files

ClawSec Scanner

Comprehensive security scanner for agent platforms that automates vulnerability detection across multiple dimensions:

  • Dependency Scanning: Analyzes npm and Python dependencies using npm audit and pip-audit with structured JSON output parsing
  • CVE Database Integration: Queries OSV (primary), NVD 2.0, and GitHub Advisory Database for vulnerability enrichment
  • SAST Analysis: Static code analysis using Semgrep (JavaScript/TypeScript) and Bandit (Python) to detect hardcoded secrets, command injection, path traversal, and unsafe deserialization
  • DAST Framework: Agent-specific static analysis of OpenClaw hook metadata and handler source without importing or invoking target code
  • Unified Reporting: Consolidated vulnerability reports with severity classification and remediation guidance
  • Continuous Monitoring: OpenClaw hook integration for automated periodic scanning

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill clawsec-scanner -a openclaw -y

Features

Multi-Engine Scanning

SKILL.md on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Details

Repository
github.com/prompt-security/clawsec
Categories
Frontend Development, Backend & APIs, Security, Git & Pull Requests, AI & Agent Building, Automation & Workflows, Python, Databases
First seen
Jun 3, 2026

More from prompt-security/clawsec

All 10

Recommended

More Frontend Development
1aiskillstore avatarhook-developmentaiskillstore/marketplaceThis skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", 188skills.sh installs
2ingpoc avatarscroll-storytelleringpoc/skillsUse when creating interactive scroll-based storytelling experiences with mouse-following spotlight effects, animated SVG art, and the Anthropic design language.186skills.sh installs
3davila7 avatarplugin-forgedavila7/claude-code-templatesCreate and manage Claude Code plugins with proper structure, manifests, and marketplace integration. Use when creating plugins for a marketplace, adding plugin 184skills.sh installs
4delorenj avatarfal-text-to-imagedelorenj/skillsGenerate, remix, and edit images using fal.ai's AI models. Supports text-to-image generation, image-to-image remixing, and targeted inpainting/editing.184skills.sh installs
5levnikolaevich avatarln-637-test-structure-auditorlevnikolaevich/claude-code-skillsAudits test maintainability and structure: layout drift, orphan tests, fragmented duplicates, test-to-source mapping, and domain grouping. Use when auditing tes184skills.sh installs
6davepoon avatarauth-patternsdavepoon/buildwithclaudeThis skill should be used when the user asks about "authentication in Next.js", "NextAuth", "Auth.js", "middleware auth", "protected routes", "session managemen182skills.sh installs