Tencent SkillHub · Security & Compliance

OpenClaw Skill Scanner

Scans ClawHub skills for malicious patterns like payloads, reverse shells, data leaks, and crypto miners before and after installation.

skill openclawclawhub Free

0 Downloads

0 Stars

0 Installs

0 Score

High Signal

Scans ClawHub skills for malicious patterns like payloads, reverse shells, data leaks, and crypto miners before and after installation.

⬇ 0 downloads ★ 0 stars Unverified but indexed

Install for OpenClaw

Known item issue.

This item's current download entry is known to bounce back to a listing or homepage instead of returning a package file.

Quick setup

Open the source page and confirm the package flow manually.
Review SKILL.md if you can obtain the files.
Treat this source as manual setup until the download is verified.

Requirements

Target platform: OpenClaw
Install method: Manual import
Extraction: Extract archive
Prerequisites: OpenClaw
Primary doc: SKILL.md

Package facts

Download mode: Manual review
Package format: ZIP package
Source platform: Tencent SkillHub
What's included: SKILL.md, install-hook.sh, report-template.md, scanner.py, whitelist.json

Validation

Open the source listing and confirm there is a real package or setup artifact available.
Review SKILL.md before asking your agent to continue.
Treat this source as manual setup until the upstream download flow is fixed.

Install with your agent

Agent handoff

Use the source page and any available docs to guide the install because the item currently does not return a direct package file.

Open the source page via Open source listing.
If you can obtain the package, extract it into a folder your agent can access.
Paste one of the prompts below and point your agent at the source page and extracted files.

New install

I tried to install a skill package from Yavira, but the item currently does not return a direct package file. Inspect the source page and any extracted docs, then tell me what you can confirm and any manual steps still required.

Upgrade existing

I tried to upgrade a skill package from Yavira, but the item currently does not return a direct package file. Compare the source page and any extracted docs with my current installation, then summarize what changed and what manual follow-up I still need.

Open Send to Agent page Open JSON manifest Open Markdown brief

Trust & source

Release facts

Source: Tencent SkillHub
Verification: Indexed source record
Version: 1.0.0

Provenance

Publisher: epwhesq
Source page: View original listing
Canonical URL: Open canonical page

Documentation

ClawHub primary doc Primary doc: SKILL.md 11 sections Open source page

Skill Scanner

Name: skill-scanner Version: 1.0.0 Author: vrtlly.us Category: Security

Description

Scans ClawHub skills for malicious patterns before and after installation. Detects base64 payloads, reverse shells, data exfiltration, crypto miners, obfuscated URLs, and more.

Scan all installed skills

python3 scanner.py

Scan a specific skill

python3 scanner.py --skill <skill-name>

Scan a specific file

python3 scanner.py --file <path-to-file>

Pre-install scan (download → scan → report → cleanup)

python3 scanner.py --pre-install <clawhub-slug>

JSON output

python3 scanner.py --json python3 scanner.py --skill <name> --json

Safe install hook

bash install-hook.sh <clawhub-slug> bash install-hook.sh <clawhub-slug> --force

Detection Patterns

CategoryWhat it catchesBase64 payloadsLong base64 strings near exec/bash/evalPipe to shellcurl ... | bash, wget ... | shRaw IP connectionshttp://1.2.3.4 style URLsDangerous functionseval(), exec(), os.system(), subprocess(shell=True)Hidden filesDotfile creation in unexpected placesEnv exfiltrationReading .env, API keys sent outboundObfuscated URLsrentry.co, pastebin, hastebin redirectorsFake dependenciesReferences to non-existent packagesData exfil endpointswebhook.site, requestbin, etc.Crypto miningxmrig, stratum, mining pool referencesPassword archivesPassword-protected zip/tar downloads

Risk Scores

0-29 (Green): Clean — no suspicious patterns found 30-69 (Yellow): Suspicious — review warnings before use 70-100 (Red): Dangerous — likely malicious, do not install

Files

scanner.py — Main scanner engine install-hook.sh — Safe installation wrapper whitelist.json — Known-good and known-bad skill lists report-template.md — Markdown report template

Category context

Identity, auth, scanning, governance, audit, and operational guardrails.

Source: Tencent SkillHub

Largest current source with strong distribution and engagement signals.

Package contents

Included in package

2 Docs2 Scripts1 Config

SKILL.md Primary doc
report-template.md Docs
install-hook.sh Scripts
scanner.py Scripts
whitelist.json Config