Scan AI agent skills for security vulnerabilities, dangerous code patterns, and undeclared permissions. Three-layer analysis: dependency CVE scanning, static code analysis, and permission auditing. Returns structured JSON risk report. Use when the user asks to scan a skill for security issues, check for vulnerabilities, audit permissions, or assess skill safety.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Scan AI agent skills for security vulnerabilities, dangerous code patterns, and undeclared permissions. Three-layer analysis: dependency CVE scanning, static code analysis, and permission auditing. Returns structured JSON risk report. Use when the user asks to scan a skill for security issues, check for vulnerabilities, audit permissions, or assess skill safety.
metadata
{"requires":{"env":["CLAW0X_API_KEY"]}}
Security Scanner
Free skill by Claw0x — powered by Claw0x Gateway API.
Scan AI agent skills for security vulnerabilities across three layers: dependency CVEs, dangerous code patterns, and undeclared permissions. Returns a structured JSON risk report with an overall score (0–100).
Free to use. This skill costs nothing. Just sign up at claw0x.com, create an API key, and start calling. No credit card, no wallet top-up required.
Quick Reference
When This Happens
Scan For
What You Get
Installing third-party skill
All vulnerabilities
Risk score + CVE list
Before publishing skill
Code patterns + permissions
Security audit report
Dependency update
New CVEs
Updated vulnerability list
User reports suspicious behavior
Undeclared permissions
Permission audit
CI/CD pipeline
Automated security check
Pass/fail + recommendations
Skill marketplace review
Trust score calculation
Approval decision data
Why API-based? Centralized CVE database (OSV.dev), consistent scanning rules, no local setup required.
5-Minute Quickstart
Step 1: Get API Key (30 seconds)
Sign up at claw0x.com → Dashboard → Create API Key
{"overall_risk":"medium","risk_score":35,"dependency_scan":{"vulnerabilities":[{"id":"GHSA-jf85-cpcp-j695","severity":"high","package_name":"lodash","summary":"Prototype Pollution"}]},"code_scan":{"findings":[{"rule_id":"SHELL_INJECT","severity":"critical","file":"handler.ts","line":42}]},"recommendations":["Critical: Shell injection pattern detected","High: lodash@4.17.20 has known vulnerabilities"]}
{"overall_risk":"high","risk_score":62,"input_mode":"direct","repo_url":null,"dependency_scan":{"packages_scanned":1,"vulnerabilities":[{"id":"GHSA-jf85-cpcp-j695","summary":"Prototype Pollution in lodash","severity":"high","package_name":"lodash","package_version":"4.17.20"}],"vulnerability_counts":{"critical":0,"high":1,"medium":0,"low":0}},"code_scan":{"findings":[{"rule_id":"SHELL_INJECT","name":"Shell injection","severity":"critical","file":"input.ts","line":1,"match":"require('child_process')","description":"Shell command execution detected"}],"finding_counts":{"critical":1,"high":0,"medium":0,"low":0},"rules_checked":8},"permission_audit":{"declared_permissions":[],"detected_permissions":["Bash(*)"],"undeclared_risks":["Bash(*)"]},"recommendations":["Critical: Shell injection pattern detected","High: lodash@4.17.20 has known vulnerabilities","Undeclared permission: Bash(*) detected but not declared"],"scanned_at":"2025-01-15T10:30:00.000Z","scan_duration_ms":1250}
Pricing
Free. This skill costs nothing to use. Just sign up at claw0x.com and create an API key.
No credit card required
No wallet top-up needed
Unlimited scans
Free forever
Why free? Security scanning is a critical need for the agent ecosystem. We provide it free to help build trust and attract users to the Claw0x platform.
API vs Local Scanning: Which is Right for You?
Feature
Local Tools (npm audit, Snyk)
Claw0x (API-Based)
Setup Time
10-30 min (install, configure)
2 minutes (get API key)
CVE Database
npm registry only
OSV.dev (all ecosystems)
Code Analysis
Basic (npm audit)
8 rule categories
Permission Audit
❌ Not available
✅ SKILL.md cross-check
Multi-Language
Separate tools per language
Unified API
CI/CD Integration
Complex (multiple tools)
Single API call
Cost
Free (local)
Free (API)
Maintenance
Tool updates required
Zero maintenance
When to Use Local Tools
Offline scanning required
Already integrated into workflow
Need language-specific deep analysis
Processing proprietary code that can't leave network
When to Use Claw0x (API-Based)
Multi-language projects (npm + PyPI)
Need permission auditing
Building skill marketplaces
CI/CD automation
Centralized security dashboard
No local tool maintenance
How It Fits Into Your Development Workflow
┌─────────────────────────────────────────────────────────────┐
│ Skill Development Lifecycle │
└─────────────────────────────────────────────────────────────┘
│
├─ Development
│ • Write code
│ • Add dependencies
│
├─ Pre-Commit Scan
│ POST /v1/call
│ {code: staged_files}
│ → Block if critical
│
├─ CI/CD Scan
│ POST /v1/call
│ {repo_url: github_url}
│ → Fail build if risk > 50
│
├─ Pre-Publish Scan
│ POST /v1/call
│ {skill_slug: slug}
│ → Calculate trust score
│
└─ Continuous Monitoring
Weekly scans for new CVEs
Alert on risk increase
Integration Points
Pre-Commit Hooks — Catch issues before Git commit
CI/CD Pipeline — Block merges with vulnerabilities
