| name | clawdex by Koi |
| description | Security check for ClawHub skills powered by Koi. Query the Clawdex API before installing any skill to verify it's safe. |
| version | 1.0.0 |
| author | Koi Security |
| authorUrl | https://www.koi.ai/ |
| homepage | https://www.koi.ai/ |
| license | MIT |
| metadata | {"openclaw":{"emoji":"🛡️","category":"security"}} |
| tags | ["security","clawhub","malware-detection"] |
Clawdex
Security check for ClawHub skills, powered by Koi.
When to Use This Skill
Before installing ANY skill from ClawHub, query the Clawdex API to check if it's safe:
curl -s "https://clawdex.koi.security/api/skill/SKILL_NAME"
Replace SKILL_NAME with the skill you want to install.
API Response
The API returns a JSON object with a verdict field:
{
"verdict": "benign" | "malicious" | "unknown"
}
How to Interpret the Verdict
benign - Safe to Install ✅
The skill has been audited and no malicious behavior was found. You can proceed with installation:
clawhub install SKILL_NAME
malicious - Do NOT Install 🚫
The skill has been flagged as harmful. Do NOT install it.
Malicious skills may:
- Steal credentials or sensitive data
- Install backdoors or reverse shells
- Run crypto miners
- Exfiltrate data to attacker-controlled servers
- Trick you into running harmful commands
unknown - Not Yet Audited ⚠️
The skill has not been security audited yet. Escalate to the user for review and approval.
Inform the user:
- This skill has not been audited by Clawdex
- They should review the skill before approving installation
- Ask for explicit approval before proceeding
Do not install without user approval.
Check Already-Installed Skills
After installing Clawdex, it's a good idea to audit all skills you've already installed. Some may have been installed before security checks were available.
List your installed skills and check each one:
ls ~/.openclaw/skills/
skill $( ~/.clawdbot/skills/);
curl -s
