honeybadger

name	honeybadger
version	1.0.0
description	Scan a GitHub or GitLab repository for security issues before installing it as a skill, tool, or MCP server. Use when the user wants to check, vet, scan, or review a repository for safety before installation. Detects hardcoded secrets, known CVEs, supply chain risks, and build provenance.
author	famclaw
license	MIT
tags	["security","scanner","supply-chain","mcp"]
metadata	{"openclaw":{"emoji":"🦡","requires":{"bins":["honeybadger"]},"install":[{"id":"go-install","kind":"shell","command":"go install github.com/famclaw/honeybadger/cmd/honeybadger@latest","bins":["honeybadger"],"label":"Install HoneyBadger (requires Go)"}]}}

HoneyBadger

HoneyBadger is a security scanner for software plugins. Before anything gets installed on your family server or development machine, HoneyBadger checks it.

HoneyBadger don't care. HoneyBadger checks anyway.

When to use this skill

Use this skill when the user:

• Wants to install a skill, MCP server, or tool from a GitHub or GitLab repo
• Asks "is this safe to install?", "can you check this?", "vet this repo"
• Wants to verify an update to an already-installed skill
• Asks about the security of any GitHub or GitLab repository

Prerequisites

The honeybadger binary must be in PATH. If not installed:

go install github.com/famclaw/honeybadger/cmd/honeybadger@latest

How to invoke

Basic scan (default: family paranoia level):

honeybadger scan <repo-url> --format text

With specific paranoia level:

honeybadger scan <repo-url> --paranoia minimal|family|strict|paranoid --format text

For update verification (rug-pull detection):

honeybadger scan <repo-url> --installed-sha <sha256-of-installed-archive>

Paranoia levels

• minimal — secrets + CVEs only. Fast. No LLM. Blocks on CRITICAL.
• family — full scan + LLM verdict. Default. Blocks on HIGH+.
• strict — adds attestation + build provenance. WARN treated as FAIL.
• paranoid — strict + allowlist enforcement. Blocks on LOW+.

How to interpret output

Exit codes: 0=PASS, 1=WARN, 2=FAIL, 3=scan error

With --format text: human-readable summary. With --format ndjson: one JSON event per line. The final line ("type":"result") contains the verdict and reasoning.

Always show the verdict and reasoning to the user. If verdict is WARN or FAIL, quote the key_finding field. If verdict is FAIL, tell the user not to install.

Example

User: "Is github.com/some-user/some-skill safe to install?"

honeybadger scan github.com/some-user/some-skill --format text

Report the verdict and reasoning to the user in plain language.