ClawSec Scanner

Comprehensive security scanner for agent platforms that automates vulnerability detection across multiple dimensions:

• Dependency Scanning: Analyzes npm and Python dependencies using npm audit and pip-audit with structured JSON output parsing
• CVE Database Integration: Queries OSV (primary), NVD 2.0, and GitHub Advisory Database for vulnerability enrichment
• SAST Analysis: Static code analysis using Semgrep (JavaScript/TypeScript) and Bandit (Python) to detect hardcoded secrets, command injection, path traversal, and unsafe deserialization
• DAST Framework: Agent-specific static analysis of OpenClaw hook metadata and handler source without importing or invoking target code
• Unified Reporting: Consolidated vulnerability reports with severity classification and remediation guidance
• Continuous Monitoring: OpenClaw hook integration for automated periodic scanning

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill clawsec-scanner -a openclaw -y

Features

Multi-Engine Scanning

The scanner orchestrates four complementary scan types to provide comprehensive vulnerability coverage:

1. Dependency Scanning

   • Executes npm audit --json and pip-audit -f json as subprocesses
   • Parses structured output to extract CVE IDs, severity, affected versions
   • Handles edge cases: missing package-lock.json, zero vulnerabilities, malformed JSON

2. CVE Database Queries

   • OSV API (primary): Free, no authentication, broad ecosystem support (npm, PyPI, Go, Maven)
   • NVD 2.0 (optional): Requires API key to avoid 6-second rate limiting
   • GitHub Advisory Database (optional): GraphQL API with OAuth token
   • Normalizes all API responses to unified Vulnerability schema