# Clawsec Scanner

Automated vulnerability scanner for agent platforms.

- Repository: https://github.com/prompt-security/clawsec (1129 stars)
- Category: Security
- License: AGPL-3.0
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add prompt-security/clawsec --skill clawsec-scanner -g -a claude-code -y`
Codex: `npx skills add prompt-security/clawsec --skill clawsec-scanner -g -a codex -y`
Cursor: `npx skills add prompt-security/clawsec --skill clawsec-scanner -g -a cursor -y`
Gemini CLI: `npx skills add prompt-security/clawsec --skill clawsec-scanner -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add prompt-security/clawsec`

## Description

Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis (Semgrep, Bandit), and agent-specific static hook inspection for OpenClaw hooks.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# ClawSec Scanner

Comprehensive security scanner for agent platforms that automates vulnerability detection across multiple dimensions:

- **Dependency Scanning**: Analyzes npm and Python dependencies using `npm audit` and `pip-audit` with structured JSON output parsing
- **CVE Database Integration**: Queries OSV (primary), NVD 2.0, and GitHub Advisory Database for vulnerability enrichment
- **SAST Analysis**: Static code analysis using Semgrep (JavaScript/TypeScript) and Bandit (Python) to detect hardcoded secrets, command injection, path traversal, and unsafe deserialization
- **DAST Framework**: Agent-specific static analysis of OpenClaw hook metadata and handler source without importing or invoking target code
- **Unified Reporting**: Consolidated vulnerability reports with severity classification and remediation guidance
- **Continuous Monitoring**: OpenClaw hook integration for automated periodic scanning

## Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

```bash
npx skills add prompt-security/clawsec --skill clawsec-scanner -a openclaw -y
```

## Features

### Multi-Engine Scanning

The scanner orchestrates four complementary scan types to provide comprehensive vulnerability coverage:

1. **Dependency Scanning**
   - Executes `npm audit --json` and `pip-audit -f json` as subprocesses
   - Parses structured output to extract CVE IDs, severity, affected versions
   - Handles edge cases: missing package-lock.json, zero vulnerabilities, malformed JSON

2. **CVE Database Queries**
   - **OSV API** (primary): Free, no authentication, broad ecosystem support (npm, PyPI, Go, Maven)
   - **NVD 2.0** (optional): Requires API key to avoid 6-second rate limiting
   - **GitHub Advisory Database** (optional): GraphQL API with OAuth token
   - Normalizes all API responses to unified `Vulnerability` schema

The rest: https://github.com/prompt-security/clawsec/blob/HEAD/skills/clawsec-scanner/SKILL.md