Skip to content
Get packs

EdgeOne ClawScan Security Check

Audits OpenClaw setups and third-party skills for security risks before you install or trust them.

Source Download skill
Repository
Tencent/AI-Infra-Guard
Stars
7,320
Licence
Apache-2.0
Files
1 file

What it does

Once installed, this skill lets the agent run a security check on your OpenClaw environment: it audits skills you already have, scans a skill before you install it, and runs a broader health check looking for insecure settings, malicious skills, and vulnerabilities. It can optionally look up skill names and your OpenClaw version against a Tencent threat database for newer threat and CVE information; you can turn that off entirely.

Great for

  • Users who install many third-party agent skills and want to vet them before use
  • Teams running OpenClaw who want a periodic security health check
  • Security-minded users who want an upfront disclosure of network activity before running a scan

Skip it if

  • General OpenClaw usage, project debugging, or normal coding tasks, which the skill says it should not trigger for (it would add no value there)
  • Scanning a production OpenClaw Gateway: the optional live probe contacts the local Gateway and the skill warns to test in an isolated environment first
  • Organizations that forbid any outbound calls to third-party endpoints unless cloud lookup is disabled with AIG_CLOUD_LOOKUP=off

Try asking

  • “Start a security health check for my OpenClaw environment”
  • “Audit this skill for supply chain risk before I install it”
  • “Review my installed skills and tell me if any look unsafe”
  • “Check whether OpenClaw has any known CVEs for my current version”
Step-by-step guide: how to use EdgeOne ClawScan Security CheckInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    edgeone-clawscan.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip edgeone-clawscan.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip edgeone-clawscan.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Set AIG_CLOUD_LOOKUP=off for a fully local, zero-outbound scan if you have privacy or policy concerns.
  • Verify that `which openclaw` points to the genuine OpenClaw binary before running the live probe, and run the --deep probe only in an isolated or test environment.
  • Check the publisher against the official GitHub repo (Tencent/AI-Infra-Guard) before trusting cloud verdicts, since registry owner labels may differ from the author field.

What's inside

  • SKILL.md

Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.