flaw0_skill

Overview

This skill is a security and vulnerability scanner tailored for OpenClaw projects, plugins, skills, and Node.js dependencies. It combines pattern-based checks with OpenClaw AI models to detect code flaws, dependency CVEs, and risky patterns. The goal is to help teams reach and maintain a "flaw 0" security score through actionable findings and suggested fixes.

How this skill works

flaw0 scans source files and dependency trees using fast pattern matching, then enriches findings with AI-powered context analysis to reduce false positives and provide remediation steps. It integrates npm audit and CVE databases for dependency issues, weights findings by severity, and computes a cumulative flaw score. Results can be exported as JSON for CI/CD gates or reviewed interactively in the terminal.

When to use it

• Before installing third-party skills or plugins to verify safety
• During development to catch injections, hardcoded secrets, and unsafe APIs early
• As a pre-commit or CI step to prevent regressions and enforce security thresholds
• Before releasing or deploying to validate dependencies and configuration
• When auditing an entire OpenClaw installation (core, plugins, and skills)

Best practices

• Fix critical and high-severity issues immediately; they have largest score impact
• Run both code and dependency scans; some vulnerabilities appear only in package trees
• Use configuration file to ignore noisy patterns and set acceptable flaw score
• Integrate scans into CI with JSON output to block builds above threshold
• Validate AI suggestions manually and apply recommended fixes in code reviews

Example use cases

• Scan a downloaded skill before installing: fl aw0 scan /tmp/some-skill
• Run full project audit and save report for compliance: flaw0 audit --output report.json
• Automate security gate in GitHub Actions to fail on non-zero flaw score
• Check dependencies after package updates with flaw0 deps --deep
• Periodic maintenance scan across all installed OpenClaw skills and plugins