security-checker_skill

Overview

This skill scans Python skill code for common security risks before publishing to ClawHub. It flags dangerous imports, unsafe functions, hardcoded secrets, and risky file operations. Use it as a pre-publish safety gate to reduce accidental leaks and destructive behaviors.

How this skill works

The scanner performs static analysis of Python files to detect patterns like os/subprocess/socket imports, calls to eval/exec, and use of subprocess APIs. It also heuristically searches for likely hardcoded secrets, absolute paths, and parent-directory traversal. Results are presented as pass, warning, or possible secret with file and line references for manual review.

When to use it

• Before publishing any skill to ensure no obvious security issues are included
• As part of a pre-commit or CI pipeline to prevent unsafe code from entering the repo
• When auditing third-party or archived skills before installation or distribution
• After major refactors to catch newly introduced risky patterns
• Before sharing code publicly to avoid leaking secrets or system access

Best practices

• Run the scanner on the whole skill directory and address warnings before publishing
• Never hardcode API keys or passwords; load them from environment variables at runtime
• Replace eval/exec with safe parsing libraries (e.g., json) and avoid shell command APIs
• Document why any flagged risky usage is necessary directly in the code comments
• Combine static scanning with manual review and isolated runtime testing

Example use cases

• Scan a single Python file or entire skill folder before publishing
• Add as a pre-commit hook to block commits with detected secrets or dangerous calls
• Automate in a publish script to prevent accidental distribution of unsafe skills
• Audit archived skills before re-publishing or updating them on the platform
• Quickly review third-party contributions for network or system access patterns