Skill Scanner

• You are about to install an unfamiliar or community-sourced Clawdbot/MCP skill and want to verify it is safe before it runs on your machine.
• You manage a shared or production Clawdbot instance and need a repeatable audit step before deploying new skills.
• You want a quick, dependency-free CLI check as part of a skill review workflow, with optional Streamlit UI for non-technical team members.
• You suspect an already-installed skill may be behaving unexpectedly and want a structured threat report in Markdown or JSON.

• You need to scan arbitrary binaries, compiled executables, or non-Python/non-skill codebases — this tool is purpose-built for Clawdbot/MCP skill folders.
• You require a certified or enterprise-grade security scanner with CVE databases and signature updates; this tool detects pattern-based threats using the Python standard library only.

Scans skill source code for known malware and spyware patterns, flagging suspicious behaviour before any code is executed on your system.

Identifies code signatures associated with crypto-mining payloads that could silently consume your CPU or GPU resources.

Detects patterns that suggest a skill may be attempting to send data off-device, open remote access channels, or establish backdoors.

Catches obfuscation techniques and dangerous code-execution constructs (e.g. eval, dynamic imports) that are commonly used to hide malicious intent.

Produces audit reports in either human-readable Markdown or machine-parseable JSON, making it easy to review results manually or pipe them into other tools.

Runs out of the box with Python 3.7+ and no extra packages. An optional Streamlit-powered Web UI is available for a point-and-click scanning experience.

Before installing a new community skill, point Skill Scanner at the downloaded skill folder to get a full threat report. Catch problems before any code touches your environment.

Ask Clawdbot directly — e.g. "Scan the youtube-watcher skill for security issues using skill-scanner" — and receive a structured report without leaving your chat interface.

Non-technical team members can use the Streamlit UI to browse skill folders and review scan results through a visual interface, without needing command-line access.

Invoke skill_scanner.py from a script or CI step and consume the JSON output programmatically to gate skill deployments on a shared or production Clawdbot instance.