security-scanner SKILL.md skillB
security-scanner from ianalloway/openclaw-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add ianalloway/openclaw-skills/security-scanner@git:20261031.825de9ePins git:20261031.825de9e in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- ianalloway/openclaw-skills
- Path
security-scanner/SKILL.md- Versions recorded
- 2
- Latest version
- git:20261031.825de9e, committed Oct 31, 2026
- First version recorded
- Feb 16, 2026
- Size
- 4,252 bytes
- Repository stars
- 4
- License
- MIT
Scan code and dependencies for security vulnerabilities. Check npm audit, pip safety, and common security issues.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Scanner
Scan your projects for security vulnerabilities in dependencies and common code issues.
## Dependency Scanning
### NPM Projects
Check for known vulnerabilities in npm packages:
```bash
npm audit
```
Get JSON output for parsing:
```bash
npm audit --json | jq '{vulnerabilities: .metadata.vulnerabilities, total: .metadata.vulnerabilities.total}'
```
Fix automatically where possible:
```bash
npm audit fix
```
### Python Projects
Check Python dependencies with pip-audit:
```bash
pip install pip-audit && pip-audit
```
Or use safety (requires free API key from https://safetycli.com/):
```bash
pip install safety && safety check
```
Check requirements.txt directly:
```bash
pip-audit -r requirements.txt
```
## Code Security Checks
### Find Hardcoded Secrets
Search for potential API keys and secrets:
```bash
grep -rn "api_key\|apikey\|secret\|password\|token" --include="*.js" --include="*.ts" --include="*.py" --include="*.env" .
```
### Find Dangerous Functions
Check for potentially dangerous code patterns:
```bash
# JavaScript/TypeScript - eval usage
grep -rn "eval(" --include="*.js" --include="*.ts" .
# Python - exec/eval usage
…Read the whole file at its exact version.
How to install
mdr add ianalloway/openclaw-skills/security-scanner@sha256:42c6d3c63d8022f0The line at the top of this page pins the label git:20261031.825de9e, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_3lllafwrzc2kgac5)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Feb 16, 2026 and Oct 31, 2026, about one every 258 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261031.825de9e latest | 2026-10-31 | 825de9e | 4,252 B | B | view · diff |
| git:20260216.48f16b4 | 2026-02-16 | 48f16b4 | 3,859 B | B | view |
Audit of the latest version
- fail: No instruction to read or print local credentials (matched: cat .gitignore | grep -E "\.env)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4252 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
ianalloway/openclaw-skills · 4 stars · license MIT · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_3lllafwrzc2kgac5 GET https://markdownregistry.com/api/v1/resolve?ref=ianalloway/openclaw-skills/security-scanner GET https://markdownregistry.com/api/v1/blob/42c6d3c63d8022f04a499e803d976054f91f528e256f8c6899861f079b2faabd
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from ianalloway/openclaw-skills
Every file in ianalloway/openclaw-skills