ClawVet

clawvet

Safety linter for OpenClaw skills. Analyzes skills for issues before installation.

Usage

Scan a local skill:

npx clawvet scan ./skill-folder/

JSON output for CI/CD:

npx clawvet scan ./skill-folder/ --format json

Audit all installed skills:

npx clawvet audit

Watch mode — auto-block risky installs:

npx clawvet watch --threshold 50

Report a bug or send feedback (opens a prefilled GitHub issue):

npx clawvet feedback

Analysis Passes

1. Skill Parser — Extracts YAML frontmatter, code blocks, URLs, and domains
2. Static Analysis — 57 pattern rules across multiple categories
3. Metadata Validator — Checks for undeclared binaries, env vars, missing descriptions
4. Dependency Checker — Flags auto-install and global package installs
5. Typosquat Detector — Levenshtein distance against popular skill names
6. Semantic Analysis — AI-powered contextual analysis (optional; bring your own Anthropic, OpenAI, Zhipu, or local Ollama key)

What's New in v0.9

• Prompt-injection hardening — a scanned skill can no longer talk its way past the AI analysis pass; an override attempt is now reported as a finding.
• Signed releases — the npm package ships with provenance, so you can verify it was built from this repo (npm audit signatures).
• 57 detection patterns across 13 categories.

What's New in v0.7–v0.8

• Cross-file payload assembly (0.8.0) — folder scans now assemble files referenced from SKILL.md (e.g. a setup.sh) before analysis, so a payload split across multiple files can no longer evade detection.
• Robust semantic parsing (0.8.0) — semantic analysis correctly parses LLM responses wrapped in markdown code fences.
• Path-traversal hardening (0.7.0) — --remote slugs are validated and URL-encoded before fetching from ClawHub.
• Grade summaries (0.7.0) — audit prints a final grade summary and flags D/F skills for review; risk scores are rounded to integers.
• Shell-free CLI (0.7.2) — replaced exec() in feedback/scan --subscribe with a shell-free execFile opener.
• Privacy-preserving telemetry (0.7.2–0.7.3) — skill names are SHA-256 hashed before sending; audit emits a session-level completion event. Still opt-in.
• Accurate skill naming (0.7.1) — skills with no name in frontmatter report the containing folder name instead of unknown.

What's New in v0.6

• Reliable telemetry — Telemetry now awaits before exit, so no data is lost.
• CI-safe — Opt-in prompt is skipped in non-TTY environments (piped stdin, CI).
• Less noise — Feedback CTA shows every 5th scan instead of every scan.
• Trust badges — Generate trust badges for skill READMEs with npx clawvet badge.
• Ban lists — Block skills by name/author/slug via .clawvetban files.
• Confidence scores — Each finding shows a confidence percentage. Risk scores are weighted accordingly.
• Fix suggestions — Every finding includes an actionable remediation in terminal and SARIF output.
• Content-hash caching — Repeat scans of unchanged files are near-instant.
• Trust badges — Run npx clawvet badge ./skill/ to generate a shields.io trust badge for your README.
• Ban list — Create a .clawvetban file to block skills by name, author, or slug.
• Feedback — Run npx clawvet feedback to open a prefilled GitHub issue.

Note on Monorepo

The clawvet npm package contains only the CLI scanner (packages/cli + packages/shared). It is a stateless tool with no databases, no authentication, and no network access by default. The repository also contains an optional web dashboard (apps/api + apps/web) for self-hosted deployments — these are NOT included in the npm package.

Risk Grades