name: heimdall description: Security scanner for AI agent skills. Scan OpenClaw skills for malicious patterns before installation. metadata: {"clawdbot":{"emoji":"🔒","requires":{"bins":["python3"]},"install":[]}}
Heimdall - Security Scanner for AI Agent Skills
Scan OpenClaw skills for malicious patterns before installation. Context-aware scanning with AI-powered narrative analysis.
Commands
Basic Scan
~/clawd/skills/heimdall/scripts/skill-scan.py /path/to/skill
AI-Powered Analysis
~/clawd/skills/heimdall/scripts/skill-scan.py --analyze /path/to/skill
Scan from URL
# Auto-scan before install (via wrapper)
openclaw skill-install-safe https://github.com/user/skill
What It Detects
- 🚨 Critical: credential_access, network_exfil, shell_exec, remote_fetch
- 🔴 High: supply_chain, telemetry, crypto_wallet, impersonation
- ⚠️ Medium: prefill_exfil, persistence
Pre-Install Protection
A wrapper script openclaw skill-install-safe is available that:
- Downloads/clones the skill to temp
- Runs Heimdall security scan
- Only installs if scan passes
- Auto-blocks critical/high risk skills