ClawScan scans OpenClaw skill files for reverse shells, credential theft, remote code execution and 50+ other threats — in your browser, before you ever hit run.
Unlimited scans · Runs locally · No data uploaded
OpenClaw skills can read files, run commands, and make network requests. That power is exactly why bad actors hide malware in them.
ClawScan analyzes every line of skill code against 50+ hand-crafted security rules — flagging dangerous patterns before you execute anything.
Upload files, paste code, or drop in a ZIP bundle. Results are instant. Everything runs in your browser — your code never leaves your machine.
Real threat patterns found in real skills. These aren't hypothetical — they're the exact code signatures ClawScan flags every scan.
Drop skill files, ZIP bundles, SKILL.md, bash or Python scripts — or paste code directly. Any file format OpenClaw skills use.
ClawScan runs all 50+ security rules across every byte simultaneously. Obfuscation, network calls, system access — all checked at once.
Get a clear verdict — Safe, Warning, or Malicious — with every finding explained in plain English and specific steps to remediate.
per month · cancel anytime
Secure checkout via Stripe · 256-bit SSL
Cancel anytime from your billing portal
No. ClawScan runs entirely in your browser using JavaScript. Your skill files and code are never uploaded, transmitted, or stored anywhere. Analysis happens locally on your device — 100% private.
ClawScan accepts any text-based file — SKILL.md, bash scripts (.sh), Python (.py), JavaScript (.js), YAML, JSON, Markdown, and plain text. You can also upload ZIP bundles and ClawScan extracts and scans every file inside.
ClawScan uses pattern-based static analysis — excellent at catching known threat signatures and updated regularly. No scanner catches 100% of novel threats. But ClawScan eliminates the overwhelming majority of real-world attack patterns before they ever execute.
After completing payment via Stripe, you receive immediate access to the ClawScan tool. Scan as many skills as you like throughout your subscription — there are no per-scan limits.
ClawHub doesn't guarantee every skill is safe — it's an open marketplace where anyone can publish. Malicious skills can look completely legitimate until analyzed at the code level. ClawScan is your last line of defense before untrusted code touches your machine.
Yes, anytime, with no fees. Cancel directly from the Stripe billing portal. Cancel before your next billing date and you won't be charged again.
One malicious skill can steal your SSH keys, hand your terminal to a stranger, or wipe your drive. For $2.99 a month, that's not a risk worth taking.
Protect My OpenClaw — $2.99/mo