Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/opencue/cuecards/clawsec-scannernpx skills add opencue/cuecards --skill clawsec-scannergit clone --depth 1 https://github.com/opencue/cuecardsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/opencue/cuecards/clawsec-scanner)<a href="https://agentmods.dev/skills/opencue/cuecards/clawsec-scanner"><img src="https://agentmods.dev/badge/skills/opencue/cuecards/clawsec-scanner.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00066 | $0.04128 |
| Opus 5 | $0.00033 | $0.02064 |
| Sonnet 5 | $0.00013 | $0.00826 |
| Haiku 4.5 | $0.00007 | $0.00413 |
Grade B, and why
clawsec-scanner scanned grade B with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 "$DEST/skill.json" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
trap 'rm -rf "$TEMP_DIR"' EXIT Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
bins: [node, npm, python3, pip-audit, semgrep, bandit, jq, curl] Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
import { spawn } from 'node:child_process'; How it starts
The opening of the file, as written. The whole thing — 498 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ClawSec Scanner
Comprehensive security scanner for agent platforms that automates vulnerability detection across multiple dimensions:
- Dependency Scanning: Analyzes npm and Python dependencies using
npm auditandpip-auditwith structured JSON output parsing - CVE Database Integration: Queries OSV (primary), NVD 2.0, and GitHub Advisory Database for vulnerability enrichment
- SAST Analysis: Static code analysis using Semgrep (JavaScript/TypeScript) and Bandit (Python) to detect hardcoded secrets, command injection, path traversal, and unsafe deserialization
- DAST Framework: Agent-specific dynamic analysis with real OpenClaw hook execution harness (malicious input, timeout, output bounds, event mutation safety)
- Unified Reporting: Consolidated vulnerability reports with severity classification and remediation guidance
- Continuous Monitoring: OpenClaw hook integration for automated periodic scanning
Features
Multi-Engine Scanning
The scanner orchestrates four complementary scan types to provide comprehensive vulnerability coverage:
-
Dependency Scanning
- Executes
npm audit --jsonandpip-audit -f jsonas subprocesses - Parses structured output to extract CVE IDs, severity, affected versions
- Handles edge cases: missing package-lock.json, zero vulnerabilities, malformed JSON
- Executes
-
CVE Database Queries
- OSV API (primary): Free, no authentication, broad ecosystem support (npm, PyPI, Go, Maven)
- NVD 2.0 (optional): Requires API key to avoid 6-second rate limiting
- GitHub Advisory Database (optional): GraphQL API with OAuth token
- Normalizes all API responses to unified
Vulnerabilityschema
-
Static Analysis (SAST)
- Semgrep for JavaScript/TypeScript: Detects security issues using
--config autoor--config p/security-audit - Bandit for Python: Leverages existing
pyproject.tomlconfiguration - Identifies: hardcoded secrets (API keys, tokens), command injection (
eval,exec), path traversal, unsafe deserialization
- Semgrep for JavaScript/TypeScript: Detects security issues using
What ships with it
24 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- CHANGELOG.md 1.5 KB
- hooks/.gitkeep 0 B
- hooks/clawsec-scanner-hook/handler.ts 9.3 KB runs code
- hooks/clawsec-scanner-hook/HOOK.md 3.6 KB
- lib/.gitkeep 0 B
- lib/report.mjs 8.0 KB runs code
- lib/types.ts 923 B runs code
- lib/utils.mjs 3.5 KB runs code
- scripts/.gitkeep 0 B
- scripts/dast_hook_executor.mjs 6.4 KB runs code
- scripts/dast_runner.mjs 20 KB runs code
- scripts/query_cve_databases.mjs 8.7 KB runs code
- scripts/runner.sh 9.3 KB runs code
- scripts/sast_analyzer.mjs 8.4 KB runs code
- scripts/scan_dependencies.mjs 9.9 KB runs code
- scripts/setup_scanner_hook.mjs 3.7 KB runs code
- skill.json 3.6 KB
- test/.gitkeep 0 B
- test/cve_integration.test.mjs 18 KB runs code
- test/dast_harness.test.mjs 7.0 KB runs code
- test/dependency_scanner.test.mjs 18 KB runs code
- test/lib/test_harness.mjs 2.4 KB runs code
- test/reviewer_regressions.test.mjs 7.4 KB runs code
- test/sast_engine.test.mjs 17 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 498 lines · 66 tokens per session scan B b1af8227bf95
clawsec-scanner is a skill published in the GitHub repository opencue/cuecards (5 stars, last pushed yesterday), licensed MIT. It adds 66 tokens to every session and 4,128 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 4 findings (asks for root, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-conventions
Project-wide coding standards for naming, formatting, error handling, security, and testing. Load this when writing or reviewing code. Covers all layers (files, functions, classes, constants, database columns) and languages in use. Do not duplicate these rules in agent prompts — load this skill instead.
crudcraft
Use when building or editing a small database-backed web app in ANY stack — plain PHP, Laravel, or Supabase, on MySQL/MariaDB, PostgreSQL, SQLite, SQL Server, or a hosted DB — scaffolding a project, creating or evolving a database, designing tables or writing SQL, adding login/registration or user roles, building a…
agency-backend-architect
Senior backend architect specializing in scalable system design, database architecture, API development, and cloud infrastructure. Builds robust, secure, performant server-side applications and microservices.
agency-database-optimizer
Expert database specialist focusing on schema design, query optimization, indexing strategies, and performance tuning for PostgreSQL, MySQL, and modern databases like Supabase and PlanetScale.
agency-database-reliability-engineer
Expert database reliability engineer (DBRE) — high availability and replication, automated failover, backup and point-in-time recovery, zero-downtime online schema migrations, connection pooling, and disaster-recovery drills. Focused on keeping data safe and available, not query tuning.
agency-drupal-performance-engineer
Expert Drupal 10/11 performance engineer specializing in Core Web Vitals, render and dynamic page caching, BigPipe, cache tags and contexts, database query and Views optimization, CSS/JS aggregation, responsive images and lazy loading, CDN integration, and opcache/PHP-FPM tuning for fast, audit-passing sites.