ClawScan— Review, Pricing, Alternatives

Description

ClawScan is a security scanner for OpenClaw skills. It detects prompt injection, credential stealers, reverse shells, invisible unicode attacks — in one command. It has found 341+ malicious skills on ClawHub. It analyzes SKILL.md and scripts to detect 10 categories of prompt injection, including role hijacking, instruction override, authority spoofing, invisible unicode, hidden comment attacks, data exfiltration prompts, privilege escalation, and conversation manipulation. It also analyzes fake prerequisites, hidden markdown commands, external binary links, and suspicious content in SKILL.md. Scripts are analyzed for reverse shells, download-and-execute chains, persistence mechanisms, and eval/exec abuse. Network detection includes blocklisted IPs/CIDRs, Discord/Telegram webhook exfiltration, and suspicious TLDs. Credential scanning looks for SSH keys, browser cookies, API tokens, OpenClaw configs, and hardcoded secrets. Obfuscation is detected via base64+exec payloads, hex encoding, minified code, and suspicious string lengths. Typosquatting is checked by Levenshtein distance against top skills. The process is: point it at a skill (local path or URL), get a combined score (e.g., exec() alone = fine; exec() + credential theft + webhook = 🔴 DANGEROUS), and receive a verdict (🟢 Safe · 🟡 Warning · 🔴 Dangerous) with explanations for each finding. It is available as an OpenClaw skill installable with one command (`openclaw skill install clawscan`) and offers 24 OpenClaw-specific checks covering config, files, skills, and network exposure, with an A-F grading system. Pro and Managed versions are available with additional features.