Agent skill · security · bighardperson
flaw0
Security and vulnerability scanner for OpenClaw code, plugins, skills, and Node.js dependencies. Powered by OpenClaw AI models.
Why this skill is useful
Adds executable scripts for comprehensive security scanning and auditing of OpenClaw code and dependencies that aren't available in public documentation.
What it needs
Requires npm installed locally. About 7k tokens when loaded. Last updated 2026-04-26. 34 stars on the source repository.
What this skill does
flaw0 - Zero Flaws Security Scanner Security and vulnerability scanner for OpenClaw ecosystems. Analyzes source code, plugins, skills, and Node.js dependencies to detect potential security flaws. Goal: Achieve flaw 0 (zero flaws detected) 🎯 Installation Install this skill via ClawHub: Or install globally via npm: When to Use This Skill Use flaw0 to ensure your OpenClaw code and dependencies are secure: Before Installing Skills During Development Before Committing Auditing OpenClaw Installation Usage Basic Commands Scan Code Check Dependencies Full Security Audit Scan OpenClaw Components What flaw0 Detects Code Vulnerabilities (12+ Types) 1. Command Injection exec() with unsanitized input Shell command construction with user input 2. Code Injection eval() usage Function() constructor with strings 3. SQL Injection String concatenation in SQL queries Unparameterized queries 4. Cross-Site Scripting (XSS) innerHTML assignments dangerouslySetInnerHTML usage 5. Path Traversal Unvalidated file path operations readFile() with user input 6. Hardcoded Secrets API keys in source code Passwords and tokens AWS credentials 7. Weak Cryptography MD5 and SHA1 usage Weak hashing algorithms 8. Insecure Randomness Math.random() for security operations Predictable token generation 9. Unsafe Deserialization JSON.parse() without validation Unvalidated input parsing 10. Missing Authentication API endpoints without auth middleware Unprotected routes Dependency Issues 1. Known CVEs - Vulnerabilities from CVE database 2. Outdated Packages - Packages with security updates available 3. Malicious Packages - Known malware or suspicious packages 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills bighardperson/og-openclawguard