Passed 19 of 21 test cases with the skill, and 8 of 21 without it.
Without skill36%
With skill91%
Checks it passed that the model alone missed
Specifies `CLAWSEC_NVD_API_KEY`
Applies `chmod 600` to `skill.json`
Specifies `CLAWSEC_SCANNER_INTERVAL`
and 10 more in the full report
12 fixed8 passed either way2 still failing0 broke
Pass-rate lift
+55 pp
Tokens
+232%
Agent turns
0%
Response time
-53%
Model gemini-3.6-flashMeasured 8/16/2026v120 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 12
Prompt
We want to install ClawSec Scanner using the Vercel Skills CLI non-interactively for the OpenClaw agent runtime. What exact terminal command should be executed?
What was checked, without and with the skill
Checked
Without skill
With skill
Executes `npx skills add prompt-security/clawsec --skill clawsec-scanner -a openclaw -y`
Missed
Passed
case-11 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md494 lines9 filesincludes scripts
ClawSec Scanner
Comprehensive security scanner for agent platforms that automates vulnerability detection across multiple dimensions:
Dependency Scanning: Analyzes npm and Python dependencies using npm audit and pip-audit with structured JSON output parsing
CVE Database Integration: Queries OSV (primary), NVD 2.0, and GitHub Advisory Database for vulnerability enrichment
SAST Analysis: Static code analysis using Semgrep (JavaScript/TypeScript) and Bandit (Python) to detect hardcoded secrets, command injection, path traversal, and unsafe deserialization
DAST Framework: Agent-specific static analysis of OpenClaw hook metadata and handler source without importing or invoking target code
Unified Reporting: Consolidated vulnerability reports with severity classification and remediation guidance
Continuous Monitoring: OpenClaw hook integration for automated periodic scanning
Vercel Skills Installation
Install with the Vercel Skills CLI for this harness:
npx skills add prompt-security/clawsec --skill clawsec-scanner -a openclaw -y
Features
Multi-Engine Scanning
The scanner orchestrates four complementary scan types to provide comprehensive vulnerability coverage:
Dependency Scanning
Executes npm audit --json and pip-audit -f json as subprocesses
Parses structured output to extract CVE IDs, severity, affected versions
Handles edge cases: missing package-lock.json, zero vulnerabilities, malformed JSON
CVE Database Queries
OSV API (primary): Free, no authentication, broad ecosystem support (npm, PyPI, Go, Maven)
NVD 2.0 (optional): Requires API key to avoid 6-second rate limiting
GitHub Advisory Database (optional): GraphQL API with OAuth token
Normalizes all API responses to unified Vulnerability schema
Static Analysis (SAST)
Semgrep for JavaScript/TypeScript: Detects security issues using --config auto or --config p/security-audit
Bandit for Python: Leverages existing pyproject.toml configuration