Does a scanner prove an agent skill is safe?
No. Scanner output is a trust signal, not a certification. Skills touching customer data, production systems, or external accounts still need human review and guardrails.
Comparison
Security scanners for OpenClaw and CLAW skill repositories
Agent skills can automate powerful actions. Review manifests, scripts, permissions, dependencies, and source before trusting them.
What to review
Skill review should focus on what the package can access and what code it can execute.
- Manifest permissions
- Scripts and automation behavior
- Secrets and environment access
- Vulnerable dependencies
- Unexpected network behavior
Questions and answers
Security references
CyberLens AI guidance is informed by established security standards and public vulnerability intelligence.
- OWASP Top 10: Common web application security risks used as a baseline reference.
- OWASP Application Security Verification Standard: Application security verification guidance for web application controls.
- NIST Cybersecurity Framework: Cybersecurity risk management guidance from NIST.
- CISA Known Exploited Vulnerabilities Catalog: Known exploited vulnerability intelligence for prioritization context.