---

name: ClawSkillShield 🛡️ description: Pure Python. No network calls. Runs entirely locally.

ClawSkillShield 🛡️

Local-first security scanner for OpenClaw/ClawHub skills.

What It Does

• Static analysis for security risks and malware patterns
• Detects:
  • Hardcoded secrets (API keys, credentials, private keys)
  • Risky imports (os, subprocess, socket, ctypes)
  • Dangerous calls (eval(), exec(), open())
  • Obfuscation (base64 blobs, suspicious encoding)
  • Hardcoded IPs
• Risk scoring (0–10) + detailed threat reports
• Quarantine high-risk skills automatically

Dual-Use Design

• CLI for humans: Quick safety checks before installing skills
• Agent API: Importable functions for autonomous agents/Moltbots to proactively scan and quarantine risky skills (essential post-ClawHavoc)

Quick Start

CLI (Humans)

pip install -e .
clawskillshield scan-local /path/to/skill
clawskillshield quarantine /path/to/skill

Python API (Agents)

from clawskillshield import scan_local, quarantine

threats = scan_local("/path/to/skill")
if risk_score < 4:  # HIGH RISK
    quarantine("/path/to/skill")

Zero Dependencies

Pure Python. No network calls. Runs entirely locally.

Why This Matters

ClawHavoc demonstrated how easily malicious skills can slip into the ecosystem. ClawSkillShield provides a trusted, open-source defense layer—audit the code, run offline, stay safe.

---

GitHub: https://github.com/AbYousef739/clawskillshield
License: MIT
Author: Ab Yousef
Contact: contact@clawskillshield.com

Skill Library MCP

15,000+ ready-to-use skills for AI coding assistants, served on demand via MCP.

An MCP server that provides on-demand skill loading for AI coding assistants. Instead of stuffing your system prompt with every skill you might need, this server indexes 15,000+ skills and serves only the ones relevant to your current task — keeping context windows lean and responses focused.

Documentation

Full documentation is at modbender.in/skill-library-mcp — installation, the tools it exposes, configuration, and examples.

Why?

• 15,000+ skills covering frontend, backend, DevOps, security, testing, databases, AI/ML, automation, and more
• On-demand loading — skills are fetched only when needed, not crammed into every conversation
• IDF-weighted search — finds the right skill even from natural language queries like "help me debug a memory leak"
• Browse by category — 13 categories to discover skills you didn't know existed
• Works with any MCP-compatible tool — Claude Code, Cursor, Windsurf, VS Code, Claude Desktop, and others
• Claude Code plugin — one-command install with claude plugin install
• Zero config — run with npx, no setup needed

Quick Start

Claude Code Plugin (Recommended)

Add the marketplace source, then install the plugin:

claude plugin marketplace add https://github.com/modbender/skill-library-mcp.git --scope user
claude plugin install skill-library --scope user

The MCP server starts automatically when Claude Code launches. No manual configuration needed.

Claude Code (MCP Server)

claude mcp add skill-library --scope user -- npx -y skill-library-mcp

MCP Server (Other Tools)

Add to your claude_desktop_config.json (location varies by OS):

{
  "mcpServers": {
    "skill-library": {
      "command": "npx",
      "args": ["-y", "skill-library-mcp"]
    }
  }
}

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "skill-library": {
      "command": "npx",
      "args": ["-y", "skill-library-mcp"]
    }
  }
}

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "skill-library": {
      "command": "npx",
      "args": ["-y", "skill-library-mcp"]
    }
  }
}

Add to .vscode/mcp.json:

{
  "servers": {
    "skill-library": {
      "command": "npx",
      "args": ["-y", "skill-library-mcp"]
    }
  }
}

git clone https://github.com/modbender/skill-library-mcp
cd skill-library-mcp
pnpm install
pnpm build

Then point your MCP config to the built binary:

{
  "mcpServers": {
    "skill-library": {
      "command": "node",
      "args": ["/path/to/skill-library-mcp/dist/index.js"]
    }
  }
}

Tools

search_skill

Search for skills by keyword. Returns a ranked list of matching skill names and descriptions.

search_skill({ query: "react patterns" })

load_skill

Load the full content of a skill by name. Optionally includes resource files.

load_skill({ name: "brainstorming", include_resources: true })

list_categories

Browse all skill categories with counts and examples. Use to discover skills before searching.

list_categories()

Skill Categories

The library includes 15,000+ skills across 13 categories:

Category	Examples
Frontend	React patterns, Angular, Vue, Svelte, Next.js, Tailwind, accessibility
Backend	Node.js, FastAPI, Django, NestJS, Express, GraphQL, REST API design
AI & LLM	LLM app dev, RAG implementation, agent patterns, prompt engineering, embeddings
DevOps & Infra	Terraform, Kubernetes, Docker, AWS, GCP, Azure, CI/CD
Data & Databases	PostgreSQL, MongoDB, Redis, SQL optimization, ETL pipelines, analytics
Security	Penetration testing, OWASP, threat modeling, vulnerability scanning, encryption
Testing	TDD workflows, Playwright, Vitest, Jest, E2E testing patterns
Mobile	React Native, Flutter, iOS, Android, Expo
Automation	Workflow automation, n8n, Zapier, web scraping, bots
Python	Django, Flask, FastAPI, pandas, Python tooling
TypeScript & JS	TypeScript, JavaScript, Deno, Bun
Architecture	Microservices, system design, design patterns, monorepos
Other	Hundreds of specialized and niche skills

Skill Format

Skills are directories containing a SKILL.md file with YAML frontmatter:

---
name: my-skill
description: What this skill does
---

# My Skill

Skill content here...

Skills can optionally include a resources/ directory with additional .md files that are appended when include_resources: true is set.

Contributing

Contributions are welcome! To add a new skill:

1. Create a directory under data/ with your skill name
2. Add a SKILL.md file with YAML frontmatter (name, description)
3. Run pnpm dedup to check for duplicates
4. Submit a PR

Development

pnpm install          # Install dependencies
pnpm test             # Run tests
pnpm build            # Build to dist/
pnpm dev              # Run server locally
pnpm dedup            # Check for duplicate skills
pnpm validate-skills  # Validate data/ directory structure
pnpm fix-skills       # Fix broken skills (dry run by default)
pnpm clean-skills     # Remove invalid skill dirs (dry run by default)
make ci               # Run test + validate + build

Third-Party Content

This project includes skills from openclaw/skills, licensed under the MIT License. See THIRD_PARTY_NOTICES.md for details.

License

MIT