skill-scanner

# Skill Scanner Use this skill for pre-submit scanning and validation of AgentSkills. ## Prime directive Do not call a skill ready until both gates have been attempted: 1. **Skill structure gate** — `openclaw skills check` and/or `package_skill.py` validation. 2. **Security scan gate** — `codeql-sdk` / `clawhub-audit` scan. If CodeQL CLI is missing, report that as a blocker and give the exact install/rerun command. If CodeQL runs but reports no analyzable source code, mark the security scan as `not applicable`, not passed. Do not silently replace the scan with weaker checks. ## Default local paths - SDK repo: `/Users/buns/Documents/GitHub/BunsDev/codeql-sdk` - SDK CLI source: `/Users/buns/Documents/GitHub/BunsDev/codeql-sdk/dist/cli.js` - Skill creator package validator: `~/.nvm/versions/node/v24.13.0/lib/node_modules/openclaw/skills/skill-creator/scripts/package_skill.py` - Workspace skills root: `/Users/buns/.openclaw/workspace/skills` Read `references/codeql-sdk.md` for CLI details, report formats, and troubleshooting. ## Standard scan workflow Given a skill directory: ```bash SKILL_DIR=/absolute/path/to/skill REPORT_DIR="$(dirname "$SKILL_DIR")/.scan-reports/$(basename "$SKILL_DIR")" mkdir -p "$REPORT_DIR" ``` 1. Preflight: ```bash test -f "$SKILL_DIR/SKILL.md" node /Users/buns/Documents/GitHub/BunsDev/codeql-sdk/dist/cli.js version command -v codeql || test -x "$CODEQL_PATH" ``` 2. Validate structure: ```bash openclaw skills check python3 ~/.nvm/versions/n...