--- name: pincer-3961d67b78e1 description: Security-first wrapper for installing agent skills. Scans for malware, prompt injection, and suspicious patterns before installation. Use instead of `clawhub install` for safer skill management. homepage: https://github.com/panzacoder/pincer metadata: openclaw: emoji: "๐Ÿฆž" requires: bins: ["pincer"] install: - id: symlink kind: script label: "Install pincer to PATH" script: | chmod +x "${SKILL_DIR}/scripts/pincer.sh" mkdir -p ~/.local/bin ln -sf "${SKILL_DIR}/scripts/pincer.sh" ~/.local/bin/pincer echo "" echo "โœ… pincer installed!" echo "" echo "Make sure ~/.local/bin is in your PATH:" echo ' export PATH="$HOME/.local/bin:$PATH"' echo "" echo "Usage:" echo " pincer install # Safe install with scanning" echo " pincer scan # Scan without installing" echo " pincer audit # Scan all installed skills" echo "" --- # pincer ๐Ÿ›ก๏ธ Security-first wrapper for `clawhub install`. Scans skills for malware, prompt injection, and suspicious patterns before installation. ## Why? Agent skills are powerful โ€” they're basically executable documentation. The ClawHub ecosystem has already seen [malware campaigns](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/) distributing infostealers via innocent-looking skills. pincer adds a security layer before you install anything. ## Install ```bash # From ClawHub clawhub install pincer # Or manually chmod +x ./scripts/pincer.sh ln -sf "$(pwd)/scripts/pincer.sh" ~/.local/bin/pincer ``` **Dependencies:** - `clawhub` โ€” for fetching skills - `uvx` โ€” for mcp-scan (`brew install uv`) - `jq` โ€” for JSON parsing ## Usage ### Safe Install ```bash # Instead of: clawhub install some-skill pincer install some-skill # With specific version pincer install some-skill@1.2.0 ``` ### Scan Without Installing ```bash # Scan a ClawHub skill pincer scan some-skill # Scan a local directory pincer scan ./path/to/skill # JSON output for automation pincer scan some-skill --json ``` ### Audit Installed Skills ```bash # Quick-scan all installed skills pincer audit # JSON output pincer audit --json ``` ### Manage Trust ```bash # Add trusted publisher (auto-approve clean skills) pincer trust add steipete # Remove from trusted pincer trust remove old-publisher # Block a publisher or skill pincer trust block suspicious-dev pincer trust block malware-skill # Unblock pincer trust unblock redeemed-dev # List all trust settings pincer trust list ``` ### View History ```bash # See what you've installed pincer history # JSON output pincer history --json ``` ### Configuration ```bash # Show current config pincer config show # Edit in $EDITOR pincer config edit # Reset to defaults pincer config reset ``` ## What It Checks ### Via mcp-scan (Invariant Labs) - Prompt injection attacks - Malware payloads in natural language - Tool poisoning - Sensitive data exposure - Hard-coded secrets ### Additional Pattern Detection | Pattern | Risk | Description | |---------|------|-------------| | Base64 commands | ๐Ÿšจ High | Encoded shell commands | | Hex payloads | ๐Ÿšจ High | Obfuscated binary data | | `xattr -d quarantine` | ๐Ÿšจ High | macOS Gatekeeper bypass | | `curl \| sh` | ๐Ÿšจ High | Pipe to shell execution | | Password archives | ๐Ÿšจ High | Hidden malicious payloads | | Download + execute | โš ๏ธ Medium | `chmod +x && ./` patterns | | `eval $var` | โš ๏ธ Medium | Dynamic code execution | | Hidden files | โš ๏ธ Medium | Dot-file creation | | Persistence | โš ๏ธ Medium | cron/launchd entries | ### Publisher & Provenance - Publisher reputation (trusted list) - Download count threshold - Skill age threshold - Blocklist checking ### Binary Detection - Scans for bundled executables - Flags Mach-O, ELF, PE32 binaries ## Risk Levels | Level | Meaning | Action | |-------|---------|--------| | โœ… **CLEAN** | No issues | Auto-approve if trusted publisher | | โš ๏ธ **CAUTION** | Warnings present | Prompt for approval | | ๐Ÿšจ **DANGER** | Suspicious patterns | Block (override with `--force`) | | โ˜ ๏ธ **MALWARE** | Known malicious | Block (cannot override) | | โ›” **BLOCKED** | On blocklist | Block (cannot override) | ## Configuration Config: `~/.config/pincer/config.json` ```json { "trustedPublishers": ["openclaw", "steipete", "invariantlabs-ai"], "blockedPublishers": [], "blockedSkills": [], "autoApprove": "clean", "logInstalls": true, "minDownloads": 0, "minAgeDays": 0 } ``` | Key | Description | |-----|-------------| | `trustedPublishers` | Publishers whose clean skills auto-approve | | `blockedPublishers` | Always block these publishers | | `blockedSkills` | Always block these specific skills | | `autoApprove` | `"clean"` = auto-approve clean+trusted, `"never"` = always prompt | | `logInstalls` | Log installations to history file | | `minDownloads` | Warn if skill has fewer downloads | | `minAgeDays` | Warn if skill is newer than N days | ## Examples ### Clean Install ``` $ pincer install bird ๐Ÿ›ก๏ธ pincer v1.0.0 โ†’ Fetching bird from ClawHub... Publisher: steipete (trusted) Stats: 7363 downloads ยท 27 โ˜… ยท created 1 month ago ๐Ÿ›ก๏ธ pincer Scanning bird... โ†’ Running mcp-scan... โœ… mcp-scan: passed โ†’ Checking for suspicious patterns... โœ… Pattern check: passed โ†’ Checking external URLs... โœ… URL check: passed โ†’ Checking for bundled binaries... โœ… Binary check: passed Risk Assessment: โœ… CLEAN โ€” No issues detected โ†’ Auto-approved (clean + trusted config). โ†’ Installing bird... โœ… Installed successfully! ``` ### Dangerous Skill Blocked ``` $ pincer install sketchy-tool ๐Ÿ›ก๏ธ pincer v1.0.0 โ†’ Fetching sketchy-tool from ClawHub... Publisher: newaccount (unknown) Stats: 12 downloads ยท 0 โ˜… ยท created 2 days ago ๐Ÿ›ก๏ธ pincer Scanning sketchy-tool... โ†’ Running mcp-scan... ๐Ÿšจ mcp-scan: high-risk warnings โ†’ Checking for suspicious patterns... ๐Ÿšจ Pattern check: suspicious patterns found โ€ข curl/wget piped to shell โ€ข macOS quarantine removal (xattr) โ†’ Checking external URLs... โš ๏ธ URL check: external URLs found โ€ข http://sketchy-domain.xyz/install โ†’ Checking for bundled binaries... โœ… Binary check: passed Risk Assessment: ๐Ÿšจ DANGER โ€” Suspicious patterns detected โ€ข mcp-scan: high-risk patterns detected โ€ข curl/wget piped to shell โ€ข macOS quarantine removal (xattr) โ˜ ๏ธ Install blocked. Use --force to override (not recommended). ``` ## Credits - [mcp-scan](https://github.com/invariantlabs-ai/mcp-scan) by Invariant Labs โ€” core security scanning - [1Password Security Research](https://1password.com/blog/from-magic-to-malware-how-openclaws-agent-skills-become-an-attack-surface) โ€” threat analysis that inspired this tool - [Snyk ToxicSkills Report](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/) โ€” ecosystem threat research ## License MIT --- **Stay safe out there.** ๐Ÿ›ก๏ธ --- Source attribution: kbarbel640-del Original project: https://github.com/kbarbel640-del/skills/blob/e7e336ac628c3e3bd771aff1aaa469c93778f94a/skills/panzacoder/pincer/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 clawdbot Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: kbarbel640-del Original project: https://github.com/kbarbel640-del/skills/blob/e7e336ac628c3e3bd771aff1aaa469c93778f94a/skills/panzacoder/pincer/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: DevOps / SRE, Security Engineer Specialties: Specialty not specified Tools: Clawhub, Jq, Uvx Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 4c2f202cecdbefd4c6708aaef2706b14f4d293bbd8d6e9653bb66eb1e4264497