A proactive security scanner that identifies malware and install traps within Openclaw Skills before they can compromise your system.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install claw-skill-guard
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install claw-skill-guard using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Claw Skill Guard?
Claw Skill Guard is an essential security utility designed specifically for the ecosystem of Openclaw Skills. As AI agents become more autonomous, the risk of installing malicious scripts via skill repositories increases. This tool provides a vital line of defense by performing static analysis on skill source code and installation manifests to detect harmful patterns like remote code execution or unauthorized credential access.
By incorporating this scanner into your developer workflow, you can safely explore the vast library of Openclaw Skills available on ClawHub or external Git repositories. It acts as an automated auditor, ensuring that every skill you integrate into your workspace meets a baseline of safety and transparency.
Claw Skill Guard Use Cases
- Scanning third-party Openclaw Skills before installation to prevent supply chain attacks.
- Auditing internal skill libraries for accidental inclusion of dangerous shell commands.
- Enforcing security policies within an AI agent's workspace to prevent the execution of untrusted code.
- Pre-screening automated updates to existing Openclaw Skills for new, suspicious patterns.
How Claw Skill Guard Works
- The user provides a target URL or local directory path of the Openclaw Skills they wish to inspect.
- The scanner recursively searches through the skill's files, including SKILL.md and any associated scripts.
- It executes a pattern-matching engine against a library of risk signatures such as obfuscated Base64, sudo commands, and unverified curl pipes.
- The tool checks all external URLs and package dependencies against a configurable allowlist to identify potential data exfiltration points.
- A detailed report is generated, categorizing findings into risk levels from LOW to CRITICAL with a final recommendation on whether to proceed with the installation.
Claw Skill Guard Setup
To begin securing your Openclaw Skills, navigate to the skill directory and use the Python-based scanner:
# Scan a remote skill from a URL
python3 scripts/claw-skill-guard/scanner.py scan https://clawhub.com/user/skill-name
# Scan your current local directory
python3 scripts/claw-skill-guard/scanner.py scan ./
Claw Skill Guard Data Schema & Taxonomy
The skill organizes its security intelligence into several JSON-based pattern files to allow for easy updates as new threats to Openclaw Skills emerge:
| File | Purpose |
|---|---|
patterns/critical.json |
Signatures that trigger an immediate block (e.g., pipe to bash). |
patterns/high.json |
High-risk patterns requiring manual developer approval. |
patterns/medium.json |
Suspicious activity that warrants a thorough code review. |
patterns/allowlist.json |
A list of trusted domains and packages to minimize false positives. |
Claw Skill Guard Advanced Features
- Integration with AGENTS.md to define mandatory security protocols for all Openclaw Skills used by an agent.
- Support for pre-commit hooks to automatically scan Openclaw Skills during the development lifecycle.
- Custom pattern definitions allowing teams to add their own internal security rules and forbidden commands.
- Batch scanning capabilities to audit entire directories containing multiple Openclaw Skills at once.
SKILL.md
Loading
Related Openclaw Skills
Mermaid Image Generator
A lightweight utility to transform Mermaid diagram code into professional PNG or SVG images using the mermaid.ink API without local dependencies.
WhatsApp Analyzer
Automate the detection of appointments and urgent messages from WhatsApp with integrated Telegram alerts and Google Calendar syncing.
WhatsApp Automation with AI Alerts
An AI-driven automation skill that monitors WhatsApp messages to provide intelligent Telegram alerts and calendar scheduling suggestions.
SQL Server Skills
A comprehensive diagnostic and management toolkit for SQL Server performance tuning and database administration using automated T-SQL workflows.
Content Draft Generator
An automated pipeline that deconstructs high-performing reference content to generate three unique, psychologically-optimized draft variations.
Content Ideas Generator
An AI-powered engine that transforms raw reference material into five structured, high-engagement social media post outlines centered on paradoxical truths and transformational narratives.
METADATA
Featured*
