SkillGuard is a robust security scanner designed to vet third-party Openclaw Skills for dangerous patterns, suspicious behavior, and vulnerable dependencies.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawscan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawscan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is SkillGuard?
SkillGuard serves as a critical security layer for the AI agent ecosystem, specifically addressing the lack of centralized moderation in skill repositories. By utilizing static analysis and pattern matching, it allows users to verify the safety of Openclaw Skills before they gain access to the local filesystem, environment variables, or network.
This tool is essential for developers and users who want to leverage the power of automated agents without compromising their system's integrity or data privacy. It empowers the community to build a more transparent and secure environment where Openclaw Skills are audited for risks such as arbitrary code execution, credential theft, and reverse shells.
SkillGuard Use Cases
- Scan a skill from a remote repository before proceeding with installation to ensure it meets safety standards.
- Perform a comprehensive security audit of all currently installed Openclaw Skills to identify new risks.
- Integrate security checks into CI/CD pipelines to automatically vet internal skills during development.
- Monitor for skill updates and automatically scan new versions to maintain a clean environment.
How SkillGuard Works
- Fetching: The tool retrieves the source code of the target Openclaw Skills from local directories or remote repositories using the CLI.
- Static Analysis: It performs a deep scan of all code files for critical patterns like eval calls, shell injections, and dangerous file system operations.
- Dependency Verification: SkillGuard cross-references declared dependencies in requirements.txt or package.json against known vulnerability databases such as CVE and npm advisories.
- Verdict Generation: Based on the findings, it assigns a security level ranging from Clean to Dangerous and generates a detailed report for the user.
SkillGuard Setup
To install via the official manager, run:
clawhub install clawscan
For a manual installation from source:
git clone https://github.com/G0HEAD/skillguard
cd skillguard
chmod +x scripts/skillguard.py
SkillGuard Data Schema & Taxonomy
The tool utilizes a structured configuration file and generates reports in various formats to help manage Openclaw Skills. Key data components include:
| Component | Description |
|---|---|
| config.json | Stores severity thresholds, trusted authors, and allowed network domains for scanning. |
| vulns.json | A local database containing known vulnerabilities for dependencies used in Openclaw Skills. |
| Report Formats | Security findings can be exported as Markdown, JSON, or HTML for external documentation. |
| Allowlist | A registry of manually reviewed and trusted skills to bypass repeated scanning. |
SkillGuard Advanced Features
- Watch Mode: Continuously monitor for new skill versions and auto-scan updates at set intervals.
- Custom Patterns: Define project-specific regex patterns to detect internal API usage or proprietary risks.
- Trusted Author System: Automatically allowlist Openclaw Skills published by verified developers or organizations.
- Multi-Format Reporting: Export detailed security audits to HTML or JSON for integration with other security tools.
SKILL.md
Loading
Related Openclaw Skills
Noodle Create Writing
An automated AI agent skill designed to search, summarize, and generate platform-specific social media articles for the food and culinary niche.
Nano Banana OpenRouter Image Generation
A specialized image generation skill leveraging Google's Gemini 2.5 Flash Image models through the OpenRouter API.
SafeFlow Sui Skill
A specialized AI agent skill for managing SafeFlow shared contracts on the Sui blockchain with secure owner-assisted provisioning.
IdleClaw
A distributed inference network that allows users to share idle Ollama capacity or consume community compute when local resources or API credits are unavailable.
KiCad PCB Automation
A full-stack PCB design automation skill for KiCad that handles everything from circuit schematics to manufacturing exports and PCBWay ordering.
TokenGuard
TokenGuard is a dedicated API cost guardian that tracks AI agent spending, enforces configurable budget limits, and prevents expensive runaway loops.
Featured*
