Merlin-ClawGuard acts as a digital immune system for autonomous agents, identifying and neutralizing malicious skills through advanced Python-based vaccines.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install merlin-clawguard
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install merlin-clawguard using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Merlin-ClawGuard?
Merlin-ClawGuard is a sophisticated security framework designed to protect the Moltbook and ClawHub ecosystem from the rising tide of malicious Openclaw Skills. Developed by the University of Applied Ethics, it functions as a digital immune system that preemptively scans and deconstructs malware into functional vaccines. It addresses the critical reality where a high percentage of skills may harbor hidden prompt injections or APT (Advanced Persistent Threat) chains.
By leveraging integration with Clawdex and a specialized pipeline of four core Python vaccines, Merlin-ClawGuard provides real-time detection for C2 communications, rootkits, bootkits, and complex cross-vector attack chains. It is built to ensure that Openclaw Skills remain safe for deployment in production environments by mapping threats directly to the MITRE ATT&CK framework.
Merlin-ClawGuard Use Cases
- Validating third-party Openclaw Skills before integration into a production Moltbook environment.
- Detecting hidden data exfiltration attempts through DNS, HTTP, or encrypted Discord/Telegram C2 channels.
- Identifying high-level persistence threats like UEFI implants or kernel-level security bypasses in agent code.
- Protecting against package ecosystem attacks such as typosquatting and malicious dependency hooks.
- Automating the security vetting process for community-contributed Openclaw Skills.
How Merlin-ClawGuard Works
- The user initiates a scan via the merlin_guard.py CLI or programmatic API, targeting a specific skill file or code snippet.
- Merlin-ClawGuard queries Clawdex to check for known malicious patterns and existing community-reported threats.
- The skill code is passed through a multi-stage vaccine pipeline, including VAX-001 (Known Malicious), VAX-027 (Exfiltration), VAX-028 (Attack Chains), and VAX-029 (Rootkits).
- A diagnostic score is calculated based on detected indicators; scores range from 0 (Clean) to 81+ (Critical Isolation).
- The system returns a verdict (Approve, Monitor, Block, or Isolate) along with detailed technical insights for the developer.
Merlin-ClawGuard Setup
To install and begin protecting your Openclaw Skills, ensure you have Python 3 and aiohttp installed:
# Install required dependencies
pip install aiohttp
# Clone the repository and run a test scan
python3 merlin_guard.py --test
# Scan a specific skill file
python3 merlin_guard.py --file your_skill.md --json
Merlin-ClawGuard Data Schema & Taxonomy
Merlin-ClawGuard utilizes a structured scoring system and modular vaccine architecture to organize threat data:
| Data Point | Description |
|---|---|
| Threat Score | A numerical value from 0-100 indicating the risk level of the skill. |
| MITRE Mapping | Correlation of detected behaviors to over 100+ MITRE ATT&CK techniques. |
| Vaccine IDs | Specific modules (VAX-001 to VAX-030) triggered during the analysis. |
| Verdict | The final action recommendation: APPROUVER, MONITOR, BLOQUER, or ISOLATION. |
Merlin-ClawGuard Advanced Features
- Cross-Vector Correlation (VAX-028) that identifies complex PI_RS_RAT chains involving prompt injection and reverse shells.
- Kernel & Firmware Detection (VAX-029) capable of spotting DKOM (Direct Kernel Object Manipulation) and UEFI/BIOS implants.
- Automated vaccine generation that converts analyzed malware patterns into preemptive defensive signatures for the community.
- Programmatic integration support, allowing developers to import vaccines directly into their own Python security workflows.
- Real-time API integration with Clawdex for up-to-the-minute threat intelligence on Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
Seedream Image Generation
A robust API-driven integration for generating and editing AI images using ByteDance's state-of-the-art Seedream models.
Trending Island Destinations Guide
An intelligent travel planning skill that generates optimized island itineraries, photography guides, and real-time transit data for viral travel destinations.
Zhangyue iReader Content Assistant
A specialized content discovery and research automation skill for the Zhangyue iReader platform.
Campaign Planning
An expert framework for designing, executing, and optimizing marketing campaigns through standardized SOPs and data-driven insights.
GDM-AI v6 Encrypted Blackbox
An advanced encrypted logic engine designed for survival and win-probability maximization in competitive gaming environments.
Badger Maps
A powerful integration for field sales professionals to optimize routes and manage CRM records directly through an AI agent.
Featured*
