SkillGuard is a specialized security tool designed to audit Openclaw Skills for malicious code, prompt injections, and data exfiltration threats.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install minduploadedcrab-skillguard
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install minduploadedcrab-skillguard using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is SkillGuard?
SkillGuard serves as a critical security layer for developers and users of AI agents. It is specifically designed to scan Openclaw Skills for potential threats that standard antivirus programs might miss, such as agent-specific prompt injections and unauthorized credential access. By analyzing the source code and configuration files within Openclaw Skills, SkillGuard provides a comprehensive safety report before any skill is integrated into your workflow.
The tool focuses on maintaining the integrity of your environment by ensuring that all Openclaw Skills adhere to safety best practices. It identifies risks associated with file system abuse, hidden network calls, and obfuscated code, making it an essential utility for anyone building or using third-party extensions in the AI agent ecosystem.
SkillGuard Use Cases
- Scanning third-party Openclaw Skills before installation to prevent credential theft.
- Performing regular security audits on all installed Openclaw Skills to ensure no new vulnerabilities are introduced.
- Identifying prompt injection attempts within SKILL.md files that could compromise agent behavior.
- Automating security checks within CI/CD pipelines for developers creating new Openclaw Skills.
How SkillGuard Works
- The user triggers a scan by pointing SkillGuard to a specific directory containing Openclaw Skills.
- SkillGuard performs static analysis on scripts, metadata, and configuration files like .json and .env.
- The engine checks for specific signatures of malicious activity, such as outbound HTTP calls to suspicious domains or path traversal patterns.
- A risk score from 0 to 100 is calculated based on the severity and frequency of the findings.
- SkillGuard outputs a final verdict of PASS, WARN, or FAIL, allowing the user to make an informed decision about the safety of their Openclaw Skills.
SkillGuard Setup
To begin securing your Openclaw Skills, ensure you have Python 3 installed and use the following commands:
# Scan a specific skill directory
python3 scripts/skillguard.py scan ~/.openclaw/workspace/skills/<skill-name>
# Perform a scan on all installed Openclaw Skills
python3 scripts/skillguard.py scan-all
# Run a quick summary audit of your environment
python3 scripts/skillguard.py audit
SkillGuard Data Schema & Taxonomy
SkillGuard generates structured security data for every scan performed on Openclaw Skills. The results are organized as follows:
| Data Point | Details |
|---|---|
| Risk Score | A 0-100 scale indicating the threat level (0 is safe, 100 is critical) |
| Verdict | A clear status indicator: PASS (No issues), WARN (Minor risks), or FAIL (Critical threats) |
| Findings | A detailed list of evidence including line numbers and specific security violations |
| Output Format | Supports both human-readable console output and machine-readable JSON for Openclaw Skills automation |
SkillGuard Advanced Features
- Advanced detection of obfuscated code, including hex and unicode escape sequences often used to hide malicious intent in Openclaw Skills.
- Deep analysis of symlink attacks designed to escape the skill directory and access sensitive system files.
- Comprehensive scanning for hardcoded secrets and API keys within .yaml, .json, and .env files.
- Support for JSON output mode, allowing for programmatic integration with other security tools used to manage Openclaw Skills.
- Specialized detection for dependency risks, such as suspicious npm post-install scripts within the skill package.
SKILL.md
Loading
Related Openclaw Skills
Content Automator
A high-performance automation pipeline for generating faceless YouTube content using AI scripts, ElevenLabs TTS, and ffmpeg assembly.
chrome-open-tabs
A powerful utility to read and list open browser tabs from Chromium-based browsers, including support for synced mobile and desktop devices.
Giphy GIF Search
A lightweight integration for AI agents to search and post contextual Giphy GIFs within Discord environments.
OpenClaw Security Guard
A zero-telemetry security auditing CLI and live dashboard for hardening AI agent installations and detecting vulnerabilities.
Platform Health Check
A diagnostic tool to monitor the connectivity, latency, and authentication status of over 20 agent platform APIs.
Universal PDF Vision Parser
A high-performance document digitizer that uses multimodal vision to convert multilingual PDFs and complex layouts into perfectly structured Markdown.
Featured*
