SkillGuard provides automated security auditing for AI agent skills to prevent prompt injection and malicious code execution.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-guard-actor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-guard-actor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is SkillGuard?
SkillGuard is an essential security tool designed to protect your AI agent environment from vulnerabilities found in third-party integrations. It specifically targets Openclaw Skills, scanning their underlying instructions and configurations for prompt injection attacks, jailbreak attempts, and malicious content using the Lakera Guard engine. By acting as a proactive firewall, it ensures that only verified and safe capabilities are added to your local setup.
As the ecosystem of Openclaw Skills grows, the risk of encountering compromised or poorly secured skills increases. SkillGuard mitigates this risk by providing a clear safety verdict for every skill, allowing developers and power users to maintain a high security posture while extending their agent's functionality.
SkillGuard Use Cases
- Preventing the installation of malicious skills during automated setup processes.
- Auditing new Openclaw Skills found via search queries before testing them.
- Batch scanning existing skills in a workspace to identify newly discovered security risks.
- Enforcing an organization-wide 'scan-before-install' policy for all AI agent contributions.
How SkillGuard Works
- The scan is initiated via a command like 'scan [skill]' or automatically during an install request.
- The skill fetches the raw SKILL.md documentation from the public API for the targeted Openclaw Skills.
- The raw content is sent to a hosted Apify actor which integrates with Lakera Guard for security analysis.
- Lakera Guard evaluates the prompt instructions for known attack vectors and malicious patterns.
- The scan result is returned via a secure webhook, providing a 'safe' or 'flagged' status along with specific reasoning for any findings.
SkillGuard Setup
To get started, ensure you have the required API keys for Apify and Lakera Guard. Set the following environment variables in your workspace:
export APIFY_TOKEN="your_apify_token"
export LAKERA_API_KEY="your_lakera_key"
export OPENCLAW_WEBHOOK_URL="your_webhook_url"
export OPENCLAW_HOOKS_TOKEN="your_auth_token"
Run the scan script to verify your setup:
bash ./scripts/scan.sh --slug skill-name
Finally, update your TOOLS.md to enforce the security policy for all Openclaw Skills to ensure protection across all sessions.
SkillGuard Data Schema & Taxonomy
SkillGuard results are structured to provide clear actionable data for the agent:
| Attribute | Type | Description |
|---|---|---|
slug |
String | The unique identifier for the scanned skill. |
verdict |
String | The security status (safe, flagged, or error). |
reasoning |
String | Details on detected threats like prompt_attack or unknown_links. |
url |
String | Link to the skill on ClawHub for manual review. |
scanned_at |
ISO Date | The timestamp of the security audit. |
SkillGuard Advanced Features
- Automated Install Policy: Automatically appends security requirements to TOOLS.md to force scans for all Openclaw Skills.
- Asynchronous Execution: Uses ad-hoc webhooks to process deep security scans without causing agent timeouts.
- Deduplicated Queries: Efficiently handles requests that involve both specific slugs and broader search queries simultaneously.
- Detailed Threat Reasoning: Provides granular feedback on why a skill was flagged, enabling informed manual overrides.
SKILL.md
Loading
Related Openclaw Skills
SushiSwap SDK
A comprehensive TypeScript wrapper for the SushiSwap Aggregator API designed to facilitate safe and efficient swap integrations.
SushiSwap REST API Integration
A comprehensive REST API skill for executing optimized token swaps and accessing multi-chain price data via the SushiSwap Aggregator.
Doppel
A skill enabling AI agents to register, navigate, and collaboratively build within the Doppel 3D virtual metaverse.
Doppel Social Outreach
A strategic outreach skill designed to promote AI agent world builds across social platforms to maximize reputation and recruitment.
ClawAI.Town World Connector
A decentralized 3D world connector that allows autonomous AI agents to live, trade, and battle on the Solana mainnet.
ClawAI.Town World Connector
An Openclaw Skills integration that connects autonomous AI agents to a decentralized 3D world on the Solana mainnet for trading, combat, and collaboration.
Featured*
