A pre-install security scanner that protects AI agents by detecting prompt injections and malware in Openclaw Skills before they are deployed.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install talonforge-skill-guard
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install talonforge-skill-guard using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is skill-guard?
skill-guard serves as a critical security layer for developers using Openclaw Skills. While standard antivirus tools check for malware signatures, skill-guard focuses on AI-specific threats such as prompt injections, data exfiltration URLs, and hidden instructions that could compromise an agent's integrity. By intercepting the installation process, it ensures that only verified and safe content enters your workspace.
This tool leverages the power of mcp-scan to analyze the actual content of a skill rather than relying on a static database or server-side checks. It provides a robust defense mechanism for any developer building on the Openclaw ecosystem, ensuring that third-party integrations do not lead to data leaks or toxic AI behavior. By running client-side, it offers immediate protection against newly published or updated threats that haven't been indexed by central repositories.
skill-guard Use Cases
- Installing new skills from ClawHub while ensuring they don't contain malicious payloads.
- Auditing local skills for hardcoded API keys, tokens, or sensitive credentials.
- Preventing prompt injection attacks that could hijack an agent's logic and ignore previous instructions.
- Automating security checks within a CI/CD pipeline for enterprise AI agent workflows.
- Quarantining suspicious code in a temporary staging area for manual review before final deployment.
How skill-guard Works
- The user initiates a secure installation using the skill-guard script wrapper instead of the standard CLI command.
- The skill is downloaded to a isolated staging directory in /tmp/ to ensure it never touches the active Openclaw Skills workspace until verified.
- The engine invokes mcp-scan to perform a deep analysis of the skill's natural language instructions and code patterns.
- If the scan is clean, the skill is automatically moved to the production workspace; if threats are found, the process is blocked and the skill remains quarantined.
skill-guard Setup
To get started with secure installations for Openclaw Skills, ensure you have the required dependencies and use the safe-install script:
# Install required CLIs
npm i -g clawhub
curl -LsSf https://astral.sh/uv/install.sh | sh
# Perform a secure installation
./scripts/safe-install.sh <skill-slug>
# Optional: Install a specific version
./scripts/safe-install.sh <skill-slug> --version 1.2.3
skill-guard Data Schema & Taxonomy
skill-guard organizes its security lifecycle and metadata using a staging-to-production workflow:
| Attribute | Specification |
|---|---|
| Staging Directory | /tmp/skill-guard-staging/skills/<slug>/ |
| Production Path | ~/.openclaw/workspace/skills/ |
| Scan Severity Codes | E004 (Prompt Injection), E006 (Malicious Code), W007 (Insecure Credentials) |
| Exit Codes | 0 (Clean/Installed), 1 (System Error), 2 (Threat Found/Blocked) |
skill-guard Advanced Features
- Version-specific scanning to ensure that updates to existing Openclaw Skills remain safe and untainted.
- Forced overwrite capabilities for power users who need to bypass warnings after manual inspection.
- Automated quarantine management that stores flagged skills for forensic analysis without risking the main agent environment.
- Deep detection for machine state compromise attempts and unauthorized third-party content exposure.
SKILL.md
Loading
Related Openclaw Skills
Jobs Style Generator
A sophisticated text transformation engine that rewrites content into the iconic, high-impact presentation style of Steve Jobs.
Best AI Video Editor
An AI-powered video editing skill that automates cutting, transitions, and 1080p exporting through a high-performance cloud GPU rendering pipeline.
Video Editor That Has AI
A cloud-powered AI video editing tool that transforms raw screen recordings into polished 1080p MP4 videos through simple natural language commands.
Image to Video Online AI
An AI-powered automation skill that converts static JPG images into professional 1080p animated video clips using natural language commands.
QA Pilot
QA Pilot is an autonomous quality assurance layer that empowers AI agents to test, debug, and verify their own code before declaring a task complete.
List of Free Video Generators
An AI-powered video generation skill that transforms text prompts and images into professional 1080p MP4 videos without manual editing.
Featured*
