skill-guard
Scan ClawHub skills for security vulnerabilities BEFORE installing. Use when installing new skills from ClawHub to detect prompt injections, malware payloads, hardcoded secrets, an…
hola
@jamesouttake
Install
$ openclaw skills install @jamesouttake/skill-guardskill-guard
The only pre-install security gate for ClawHub skills.
Why skill-guard?
| VirusTotal (ClawHub built-in) | skillscanner (Gen Digital) | skill-guard | |
|---|---|---|---|
| When it runs | After publish (server-side) | On-demand lookup | Before install (client-side) |
| What it checks | Malware signatures | Their database | Actual skill content |
| Prompt injections | ❌ | ❌ | ✅ |
| Data exfiltration URLs | ❌ | ❌ | ✅ |
| Hidden instructions | ❌ | ❌ | ✅ |
| AI-specific threats | ❌ | ❌ | ✅ |
| Install blocking | ❌ | ❌ | ✅ |
VirusTotal catches known malware binaries — but won't flag <!-- IGNORE PREVIOUS INSTRUCTIONS -->.
skillscanner checks if Gen Digital has reviewed it — but can't scan new or updated skills.
skill-guard uses mcp-scan (Invariant Labs, acquired by Snyk) to analyze what's actually in the skill, catches AI-specific threats, and blocks install if issues are found.
The Problem
Skills can contain:
- 🎭 Prompt injections — hidden "ignore previous instructions" attacks
- 💀 Malware payloads — dangerous commands disguised in natural language
- 🔑 Hardcoded secrets — API keys, tokens in plain text
- 📤 Data exfiltration — URLs that leak your conversations, memory, files
- ⛓️ Toxic flows — instructions that chain into harmful actions
One bad skill = compromised agent. Your agent trusts skills implicitly.
The Solution
# Instead of: clawhub install some-skill
./scripts/safe-install.sh some-skill
skill-guard:
- Downloads to staging (
/tmp/) — never touches your real skills folder - Scans with mcp-scan — Invariant/Snyk's security scanner for AI agents
- Blocks or installs — clean skills get installed, threats get quarantined
What It Catches
Real example — skill-guard flagged this malicious skill:
● [E004]: Prompt injection detected (high risk)
● [E006]: Malicious code pattern detected
● [W007]: Insecure credential handling
● [W008]: Machine state compromise attempt
● [W011]: Third-party content exposure
VirusTotal: 0/76 engines. mcp-scan caught what antivirus missed.
Usage
# Secure install (recommended)
./scripts/safe-install.sh <skill-slug>
# With version
./scripts/safe-install.sh <skill-slug> --version 1.2.3
# Force overwrite
./scripts/safe-install.sh <skill-slug> --force
Exit Codes
| Code | Meaning | Action |
|---|---|---|
0 | Clean | Skill installed ✓ |
1 | Error | Check dependencies/network |
2 | Threats found | Skill quarantined in /tmp/, review before deciding |
When Threats Are Found
Skill stays in /tmp/skill-guard-staging/skills/<slug>/ (quarantined). You can:
- Review — read the scan output, inspect the files
- Install anyway —
mv /tmp/skill-guard-staging/skills/<slug> ~/.openclaw/workspace/skills/ - Discard —
rm -rf /tmp/skill-guard-staging/
Requirements
clawhubCLI —npm i -g clawhubuv—curl -LsSf https://astral.sh/uv/install.sh | sh
Why This Matters
Your agent has access to your files, messages, maybe your whole machine. One malicious skill can:
- Read your secrets and send them elsewhere
- Modify your agent's behavior permanently
- Use your identity to spread to other systems
Trust, but verify. Scan before you install.
Top skills in this category
Skill Vetter
@spclaudehomeSecurity-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
Multi Search Engine
@gpyangyoujunMulti search engine integration with 16 engines (7 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra...
API Gateway
@byungkyuCall third-party APIs through the Maton gateway, which injects the credential for an app the user has already connected. Use this skill when the user names a connected app and a concrete action in it - read a mailbox, query a CRM, file an issue, update a spreadsheet, run a query through a connected
MoltGuard - Security & Antivirus & Guardrails
@thomaslwangMoltGuard — OpenClaw security guard by OpenGuardrails. Install MoltGuard to protect you and your human from prompt injection, data exfiltration, and maliciou...
1password
@steipeteSet up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.