minduploadedcrab-skillguard

Security scanner for OpenClaw skills. Scans skills for malware, credential theft, data exfiltration, prompt injection, and permission overreach before installation. Run: python3 scripts/skillguard.py scan <skill-directory>

Safety Notice

This listing is from the official public ClawHub registry. Review SKILL.md and referenced scripts before running.

Copy this and send it to your AI assistant to learn

Install skill "minduploadedcrab-skillguard" with this command: npx skills add minduploadedcrab/minduploadedcrab-skillguard

SkillGuard — Security Scanner for OpenClaw Skills

Scans OpenClaw skills for security threats before installation. Catches agent-specific attacks that generic antivirus misses.

Usage

# Scan a skill directory
python3 scripts/skillguard.py scan ~/.openclaw/workspace/skills/<skill-name>

# Scan with JSON output
python3 scripts/skillguard.py scan ~/.openclaw/workspace/skills/<skill-name> --json

# Scan all installed skills
python3 scripts/skillguard.py scan-all

# Quick summary of all skills
python3 scripts/skillguard.py audit

What It Detects

  1. Credential Access — reads of config files, env vars, wallet files, API keys
  2. Network Exfiltration — outbound HTTP calls, encoded payloads, suspicious domains
  3. File System Abuse — path traversal, writes outside skill directory, hidden files
  4. Prompt Injection — SKILL.md content that manipulates agent behavior
  5. Dependency Risks — suspicious npm post-install scripts, known bad packages
  6. Obfuscation — extremely long lines, hex/unicode escape sequences
  7. Symlink Attacks — symlinks escaping the skill directory to access sensitive files
  8. Config File Secrets — hardcoded credentials in .json, .env, .yaml files

Output

Each scan produces:

  • Risk Score: 0-100 (0 = clean, 100 = critical threat)
  • Verdict: PASS / WARN / FAIL
  • Findings: Detailed list of issues with severity and evidence

Source Transparency

This detail page is rendered from real SKILL.md content. Trust labels are metadata-based hints, not a safety guarantee.

Open Registry RecordOpen in ClawHub

Related Skills

Related by shared tags or category signals.

Security

Docker Compose Linter

Lint docker-compose.yml files for security, best practices, and port conflicts.

Registry SourceRecently Updated
920charlie-morrison
Security

Circleci Config Validator

Validate .circleci/config.yml files for syntax, structure, security, and best practices. Use when validating CircleCI pipeline configuration, auditing CI/CD...

Registry SourceRecently Updated
1360charlie-morrison
Security

Vite Config Validator

Validate Vite configuration files (JSON-exported) for structural correctness, build settings, server security, resolve/CSS hygiene, plugin deprecations, and...

Registry SourceRecently Updated
890charlie-morrison
Security

Nginx Config Linter

Lint, validate, and audit nginx configuration files for syntax errors, security issues, and performance problems.

Registry SourceRecently Updated
920charlie-morrison