claw-skill-guard

What This Skill Does

claw-skill-guard acts as a robust security gatekeeper for your OpenClaw agent ecosystem. It serves as a static analysis tool specifically designed to inspect third-party skills before they gain access to your local environment. By scanning the source code and installation manifests of skills sourced from ClawHub or external repositories, it identifies suspicious command patterns, hidden obfuscated code, and potential install traps that could compromise your system. In an era where malicious code can be packaged as benign developer utilities, this skill provides the essential verification step to ensure that only trustworthy code executes within your agent workflow.

Installation

To install the claw-skill-guard, use the official repository command: clawhub install openclaw/skills/skills/bobdevibecoder/bobagent-claw-skill-guard. After installation, ensure you update your team or personal AGENTS.md file to mandate the use of this scanner. We recommend adding a CI/CD-style check or a pre-installation hook that forces this scanner to run before any new skill is integrated into your existing agent environment.

Use Cases

1. Vetting External Contributions: Use the scanner to audit pull requests or new agent skills downloaded from the public ClawHub marketplace.
2. Security Auditing: Periodically scan existing skills in your local ./skills/ directory to ensure that updates haven't introduced malicious dependencies.
3. Enterprise Compliance: Enforce a strict "no-install" policy for skills that trigger CRITICAL or HIGH risk alerts, protecting your organization's sensitive data and system integrity.

Example Prompts

1. "OpenClaw, scan this new skill at https://clawhub.com/dev/cool-new-tool and tell me if it is safe to install."
2. "Run the claw-skill-guard scanner on all my local skills in the ./skills folder and output a report of any potential risks."
3. "I found a suspicious shell command in the latest update of my skill. Use claw-skill-guard to analyze the source code and explain why it might be triggering a CRITICAL risk flag."

Tips & Limitations

While highly effective, claw-skill-guard performs static analysis. It is excellent at catching known malware patterns like curl | bash, but it may occasionally flag legitimate scripts that perform system administration tasks. Always review "Medium" risks manually. This tool cannot replace a full behavioral analysis or sandbox execution, so remain cautious with skills that require sudo privileges or extensive file system access.