Guardclaw

Security scanner for tool arguments and tool results. Detects prompt injection, RCE, credential harvesting, DNS exfiltration, and data exfiltration before execution or before feeding results back to the agent.

acria9 21e0466 12 files · 171.6 KB Updated

File contents

GuardClaw

Invoke GuardClaw as an external process before executing any tool and after receiving any tool result.

Before a tool call

python3 /path/to/guardclaw.py --text "TOOL: <name>\nARGS:\n<args>" --mode bouncer

After a tool result

python3 /path/to/guardclaw.py --text "<result>" --mode bouncer

Exit codes

Code Meaning Action
0 Clean Proceed
1 Medium Use judgment, inform user
2 High Warn user, ask confirmation
3 Critical Do NOT proceed, explain threat

Modes

  • nanny — auto-block all high/critical (pipelines)
  • bouncer — block critical, confirm high/medium (default)
  • junior — log only, never block (developers)

Full docs: https://github.com/acria9/GuardClaw

acria9/GuardClaw/tree/main/ commit 21e0466550

Frequently asked questions

npx skillmds@latest add acria9/guardclaw