# Guardclaw

> Security scanner for tool arguments and tool results. Detects prompt injection, RCE, credential harvesting, DNS exfiltration, and data exfiltration before execution or before feeding results back to the agent.

- Skill: `acria9/guardclaw` (Agent Skill, multi-file: 12 files)
- Install (CLI): `npx skillmds@latest add acria9/guardclaw`
- Raw SKILL.md: https://api.skillmd.com/api/skills/acria9/guardclaw/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: acria9 (https://skillmd.com/u/acria9)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/acria9/guardclaw

---


# GuardClaw

Invoke GuardClaw as an external process before executing any tool and after receiving any tool result.

## Before a tool call

```bash
python3 /path/to/guardclaw.py --text "TOOL: <name>\nARGS:\n<args>" --mode bouncer
```

## After a tool result

```bash
python3 /path/to/guardclaw.py --text "<result>" --mode bouncer
```

## Exit codes

| Code | Meaning | Action |
|------|---------|--------|
| 0 | Clean | Proceed |
| 1 | Medium | Use judgment, inform user |
| 2 | High | Warn user, ask confirmation |
| 3 | Critical | Do NOT proceed, explain threat |

## Modes

- `nanny` — auto-block all high/critical (pipelines)  
- `bouncer` — block critical, confirm high/medium (default)  
- `junior` — log only, never block (developers)

Full docs: https://github.com/acria9/GuardClaw