# Skillguard

> Audit OpenClaw skills for security risks before installation via SkillGuard API.

- Skill: `claw-works/skillguard` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add claw-works/skillguard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/claw-works/skillguard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: claw-works (https://skillmd.com/u/claw-works)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/claw-works/skillguard

---


# SkillGuard

Audit any OpenClaw skill for security risks **before** you install it.

Calls the SkillGuard API (`https://api.agentsouls.io/api/audit`) and returns a verdict, risk score, and threat list.

## Usage

### Audit a skill from ClawHub by name

```bash
bash skills/skillguard/audit.sh --name <skill-slug>
```

This uses `clawhub inspect --file` to pull the skill's SKILL.md (and any scripts), then sends the code to the audit API.

### Audit a local file

```bash
bash skills/skillguard/audit.sh --code <path-to-file>
```

Reads the file and sends its contents for audit.

### Output

Returns JSON with:
- **verdict**: `SAFE` | `CAUTION` | `DANGEROUS`
- **riskScore**: 0–100
- **threats**: list of identified risks

Example:
```json
{
  "verdict": "CAUTION",
  "riskScore": 35,
  "threats": ["Executes arbitrary shell commands", "Accesses network without disclosure"]
}
```

## When to use

**Before installing any new skill**, run:

```bash
bash skills/skillguard/audit.sh --name <skill-name>
```

If verdict is `DANGEROUS`, do **not** install. If `CAUTION`, review the threats and decide with the user.