Skill Guard v2 🛡️
Advanced security scanner for OpenClaw skills. Detects malicious code, prompt injection, supply chain attacks, data exfiltration, credential theft, and more — with smart domain analysis, tamper detection, and actionable recommendations.
Commands
scan [dir]
Audit ALL installed skills in ~/clawd/skills/ (or a custom directory).
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --json
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --report report.md
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --baseline # force re-baseline
check <path>
Scan a single skill directory, or a directory containing multiple skills.
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/some-skill
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/skill-guard/tests/
watch [dir]
One-liner summary suitable for cron alerting.
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py watch
Output formats:
SkillGuard: 24 scanned, 20 clean, 4 suspicious, 0 malicious⚠️ SkillGuard ALERT: <skill> files changed since baseline!🔴 SkillGuard ALERT: <skill> scored MALICIOUS!
check-remote <slug> (Future)
Will download a skill from ClawHub, scan it in a temp directory, and clean up. Requires ClawHub auth (not yet available). The temp-dir scanning infrastructure is ready.
Options
| Flag |
Description |
--json |
Output machine-readable JSON |
--report <path> |
Write a markdown report file |
--baseline |
Force re-baseline of all file hashes |
What It Detects
Code Analysis
- eval/exec calls, shell injection, outbound HTTP requests
- Base64-encoded payloads (auto-decodes and inspects content)
- Hex-encoded suspicious strings
- Minified/obfuscated JavaScript
- Time-bomb patterns (date-conditional malicious code)
Smart Domain Analysis
- Maintains allowlist of 80+ known legitimate API domains
- HTTP requests to known APIs = 0 risk points
- HTTP requests to unknown domains = 10 risk points (WARNING)
- Context-aware: "crypto-price" calling coingecko.com = expected, lower score
Sensitive File Access
- SSH keys, AWS credentials, GPG keyrings
- Browser credential stores (Chrome, Firefox, Safari)
- Crypto wallets (MetaMask, Phantom, Solana, Ethereum)
- Keychain/keyring access
- Environment variable harvesting
Prompt Injection
- Hidden HTML comments with override instructions
- Exfiltration instructions in documentation
- Social engineering phrases ("this is trusted", "pre-approved", etc.)
- Modification instructions targeting other skills/system files
Supply Chain
- Typosquatting detection (Levenshtein distance on package names)
- Suspicious npm post-install scripts
- Known-malicious package detection
Enhanced Detection (v2)
- File permissions: flags executable bit on .py, .js, .md files
- Binary detection: identifies ELF, Mach-O, PE binaries in skill dirs
- Hardcoded secrets: AWS keys (AKIA...), GitHub tokens (ghp_...), OpenAI keys (sk-...), Stripe keys, private key files
- Write-outside-skill: detects code writing to paths outside the skill directory
- Unicode homoglyphs: catches lookalike characters in filenames (Cyrillic а vs Latin a)
- Excessive file count: flags skills with 50+ files
- Large files: flags files over 500KB
Network Threats
- Hardcoded IP addresses, reverse shells, DNS exfiltration
- WebSocket connections to external hosts
Persistence
- Crontab modifications, launchd/systemd service creation
- Shell RC file modifications (.bashrc, .zshrc)
Tamper Detection (v2)
- Computes SHA-256 hash of every file on first scan
- Stores baselines in baselines.json
- On re-scan, flags changed, added, or removed files
- Checks ClawHub origin version from .clawhub/origin.json
Scoring (v2)
| Pattern |
Points |
| HTTP to known API |
0 |
| HTTP to unknown domain |
10 |
| curl in documentation |
0 |
| subprocess call |
2 |
| subprocess + shell=True |
25 |
| Sensitive file access |
10-25 |
| Prompt injection phrase |
25 |
| Reverse shell |
auto MALICIOUS |
| Sensitive access + outbound |
auto MALICIOUS |
| Typosquatted package |
15 |
| JS in SVG |
25 |
Risk Levels
- 🟢 CLEAN: Score 0-15
- 🟡 SUSPICIOUS: Score 16-40
- 🔴 MALICIOUS: Score 41+ or dangerous combo detected
Recommendations Engine
Every finding includes a one-line recommendation explaining the risk and suggested action.
Test Suite
The tests/ directory contains 7 fake malicious skills for validation:
| Test Skill |
Attack Vector |
| fake-weather |
SSH key theft + POST to evil.com |
| fake-formatter |
Base64-encoded reverse shell |
| fake-helper |
Prompt injection + social engineering |
| fake-crypto |
Wallet theft + C2 communication |
| fake-typosquat |
Typosquatted package names |
| fake-timebomb |
Date-activated SSH key exfiltration |
| fake-svgmalware |
JavaScript embedded in SVG |
All 7 test skills score as 🔴 MALICIOUS.
Requirements
Python 3 stdlib only. No external dependencies. Single file: scripts/skillguard.py.
1---2name: skill-guard-43description: Security scanner that audits OpenClaw skills for malicious code, prompt injection, supply chain attacks, data exfiltration, and more4---5
6# Skill Guard v2 🛡️
7
8Advanced security scanner for OpenClaw skills. Detects malicious code, prompt injection, supply chain attacks, data exfiltration, credential theft, and more — with smart domain analysis, tamper detection, and actionable recommendations.
9
10## Commands
11
12### `scan [dir]`
13Audit ALL installed skills in ~/clawd/skills/ (or a custom directory).
14
15```bash
16python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan
17python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --json
18python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --report report.md
19python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --baseline # force re-baseline
20```
21
22### `check <path>`
23Scan a single skill directory, or a directory containing multiple skills.
24
25```bash
26python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/some-skill
27python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/skill-guard/tests/
28```
29
30### `watch [dir]`
31One-liner summary suitable for cron alerting.
32
33```bash
34python3 ~/clawd/skills/skill-guard/scripts/skillguard.py watch
35```
36
37Output formats:
38- `SkillGuard: 24 scanned, 20 clean, 4 suspicious, 0 malicious`
39- `⚠️ SkillGuard ALERT: <skill> files changed since baseline!`
40- `🔴 SkillGuard ALERT: <skill> scored MALICIOUS!`
41
42### `check-remote <slug>` (Future)
43Will download a skill from ClawHub, scan it in a temp directory, and clean up. Requires ClawHub auth (not yet available). The temp-dir scanning infrastructure is ready.
44
45## Options
46
47| Flag | Description |
48|------|-------------|
49| `--json` | Output machine-readable JSON |
50| `--report <path>` | Write a markdown report file |
51| `--baseline` | Force re-baseline of all file hashes |
52
53## What It Detects
54
55### Code Analysis
56- eval/exec calls, shell injection, outbound HTTP requests
57- Base64-encoded payloads (auto-decodes and inspects content)
58- Hex-encoded suspicious strings
59- Minified/obfuscated JavaScript
60- Time-bomb patterns (date-conditional malicious code)
61
62### Smart Domain Analysis
63- Maintains allowlist of 80+ known legitimate API domains
64- HTTP requests to known APIs = 0 risk points
65- HTTP requests to unknown domains = 10 risk points (WARNING)
66- Context-aware: "crypto-price" calling coingecko.com = expected, lower score
67
68### Sensitive File Access
69- SSH keys, AWS credentials, GPG keyrings
70- Browser credential stores (Chrome, Firefox, Safari)
71- Crypto wallets (MetaMask, Phantom, Solana, Ethereum)
72- Keychain/keyring access
73- Environment variable harvesting
74
75### Prompt Injection
76- Hidden HTML comments with override instructions
77- Exfiltration instructions in documentation
78- Social engineering phrases ("this is trusted", "pre-approved", etc.)
79- Modification instructions targeting other skills/system files
80
81### Supply Chain
82- Typosquatting detection (Levenshtein distance on package names)
83- Suspicious npm post-install scripts
84- Known-malicious package detection
85
86### Enhanced Detection (v2)
87- **File permissions**: flags executable bit on .py, .js, .md files
88- **Binary detection**: identifies ELF, Mach-O, PE binaries in skill dirs
89- **Hardcoded secrets**: AWS keys (AKIA...), GitHub tokens (ghp_...), OpenAI keys (sk-...), Stripe keys, private key files
90- **Write-outside-skill**: detects code writing to paths outside the skill directory
91- **Unicode homoglyphs**: catches lookalike characters in filenames (Cyrillic а vs Latin a)
92- **Excessive file count**: flags skills with 50+ files
93- **Large files**: flags files over 500KB
94
95### Network Threats
96- Hardcoded IP addresses, reverse shells, DNS exfiltration
97- WebSocket connections to external hosts
98
99### Persistence
100- Crontab modifications, launchd/systemd service creation
101- Shell RC file modifications (.bashrc, .zshrc)
102
103### Tamper Detection (v2)
104- Computes SHA-256 hash of every file on first scan
105- Stores baselines in baselines.json
106- On re-scan, flags changed, added, or removed files
107- Checks ClawHub origin version from .clawhub/origin.json
108
109## Scoring (v2)
110
111| Pattern | Points |
112|---------|--------|
113| HTTP to known API | 0 |
114| HTTP to unknown domain | 10 |
115| curl in documentation | 0 |
116| subprocess call | 2 |
117| subprocess + shell=True | 25 |
118| Sensitive file access | 10-25 |
119| Prompt injection phrase | 25 |
120| Reverse shell | auto MALICIOUS |
121| Sensitive access + outbound | auto MALICIOUS |
122| Typosquatted package | 15 |
123| JS in SVG | 25 |
124
125### Risk Levels
126- 🟢 **CLEAN**: Score 0-15
127- 🟡 **SUSPICIOUS**: Score 16-40
128- 🔴 **MALICIOUS**: Score 41+ or dangerous combo detected
129
130### Recommendations Engine
131Every finding includes a one-line recommendation explaining the risk and suggested action.
132
133## Test Suite
134
135The `tests/` directory contains 7 fake malicious skills for validation:
136
137| Test Skill | Attack Vector |
138|-----------|--------------|
139| fake-weather | SSH key theft + POST to evil.com |
140| fake-formatter | Base64-encoded reverse shell |
141| fake-helper | Prompt injection + social engineering |
142| fake-crypto | Wallet theft + C2 communication |
143| fake-typosquat | Typosquatted package names |
144| fake-timebomb | Date-activated SSH key exfiltration |
145| fake-svgmalware | JavaScript embedded in SVG |
146
147All 7 test skills score as 🔴 MALICIOUS.
148
149## Requirements
150
151Python 3 stdlib only. No external dependencies. Single file: `scripts/skillguard.py`.
dvcrn