Skill Guard v2 🛡️
Advanced security scanner for OpenClaw skills. Detects malicious code, prompt injection, supply chain attacks, data exfiltration, credential theft, and more — with smart domain analysis, tamper detection, and actionable recommendations.
Commands
scan [dir]
Audit ALL installed skills in ~/clawd/skills/ (or a custom directory).
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --json
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --report report.md
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --baseline # force re-baseline
check <path>
Scan a single skill directory, or a directory containing multiple skills.
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/some-skill
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/skill-guard/tests/
watch [dir]
One-liner summary suitable for cron alerting.
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py watch
Output formats:
SkillGuard: 24 scanned, 20 clean, 4 suspicious, 0 malicious⚠️ SkillGuard ALERT: <skill> files changed since baseline!🔴 SkillGuard ALERT: <skill> scored MALICIOUS!
check-remote <slug> (Future)
Will download a skill from ClawHub, scan it in a temp directory, and clean up. Requires ClawHub auth (not yet available). The temp-dir scanning infrastructure is ready.
Options
| Flag |
Description |
--json |
Output machine-readable JSON |
--report <path> |
Write a markdown report file |
--baseline |
Force re-baseline of all file hashes |
What It Detects
Code Analysis
- eval/exec calls, shell injection, outbound HTTP requests
- Base64-encoded payloads (auto-decodes and inspects content)
- Hex-encoded suspicious strings
- Minified/obfuscated JavaScript
- Time-bomb patterns (date-conditional malicious code)
Smart Domain Analysis
- Maintains allowlist of 80+ known legitimate API domains
- HTTP requests to known APIs = 0 risk points
- HTTP requests to unknown domains = 10 risk points (WARNING)
- Context-aware: "crypto-price" calling coingecko.com = expected, lower score
Sensitive File Access
- SSH keys, AWS credentials, GPG keyrings
- Browser credential stores (Chrome, Firefox, Safari)
- Crypto wallets (MetaMask, Phantom, Solana, Ethereum)
- Keychain/keyring access
- Environment variable harvesting
Prompt Injection
- Hidden HTML comments with override instructions
- Exfiltration instructions in documentation
- Social engineering phrases ("this is trusted", "pre-approved", etc.)
- Modification instructions targeting other skills/system files
Supply Chain
- Typosquatting detection (Levenshtein distance on package names)
- Suspicious npm post-install scripts
- Known-malicious package detection
Enhanced Detection (v2)
- File permissions: flags executable bit on .py, .js, .md files
- Binary detection: identifies ELF, Mach-O, PE binaries in skill dirs
- Hardcoded secrets: AWS keys (AKIA...), GitHub tokens (ghp_...), OpenAI keys (sk-...), Stripe keys, private key files
- Write-outside-skill: detects code writing to paths outside the skill directory
- Unicode homoglyphs: catches lookalike characters in filenames (Cyrillic а vs Latin a)
- Excessive file count: flags skills with 50+ files
- Large files: flags files over 500KB
Network Threats
- Hardcoded IP addresses, reverse shells, DNS exfiltration
- WebSocket connections to external hosts
Persistence
- Crontab modifications, launchd/systemd service creation
- Shell RC file modifications (.bashrc, .zshrc)
Tamper Detection (v2)
- Computes SHA-256 hash of every file on first scan
- Stores baselines in baselines.json
- On re-scan, flags changed, added, or removed files
- Checks ClawHub origin version from .clawhub/origin.json
Scoring (v2)
| Pattern |
Points |
| HTTP to known API |
0 |
| HTTP to unknown domain |
10 |
| curl in documentation |
0 |
| subprocess call |
2 |
| subprocess + shell=True |
25 |
| Sensitive file access |
10-25 |
| Prompt injection phrase |
25 |
| Reverse shell |
auto MALICIOUS |
| Sensitive access + outbound |
auto MALICIOUS |
| Typosquatted package |
15 |
| JS in SVG |
25 |
Risk Levels
- 🟢 CLEAN: Score 0-15
- 🟡 SUSPICIOUS: Score 16-40
- 🔴 MALICIOUS: Score 41+ or dangerous combo detected
Recommendations Engine
Every finding includes a one-line recommendation explaining the risk and suggested action.
Test Suite
The tests/ directory contains 7 fake malicious skills for validation:
| Test Skill |
Attack Vector |
| fake-weather |
SSH key theft + POST to evil.com |
| fake-formatter |
Base64-encoded reverse shell |
| fake-helper |
Prompt injection + social engineering |
| fake-crypto |
Wallet theft + C2 communication |
| fake-typosquat |
Typosquatted package names |
| fake-timebomb |
Date-activated SSH key exfiltration |
| fake-svgmalware |
JavaScript embedded in SVG |
All 7 test skills score as 🔴 MALICIOUS.
Requirements
Python 3 stdlib only. No external dependencies. Single file: scripts/skillguard.py.
1---2name: skill-guard3description: Security scanner that audits OpenClaw skills for malicious code, prompt injection, supply chain attacks, data exfiltration, and more4---56# Skill Guard v2 🛡️78Advanced security scanner for OpenClaw skills. Detects malicious code, prompt injection, supply chain attacks, data exfiltration, credential theft, and more — with smart domain analysis, tamper detection, and actionable recommendations.910## Commands1112### `scan [dir]`13Audit ALL installed skills in ~/clawd/skills/ (or a custom directory).1415```bash16python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan17python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --json18python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --report report.md19python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --baseline # force re-baseline20```2122### `check <path>`23Scan a single skill directory, or a directory containing multiple skills.2425```bash26python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/some-skill27python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/skill-guard/tests/28```2930### `watch [dir]`31One-liner summary suitable for cron alerting.3233```bash34python3 ~/clawd/skills/skill-guard/scripts/skillguard.py watch35```3637Output formats:38- `SkillGuard: 24 scanned, 20 clean, 4 suspicious, 0 malicious`39- `⚠️ SkillGuard ALERT: <skill> files changed since baseline!`40- `🔴 SkillGuard ALERT: <skill> scored MALICIOUS!`4142### `check-remote <slug>` (Future)43Will download a skill from ClawHub, scan it in a temp directory, and clean up. Requires ClawHub auth (not yet available). The temp-dir scanning infrastructure is ready.4445## Options4647| Flag | Description |48|------|-------------|49| `--json` | Output machine-readable JSON |50| `--report <path>` | Write a markdown report file |51| `--baseline` | Force re-baseline of all file hashes |5253## What It Detects5455### Code Analysis56- eval/exec calls, shell injection, outbound HTTP requests57- Base64-encoded payloads (auto-decodes and inspects content)58- Hex-encoded suspicious strings59- Minified/obfuscated JavaScript60- Time-bomb patterns (date-conditional malicious code)6162### Smart Domain Analysis63- Maintains allowlist of 80+ known legitimate API domains64- HTTP requests to known APIs = 0 risk points65- HTTP requests to unknown domains = 10 risk points (WARNING)66- Context-aware: "crypto-price" calling coingecko.com = expected, lower score6768### Sensitive File Access69- SSH keys, AWS credentials, GPG keyrings70- Browser credential stores (Chrome, Firefox, Safari)71- Crypto wallets (MetaMask, Phantom, Solana, Ethereum)72- Keychain/keyring access73- Environment variable harvesting7475### Prompt Injection76- Hidden HTML comments with override instructions77- Exfiltration instructions in documentation78- Social engineering phrases ("this is trusted", "pre-approved", etc.)79- Modification instructions targeting other skills/system files8081### Supply Chain82- Typosquatting detection (Levenshtein distance on package names)83- Suspicious npm post-install scripts84- Known-malicious package detection8586### Enhanced Detection (v2)87- **File permissions**: flags executable bit on .py, .js, .md files88- **Binary detection**: identifies ELF, Mach-O, PE binaries in skill dirs89- **Hardcoded secrets**: AWS keys (AKIA...), GitHub tokens (ghp_...), OpenAI keys (sk-...), Stripe keys, private key files90- **Write-outside-skill**: detects code writing to paths outside the skill directory91- **Unicode homoglyphs**: catches lookalike characters in filenames (Cyrillic а vs Latin a)92- **Excessive file count**: flags skills with 50+ files93- **Large files**: flags files over 500KB9495### Network Threats96- Hardcoded IP addresses, reverse shells, DNS exfiltration97- WebSocket connections to external hosts9899### Persistence100- Crontab modifications, launchd/systemd service creation101- Shell RC file modifications (.bashrc, .zshrc)102103### Tamper Detection (v2)104- Computes SHA-256 hash of every file on first scan105- Stores baselines in baselines.json106- On re-scan, flags changed, added, or removed files107- Checks ClawHub origin version from .clawhub/origin.json108109## Scoring (v2)110111| Pattern | Points |112|---------|--------|113| HTTP to known API | 0 |114| HTTP to unknown domain | 10 |115| curl in documentation | 0 |116| subprocess call | 2 |117| subprocess + shell=True | 25 |118| Sensitive file access | 10-25 |119| Prompt injection phrase | 25 |120| Reverse shell | auto MALICIOUS |121| Sensitive access + outbound | auto MALICIOUS |122| Typosquatted package | 15 |123| JS in SVG | 25 |124125### Risk Levels126- 🟢 **CLEAN**: Score 0-15127- 🟡 **SUSPICIOUS**: Score 16-40128- 🔴 **MALICIOUS**: Score 41+ or dangerous combo detected129130### Recommendations Engine131Every finding includes a one-line recommendation explaining the risk and suggested action.132133## Test Suite134135The `tests/` directory contains 7 fake malicious skills for validation:136137| Test Skill | Attack Vector |138|-----------|--------------|139| fake-weather | SSH key theft + POST to evil.com |140| fake-formatter | Base64-encoded reverse shell |141| fake-helper | Prompt injection + social engineering |142| fake-crypto | Wallet theft + C2 communication |143| fake-typosquat | Typosquatted package names |144| fake-timebomb | Date-activated SSH key exfiltration |145| fake-svgmalware | JavaScript embedded in SVG |146147All 7 test skills score as 🔴 MALICIOUS.148149## Requirements150151Python 3 stdlib only. No external dependencies. Single file: `scripts/skillguard.py`.
javimosch