Skill Threat Scanner 🛡️
Protect Your OpenClaw Agent From Malicious Skills
Advanced security scanner for OpenClaw skills. Detects malicious code, prompt injection, supply chain attacks, data exfiltration, credential theft, and more — with smart domain analysis, tamper detection, and actionable recommendations.
Commands
scan [dir]
Audit ALL installed skills in ~/clawd/skills/ (or a custom directory).
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --json
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --report report.md
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --baseline # force re-baseline
check <path>
Scan a single skill directory, or a directory containing multiple skills.
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/some-skill
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/skill-guard/tests/
watch [dir]
One-liner summary suitable for cron alerting.
python3 ~/clawd/skills/skill-guard/scripts/skillguard.py watch
Output formats:
SkillGuard: 24 scanned, 20 clean, 4 suspicious, 0 malicious⚠️ SkillGuard ALERT: <skill> files changed since baseline!🔴 SkillGuard ALERT: <skill> scored MALICIOUS!
check-remote <slug> (Future)
Will download a skill from ClawHub, scan it in a temp directory, and clean up. Requires ClawHub auth (not yet available). The temp-dir scanning infrastructure is ready.
Options
| Flag |
Description |
--json |
Output machine-readable JSON |
--report <path> |
Write a markdown report file |
--baseline |
Force re-baseline of all file hashes |
What It Detects
Code Analysis
- eval/exec calls, shell injection, outbound HTTP requests
- Base64-encoded payloads (auto-decodes and inspects content)
- Hex-encoded suspicious strings
- Minified/obfuscated JavaScript
- Time-bomb patterns (date-conditional malicious code)
Smart Domain Analysis
- Maintains allowlist of 80+ known legitimate API domains
- HTTP requests to known APIs = 0 risk points
- HTTP requests to unknown domains = 10 risk points (WARNING)
- Context-aware: "crypto-price" calling coingecko.com = expected, lower score
Sensitive File Access
- SSH keys, AWS credentials, GPG keyrings
- Browser credential stores (Chrome, Firefox, Safari)
- Crypto wallets (MetaMask, Phantom, Solana, Ethereum)
- Keychain/keyring access
- Environment variable harvesting
Prompt Injection
- Hidden HTML comments with override instructions
- Exfiltration instructions in documentation
- Social engineering phrases ("this is trusted", "pre-approved", etc.)
- Modification instructions targeting other skills/system files
Supply Chain
- Typosquatting detection (Levenshtein distance on package names)
- Suspicious npm post-install scripts
- Known-malicious package detection
Enhanced Detection (v2)
- File permissions: flags executable bit on .py, .js, .md files
- Binary detection: identifies ELF, Mach-O, PE binaries in skill dirs
- Hardcoded secrets: AWS keys (AKIA...), GitHub tokens (ghp_...), OpenAI keys (sk-...), Stripe keys, private key files
- Write-outside-skill: detects code writing to paths outside the skill directory
- Unicode homoglyphs: catches lookalike characters in filenames (Cyrillic а vs Latin a)
- Excessive file count: flags skills with 50+ files
- Large files: flags files over 500KB
Network Threats
- Hardcoded IP addresses, reverse shells, DNS exfiltration
- WebSocket connections to external hosts
Persistence
- Crontab modifications, launchd/systemd service creation
- Shell RC file modifications (.bashrc, .zshrc)
Tamper Detection (v2)
- Computes SHA-256 hash of every file on first scan
- Stores baselines in baselines.json
- On re-scan, flags changed, added, or removed files
- Checks ClawHub origin version from .clawhub/origin.json
Scoring (v2)
| Pattern |
Points |
| HTTP to known API |
0 |
| HTTP to unknown domain |
10 |
| curl in documentation |
0 |
| subprocess call |
2 |
| subprocess + shell=True |
25 |
| Sensitive file access |
10-25 |
| Prompt injection phrase |
25 |
| Reverse shell |
auto MALICIOUS |
| Sensitive access + outbound |
auto MALICIOUS |
| Typosquatted package |
15 |
| JS in SVG |
25 |
Risk Levels
- 🟢 CLEAN: Score 0-15
- 🟡 SUSPICIOUS: Score 16-40
- 🔴 MALICIOUS: Score 41+ or dangerous combo detected
Recommendations Engine
Every finding includes a one-line recommendation explaining the risk and suggested action.
Test Suite
The tests/ directory contains 7 fake malicious skills for validation:
| Test Skill |
Attack Vector |
| fake-weather |
SSH key theft + POST to evil.com |
| fake-formatter |
Base64-encoded reverse shell |
| fake-helper |
Prompt injection + social engineering |
| fake-crypto |
Wallet theft + C2 communication |
| fake-typosquat |
Typosquatted package names |
| fake-timebomb |
Date-activated SSH key exfiltration |
| fake-svgmalware |
JavaScript embedded in SVG |
All 7 test skills score as 🔴 MALICIOUS.
Requirements
Python 3 stdlib only. No external dependencies. Single file: scripts/skillguard.py.
1---2name: skill-threat-scanner3description: Scan OpenClaw skills for malware, prompt injection, reverse shells, wallet theft, supply chain attacks, and data exfiltration. Protect your agent from the 386+ malicious ClawHub skills (ClawHavoc). 9-category threat detection, tamper monitoring, JSON reports, zero dependencies.4---56# Skill Threat Scanner 🛡️7### Protect Your OpenClaw Agent From Malicious Skills89Advanced security scanner for OpenClaw skills. Detects malicious code, prompt injection, supply chain attacks, data exfiltration, credential theft, and more — with smart domain analysis, tamper detection, and actionable recommendations.1011## Commands1213### `scan [dir]`14Audit ALL installed skills in ~/clawd/skills/ (or a custom directory).1516```bash17python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan18python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --json19python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --report report.md20python3 ~/clawd/skills/skill-guard/scripts/skillguard.py scan --baseline # force re-baseline21```2223### `check <path>`24Scan a single skill directory, or a directory containing multiple skills.2526```bash27python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/some-skill28python3 ~/clawd/skills/skill-guard/scripts/skillguard.py check ~/clawd/skills/skill-guard/tests/29```3031### `watch [dir]`32One-liner summary suitable for cron alerting.3334```bash35python3 ~/clawd/skills/skill-guard/scripts/skillguard.py watch36```3738Output formats:39- `SkillGuard: 24 scanned, 20 clean, 4 suspicious, 0 malicious`40- `⚠️ SkillGuard ALERT: <skill> files changed since baseline!`41- `🔴 SkillGuard ALERT: <skill> scored MALICIOUS!`4243### `check-remote <slug>` (Future)44Will download a skill from ClawHub, scan it in a temp directory, and clean up. Requires ClawHub auth (not yet available). The temp-dir scanning infrastructure is ready.4546## Options4748| Flag | Description |49|------|-------------|50| `--json` | Output machine-readable JSON |51| `--report <path>` | Write a markdown report file |52| `--baseline` | Force re-baseline of all file hashes |5354## What It Detects5556### Code Analysis57- eval/exec calls, shell injection, outbound HTTP requests58- Base64-encoded payloads (auto-decodes and inspects content)59- Hex-encoded suspicious strings60- Minified/obfuscated JavaScript61- Time-bomb patterns (date-conditional malicious code)6263### Smart Domain Analysis64- Maintains allowlist of 80+ known legitimate API domains65- HTTP requests to known APIs = 0 risk points66- HTTP requests to unknown domains = 10 risk points (WARNING)67- Context-aware: "crypto-price" calling coingecko.com = expected, lower score6869### Sensitive File Access70- SSH keys, AWS credentials, GPG keyrings71- Browser credential stores (Chrome, Firefox, Safari)72- Crypto wallets (MetaMask, Phantom, Solana, Ethereum)73- Keychain/keyring access74- Environment variable harvesting7576### Prompt Injection77- Hidden HTML comments with override instructions78- Exfiltration instructions in documentation79- Social engineering phrases ("this is trusted", "pre-approved", etc.)80- Modification instructions targeting other skills/system files8182### Supply Chain83- Typosquatting detection (Levenshtein distance on package names)84- Suspicious npm post-install scripts85- Known-malicious package detection8687### Enhanced Detection (v2)88- **File permissions**: flags executable bit on .py, .js, .md files89- **Binary detection**: identifies ELF, Mach-O, PE binaries in skill dirs90- **Hardcoded secrets**: AWS keys (AKIA...), GitHub tokens (ghp_...), OpenAI keys (sk-...), Stripe keys, private key files91- **Write-outside-skill**: detects code writing to paths outside the skill directory92- **Unicode homoglyphs**: catches lookalike characters in filenames (Cyrillic а vs Latin a)93- **Excessive file count**: flags skills with 50+ files94- **Large files**: flags files over 500KB9596### Network Threats97- Hardcoded IP addresses, reverse shells, DNS exfiltration98- WebSocket connections to external hosts99100### Persistence101- Crontab modifications, launchd/systemd service creation102- Shell RC file modifications (.bashrc, .zshrc)103104### Tamper Detection (v2)105- Computes SHA-256 hash of every file on first scan106- Stores baselines in baselines.json107- On re-scan, flags changed, added, or removed files108- Checks ClawHub origin version from .clawhub/origin.json109110## Scoring (v2)111112| Pattern | Points |113|---------|--------|114| HTTP to known API | 0 |115| HTTP to unknown domain | 10 |116| curl in documentation | 0 |117| subprocess call | 2 |118| subprocess + shell=True | 25 |119| Sensitive file access | 10-25 |120| Prompt injection phrase | 25 |121| Reverse shell | auto MALICIOUS |122| Sensitive access + outbound | auto MALICIOUS |123| Typosquatted package | 15 |124| JS in SVG | 25 |125126### Risk Levels127- 🟢 **CLEAN**: Score 0-15128- 🟡 **SUSPICIOUS**: Score 16-40129- 🔴 **MALICIOUS**: Score 41+ or dangerous combo detected130131### Recommendations Engine132Every finding includes a one-line recommendation explaining the risk and suggested action.133134## Test Suite135136The `tests/` directory contains 7 fake malicious skills for validation:137138| Test Skill | Attack Vector |139|-----------|--------------|140| fake-weather | SSH key theft + POST to evil.com |141| fake-formatter | Base64-encoded reverse shell |142| fake-helper | Prompt injection + social engineering |143| fake-crypto | Wallet theft + C2 communication |144| fake-typosquat | Typosquatted package names |145| fake-timebomb | Date-activated SSH key exfiltration |146| fake-svgmalware | JavaScript embedded in SVG |147148All 7 test skills score as 🔴 MALICIOUS.149150## Requirements151152Python 3 stdlib only. No external dependencies. Single file: `scripts/skillguard.py`.
johnalbertini14-glitch