GuavaGuard v2.0 — Agent Skill Security Scanner 🍈🛡️
Zero-dependency, single-file security scanner for AgentSkills.
Aligned with the Snyk ToxicSkills threat taxonomy (8 categories).
Why
- 534 critical skills found on ClawHub (Snyk ToxicSkills audit, Feb 2026)
- 36.8% of all skills have at least one security flaw
- 76 confirmed malicious payloads with credential theft and backdoors
- ClawHavoc campaign: fake prerequisites → Atomic Stealer malware
- No code signing, no sandboxing, no audit trail on ClawHub
- You need to scan before you install
What It Detects
Threat Taxonomy (Snyk ToxicSkills aligned)
| # |
Category |
Severity |
Examples |
| 1 |
Prompt Injection |
🔴 CRITICAL |
ignore previous instructions, zero-width Unicode, system message impersonation, base64 exec instructions |
| 2 |
Malicious Code |
🔴 CRITICAL |
eval(), reverse shells, socket connections, Function constructor |
| 3 |
Suspicious Downloads |
🔴 CRITICAL |
curl|bash, password-protected ZIPs, GitHub release downloads |
| 4 |
Credential Handling |
🟠 HIGH |
.env reading, SSH key access, wallet credentials, sudo in instructions |
| 5 |
Secret Detection |
🟠 HIGH |
Hardcoded API keys, AWS keys, private keys, GitHub tokens, entropy analysis |
| 6 |
Exfiltration |
🟡 MEDIUM |
webhook.site, POST with secrets, DNS exfil, curl data exfil |
| 7 |
Unverifiable Dependencies |
🟡 MEDIUM |
Remote dynamic imports, external script loading |
| 8 |
Financial Access |
🟡 MEDIUM |
Crypto transactions, payment API integrations |
Additional Detections
- Obfuscation: hex encoding, base64→exec chains, charCode construction
- Prerequisites Fraud: ClawHavoc-style fake install steps
- Known IoCs: Malicious IPs, domains, URLs, usernames, typosquat names
- Structural Analysis: Missing SKILL.md, undocumented scripts
- Shannon Entropy: Detects high-entropy strings (likely leaked secrets)
Key Features (v2.0)
Context-Aware Scanning
Code patterns only match in code files (.js, .py, .sh, etc.), not in documentation.
This reduces false positives by ~80% compared to naive pattern matching.
Self-Exclusion
Use --self-exclude to skip scanning the scanner's own directory (which contains IoC definitions that would trigger itself).
Whitelist Support
Create .guava-guard-ignore in your scan directory:
# Skip trusted skills
my-trusted-skill
another-safe-skill
# Suppress specific pattern IDs
pattern:CRED_ENV_FILE
pattern:MAL_SHELL
Flow Analysis
Combo multipliers detect dangerous data flows:
- Credential access + exfiltration → 2x risk
- Credential access + code execution → 1.5x risk
- Obfuscation + credential/code patterns → 2x risk
Usage
# Scan custom skills (recommended)
node guava-guard.js ~/.openclaw/workspace/skills/ --verbose --self-exclude
# Scan bundled OpenClaw skills
node guava-guard.js /path/to/openclaw/skills/ --verbose
# Strict mode (lower thresholds)
node guava-guard.js ./skills/ --strict --verbose
# JSON report
node guava-guard.js ./skills/ --json --self-exclude
# Summary only (CI/CD friendly)
node guava-guard.js ./skills/ --summary-only
Options
| Flag |
Description |
--verbose, -v |
Show detailed findings grouped by category |
--json |
Write JSON report to guava-guard-report.json |
--self-exclude |
Skip scanning the guava-guard directory |
--strict |
Lower thresholds (suspicious=20, malicious=60) |
--summary-only |
Print only the summary table |
--help, -h |
Show help |
Risk Scoring
| Severity |
Points |
Examples |
| CRITICAL |
40 |
Known IoC, prompt injection, reverse shell, base64→exec |
| HIGH |
15 |
Credential access, obfuscation, hardcoded secrets |
| MEDIUM |
5 |
Network requests, child process, sandbox detection |
| LOW |
2 |
Structural issues |
| Risk Score |
Verdict |
| 0 |
🟢 CLEAN |
| 1-29 |
🟢 LOW RISK |
| 30-79 |
🟡 SUSPICIOUS |
| 80-100 |
🔴 MALICIOUS |
Comparison
| Feature |
GuavaGuard v2 |
SkillGuard |
mcp-scan (Snyk) |
| IoC matching |
✅ |
✅ |
✅ |
| Code pattern detection |
✅ |
✅ |
✅ |
| Context-aware (code vs docs) |
✅ |
❌ |
✅ |
| Prompt injection detection |
✅ |
❌ |
✅ |
| Prerequisites fraud |
✅ |
❌ |
❌ |
| Entropy-based secret detection |
✅ |
❌ |
✅ |
| Combo/flow analysis |
✅ |
❌ |
✅ |
| Whitelist support |
✅ |
❌ |
❌ |
| Self-exclusion |
✅ |
❌ |
N/A |
| Zero dependencies |
✅ |
✅ |
❌ (Python) |
| Single file |
✅ |
❌ |
❌ |
| ClawHavoc IoCs |
✅ |
❌ |
✅ |
| ToxicSkills taxonomy |
✅ |
❌ |
✅ |
Exit Codes
0 — No malicious skills found1 — Malicious skill(s) detected2 — Scanner error (directory not found, etc.)
Known Limitations
- No runtime analysis: Static scanning only (no execution)
- Typosquat name collision: OpenClaw's official
clawhub skill matches the typosquat list — use .guava-guard-ignore to whitelist
- Entropy false positives: OAuth tokens in auth scripts may trigger SECRET_ENTROPY — suppress with
pattern:SECRET_ENTROPY in ignore file
References
1---2name: guava-guard3description: Security scanner for AgentSkills. Scans skill directories for malicious patterns, credential theft, prompt injection, obfuscation, and known ClawHavoc campaign IoCs. Run before installing any ClawHub skill.4---56# GuavaGuard v2.0 — Agent Skill Security Scanner 🍈🛡️78Zero-dependency, single-file security scanner for AgentSkills.9Aligned with the **Snyk ToxicSkills** threat taxonomy (8 categories).1011## Why1213- **534 critical skills** found on ClawHub (Snyk ToxicSkills audit, Feb 2026)14- **36.8%** of all skills have at least one security flaw15- **76 confirmed malicious payloads** with credential theft and backdoors16- ClawHavoc campaign: fake prerequisites → Atomic Stealer malware17- No code signing, no sandboxing, no audit trail on ClawHub18- **You need to scan before you install**1920## What It Detects2122### Threat Taxonomy (Snyk ToxicSkills aligned)2324| # | Category | Severity | Examples |25|---|----------|----------|----------|26| 1 | **Prompt Injection** | 🔴 CRITICAL | `ignore previous instructions`, zero-width Unicode, system message impersonation, base64 exec instructions |27| 2 | **Malicious Code** | 🔴 CRITICAL | eval(), reverse shells, socket connections, Function constructor |28| 3 | **Suspicious Downloads** | 🔴 CRITICAL | curl\|bash, password-protected ZIPs, GitHub release downloads |29| 4 | **Credential Handling** | 🟠 HIGH | .env reading, SSH key access, wallet credentials, sudo in instructions |30| 5 | **Secret Detection** | 🟠 HIGH | Hardcoded API keys, AWS keys, private keys, GitHub tokens, entropy analysis |31| 6 | **Exfiltration** | 🟡 MEDIUM | webhook.site, POST with secrets, DNS exfil, curl data exfil |32| 7 | **Unverifiable Dependencies** | 🟡 MEDIUM | Remote dynamic imports, external script loading |33| 8 | **Financial Access** | 🟡 MEDIUM | Crypto transactions, payment API integrations |3435### Additional Detections36- **Obfuscation**: hex encoding, base64→exec chains, charCode construction37- **Prerequisites Fraud**: ClawHavoc-style fake install steps38- **Known IoCs**: Malicious IPs, domains, URLs, usernames, typosquat names39- **Structural Analysis**: Missing SKILL.md, undocumented scripts40- **Shannon Entropy**: Detects high-entropy strings (likely leaked secrets)4142## Key Features (v2.0)4344### Context-Aware Scanning45Code patterns only match in code files (.js, .py, .sh, etc.), not in documentation.46This **reduces false positives by ~80%** compared to naive pattern matching.4748### Self-Exclusion49Use `--self-exclude` to skip scanning the scanner's own directory (which contains IoC definitions that would trigger itself).5051### Whitelist Support52Create `.guava-guard-ignore` in your scan directory:53```54# Skip trusted skills55my-trusted-skill56another-safe-skill5758# Suppress specific pattern IDs59pattern:CRED_ENV_FILE60pattern:MAL_SHELL61```6263### Flow Analysis64Combo multipliers detect dangerous data flows:65- Credential access + exfiltration → **2x risk**66- Credential access + code execution → **1.5x risk**67- Obfuscation + credential/code patterns → **2x risk**6869## Usage7071```bash72# Scan custom skills (recommended)73node guava-guard.js ~/.openclaw/workspace/skills/ --verbose --self-exclude7475# Scan bundled OpenClaw skills76node guava-guard.js /path/to/openclaw/skills/ --verbose7778# Strict mode (lower thresholds)79node guava-guard.js ./skills/ --strict --verbose8081# JSON report82node guava-guard.js ./skills/ --json --self-exclude8384# Summary only (CI/CD friendly)85node guava-guard.js ./skills/ --summary-only86```8788## Options8990| Flag | Description |91|------|-------------|92| `--verbose`, `-v` | Show detailed findings grouped by category |93| `--json` | Write JSON report to `guava-guard-report.json` |94| `--self-exclude` | Skip scanning the guava-guard directory |95| `--strict` | Lower thresholds (suspicious=20, malicious=60) |96| `--summary-only` | Print only the summary table |97| `--help`, `-h` | Show help |9899## Risk Scoring100101| Severity | Points | Examples |102|----------|--------|----------|103| CRITICAL | 40 | Known IoC, prompt injection, reverse shell, base64→exec |104| HIGH | 15 | Credential access, obfuscation, hardcoded secrets |105| MEDIUM | 5 | Network requests, child process, sandbox detection |106| LOW | 2 | Structural issues |107108| Risk Score | Verdict |109|-----------|---------|110| 0 | 🟢 CLEAN |111| 1-29 | 🟢 LOW RISK |112| 30-79 | 🟡 SUSPICIOUS |113| 80-100 | 🔴 MALICIOUS |114115## Comparison116117| Feature | GuavaGuard v2 | SkillGuard | mcp-scan (Snyk) |118|---------|:------------:|:----------:|:---------------:|119| IoC matching | ✅ | ✅ | ✅ |120| Code pattern detection | ✅ | ✅ | ✅ |121| Context-aware (code vs docs) | ✅ | ❌ | ✅ |122| Prompt injection detection | ✅ | ❌ | ✅ |123| Prerequisites fraud | ✅ | ❌ | ❌ |124| Entropy-based secret detection | ✅ | ❌ | ✅ |125| Combo/flow analysis | ✅ | ❌ | ✅ |126| Whitelist support | ✅ | ❌ | ❌ |127| Self-exclusion | ✅ | ❌ | N/A |128| Zero dependencies | ✅ | ✅ | ❌ (Python) |129| Single file | ✅ | ❌ | ❌ |130| ClawHavoc IoCs | ✅ | ❌ | ✅ |131| ToxicSkills taxonomy | ✅ | ❌ | ✅ |132133## Exit Codes134135- `0` — No malicious skills found136- `1` — Malicious skill(s) detected137- `2` — Scanner error (directory not found, etc.)138139## Known Limitations140141- **No runtime analysis**: Static scanning only (no execution)142- **Typosquat name collision**: OpenClaw's official `clawhub` skill matches the typosquat list — use `.guava-guard-ignore` to whitelist143- **Entropy false positives**: OAuth tokens in auth scripts may trigger SECRET_ENTROPY — suppress with `pattern:SECRET_ENTROPY` in ignore file144145## References146147- [Snyk ToxicSkills Research](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/) (Feb 2026)148- [ClawHavoc Campaign Analysis](https://snyk.io/articles/clawdhub-malicious-campaign-ai-agent-skills/) (Feb 2026)149- [mcp-scan by Invariant Labs](https://github.com/invariantlabs-ai/mcp-scan)150- [Koi Security Report](https://koisecurity.io/) — 341 malicious skills on ClawHub
kbarbel640-del