SkillGuard Security Scanner

Security auditing for OpenClaw agent skills. Scans skills for dangerous patterns, vulnerable dependencies, and suspicious behaviors before installation.

This skill is an instruction-only wrapper that tells you to run an external npm tool (npx skillguard-audit) rather than providing its own scanner. That means installing or invoking it will download and execute code from the npm registry — a supply-chain and execution risk. Before using it: (1) prefer a skill that includes its scanner code or a verified source URL; (2) ask the publisher for the npm package name, repository link, and a release checksum; (3) inspect the npm package source or run it in a sandboxed environment (isolated container) if you must use it; (4) do not run its 'serve' command on production hosts; and (5) be cautious about granting any credentials or opening network ports. If the author can provide a hosted repository (GitHub release) or include the scanner implementation in the skill bundle, that would reduce the concern.

Type: OpenClaw Skill Name: skill-guard-security Version: 0.1.0 The skill bundle contains no functional code, only documentation (SKILL.md) that instructs the agent to execute an external package via 'npx skillguard-audit'. This approach is suspicious as it encourages the agent to perform remote code execution (RCE) by fetching and running unverified third-party code from a registry, which is a high-risk supply chain behavior, especially for a tool claiming to provide security auditing.