skill-guard

Scan ClawHub skills for security vulnerabilities BEFORE installing. Use when installing new skills from ClawHub to detect prompt injections, malware payloads, hardcoded secrets, and other threats. Wraps clawhub install with mcp-scan pre-flight checks.

Install only if you are comfortable reviewing and running a shell script that stages, scans, deletes, moves, and installs skill directories. Avoid --skip-scan and --force unless you fully intend those effects, use only normal ClawHub slugs, and prefer verified package-manager installation for dependencies like uv.

Type: OpenClaw Skill Name: skill-guard Version: 1.0.2 This skill, 'skill-guard', is designed to enhance security by scanning other OpenClaw skills for vulnerabilities before installation. The `SKILL.md` documentation clearly outlines its purpose and methods, without any prompt injection attempts. The `scripts/safe-install.sh` script uses legitimate tools (`clawhub`, `uvx`, `mcp-scan`) to download skills to a temporary staging area (`/tmp`), scan them, and only install them if no security issues are detected. It does not exhibit any malicious behaviors such as data exfiltration, unauthorized remote control, or persistence mechanisms. While the installation instructions for its `uv` dependency suggest `curl | sh`, this is a common method for that specific tool and is an instruction for the user, not an action performed by the skill's core logic for a malicious payload.