skill-guard

Scan ClawHub skills for security vulnerabilities BEFORE installing. Use when installing new skills from ClawHub to detect prompt injections, malware payloads, hardcoded secrets, and other threats. Wraps clawhub install with mcp-scan pre-flight checks.

Install only if you are comfortable letting this skill run shell commands that stage, scan, and install other skills. Review safe-install.sh first, avoid --force unless you intend to replace an existing skill, and install uv through a trusted package manager or verified installer when possible.

Type: OpenClaw Skill Name: skill-guard Version: 1.0.2 This skill, 'skill-guard', is designed to enhance security by scanning other OpenClaw skills for vulnerabilities before installation. The `SKILL.md` documentation clearly outlines its purpose and methods, without any prompt injection attempts. The `scripts/safe-install.sh` script uses legitimate tools (`clawhub`, `uvx`, `mcp-scan`) to download skills to a temporary staging area (`/tmp`), scan them, and only install them if no security issues are detected. It does not exhibit any malicious behaviors such as data exfiltration, unauthorized remote control, or persistence mechanisms. While the installation instructions for its `uv` dependency suggest `curl | sh`, this is a common method for that specific tool and is an instruction for the user, not an action performed by the skill's core logic for a malicious payload.