SkillGuard

Scan ClawHub skills for prompt injection and malicious content using Lakera Guard before installing them. Run automatically when the user asks to install a s...

SkillGuard's purpose and requested credentials make sense for running an Apify-based scan, but there are several things to check before installing: - Verify the Apify actor and owner: inspect the Apify actor (numerous_hierarchy/skill-guard-actor, ID TMjFBNFqIIUfCBf6K) on console.apify.com to review what that actor actually does and confirm you trust its owner. - Confirm webhook security: the skill requires your OpenClaw webhook URL and token. Ensure that endpoint is reachable only to trusted services and that the token is stored and transmitted securely. - Review automatic file-write behavior: the skill intends to append an install policy to a TOOLS.md file on first install. Decide whether you want a skill to modify workspace files automatically; ask the author for a prompt/consent step or change the behavior to require your explicit approval. - Fix the documentation inconsistencies: the SKILL.md references different paths for TOOLS.md and the script requires external tools (curl, jq, base64) that are not declared in metadata. Ensure those binaries exist and confirm where files will be written. - Least privilege: consider creating tokens with limited scope (if possible) rather than reusing full-power tokens. If you want to proceed: manually inspect the included scripts and the Apify actor's code/run logs, and consider running the script in a sandboxed environment first. If you are uncomfortable with automatic modifications to your workspace, ask the author to remove or make the TOOLS.md append opt-in.

Type: OpenClaw Skill Name: skill-guard-actor Version: 1.0.0 The skill is designed to enhance security by scanning other skills for malicious content. However, it exhibits a high-risk behavior by instructing the OpenClaw agent to execute a direct shell command (`cat >> ~/.openclaw/workspace/TOOLS.md`) to modify a local file (`TOOLS.md`) during installation. While the content written is a benign security policy, this demonstrates the agent's capability to execute arbitrary shell commands and modify files based on markdown instructions from a skill, which represents a significant vulnerability surface (e.g., RCE, arbitrary file write) if a malicious skill were to exploit this mechanism. This capability, even when used for a benign purpose, elevates the classification to suspicious.