skill-guard w Snyk Agent Scan

Scan ClawHub skills for security vulnerabilities BEFORE installing. Use when installing new skills from ClawHub to detect prompt injections, malware payloads...

This wrapper appears to do what it says: download a skill to /tmp, run a Snyk Agent scan, and only install if clean. Before using it: 1) Verify the uv installer source (astral.sh) and prefer installing uv/uvx from a trusted package manager if possible (avoid copy-pasting arbitrary curl | sh commands). 2) Only provide a SNYK_TOKEN with the minimal scope needed for scanning; treat it like any secret. 3) When threats are reported, inspect the staged files in /tmp and the scan report before manually moving them into your skills directory. 4) Avoid using --skip-scan except when you explicitly accept the risk. Overall the design is coherent, but runtime downloads (uvx and the scanner package) are the primary residual risk — verify those upstream projects before trusting them.

Type: OpenClaw Skill Name: skill-guard-snyk-agent-scan Version: 1.0.3 The skill-guard bundle is a security utility designed to protect OpenClaw agents by scanning other skills for vulnerabilities before installation. The primary component, scripts/safe-install.sh, implements a secure workflow by downloading skills to a temporary staging directory, scanning them using the legitimate Snyk Agent Scan tool (via uvx), and only moving them to the active workspace if no threats are detected. No evidence of data exfiltration, malicious execution, or prompt injection was found; the code logic aligns perfectly with its stated purpose of enhancing agent security.