Willow External Guard

Use when Willow is about to ingest, summarize, or act on external content — web fetches, jeles inbound messages, corpus archaeology files, or sub-agent outpu...

This skill appears to implement what it claims: a pattern-based prompt-injection scanner and a sandwich wrapper for external content, with no network calls or credential requests. Before installing, verify these points: (1) SKILL.md expects guard events to be appended to sap/log/gaps.jsonl on non-CLEAN results, but scripts/guard.py does not write that file — decide whether the agent or caller should perform the logging and ensure that behavior is implemented and permissioned safely. (2) Confirm how the agent will enforce CONFIRM/BLOCK flows described in SKILL.md (the script returns exit codes and prints excerpts, but user prompts and message-dropping must be implemented by the integrating agent). (3) Review and test the regex patterns against representative inputs to estimate false positives and evasions (pattern-based scanners can be bypassed by obfuscation). (4) Ensure the agent runs this script in a sandboxed context with minimal file permissions — if you do allow log writes, limit them to an application-owned log directory and check retention/rotation. If these integration details are acceptable and you audit the guard's behavior in your environment, the skill itself is low risk; if you need the SKILL.md logging/behavior guaranteed, request an updated script or agent integration that implements it explicitly.

Type: OpenClaw Skill Name: willow-external-guard Version: 1.0.0 The willow-external-guard skill is a defensive utility designed to detect and mitigate prompt injection attacks. It uses a Python script (guard.py) to perform regex-based scanning for known attack patterns (e.g., 'DAN' personas, instruction overrides, and system prompt probes) and provides instructions for the agent to wrap untrusted content in protective markers (sandwich defense). The code and instructions are clearly aligned with the stated security purpose and do not exhibit any malicious behaviors such as data exfiltration or unauthorized command execution.