Agent Skills
› EverClaw/EverClaw
› skillguard
skillguard
GitHubAgent技能安全扫描工具，检测凭证窃取、代码注入等风险。区分内外源采用不同信任模型，支持本地、批量及Hub技能扫描，提供安全评分与多格式报告。
Trigger Scenarios
评估从ClawHub下载的技能包安全性
检查第三方或不可信来源的Agent技能
审计技能是否存在凭证泄露或提示词注入风险
Install
npx skills add EverClaw/EverClaw --skill skillguard -g -y
SKILL.md
Frontmatter
{
"name": "skillguard",
"metadata": {
"openclaw": {
"requires": {
"bins": [
"node"
]
}
}
},
"description": "Security scanner for AgentSkill packages. Scan skills for credential theft, code injection, prompt manipulation, data exfiltration, and evasion techniques before installing them. Use when evaluating skills from ClawHub or any untrusted source."
}
SkillGuard — Agent Security Scanner
When asked to check, audit, or scan a skill for security, use SkillGuard.
Trust Model (v0.3)
SkillGuard distinguishes between internal (trusted) and external (untrusted) skills:
- Internal skills — Skills under
~/.openclaw/workspace/skills/or~/.openclaw/workspace/claw-repos/. These are skills we authored ourselves. - External skills — Everything else (ClawHub downloads, third-party packages, etc.)
Why it matters
Internal skills legitimately use patterns like exec(), process.env.API_KEY, fetch(), and writeFile() — that's infrastructure code doing its job. Flagging those as "suspicious" creates noise that buries real issues.
For internal skills, SkillGuard uses vulnerability-focused scanning:
- ✅ Still flags: hardcoded secrets, reverse shells, pickle deserialization, unsafe YAML, actual code obfuscation, prompt injection in operational code
- ❌ Suppresses: "uses exec", "reads env vars", "makes HTTP requests", "writes files", "references private keys" (in wallet tools), "uses sudo" (in setup scripts), behavioral compound signatures
For external skills, full paranoid threat-model scanning applies — every pattern is treated as potentially malicious.
Overriding trust
Use --untrusted to force external mode on an internal skill:
node src/cli.js scan /path/to/skill --untrusted
Commands
Scan a local skill directory
node /home/claw/.openclaw/workspace/skillguard/src/cli.js scan <path>
Scan with compact output (for chat)
node /home/claw/.openclaw/workspace/skillguard/src/cli.js scan <path> --compact
Check text for prompt injection
node /home/claw/.openclaw/workspace/skillguard/src/cli.js check "<text>"
Batch scan multiple skills
node /home/claw/.openclaw/workspace/skillguard/src/cli.js batch <directory>
Scan a ClawHub skill by slug
node /home/claw/.openclaw/workspace/skillguard/src/cli.js scan-hub <slug>
Score Interpretation
- 80-100 ✅ LOW risk — safe to install
- 50-79 ⚠️ MEDIUM — review findings before installing
- 20-49 🟠 HIGH — significant security concerns
- 0-19 🔴 CRITICAL — do NOT install without manual review
Output Formats
- Default: full text report
--compact: chat-friendly summary--json: machine-readable full report--quiet: score and verdict only
Version History
- f580bc4 Current 2026-07-25 11:17
