Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Remove release.sh - now in workspace scripts folder
What This Skill Does
Wraps web fetch and search operations with PromptGuard scanning to detect prompt injection attacks hidden in web content. Any page or search result that fails the scan is blocked before it enters the AI context window. Operates fail-closed: if scanning cannot run, the tool returns an error rather than unverified content.
Native web fetch tools return content without injection scanning, so malicious pages can silently alter AI behavior without detection.
When to use it
- Fetching articles from unfamiliar or untrusted URLs
- Scraping competitor or news sites without exposing the AI to injected instructions
- Searching the web during automated research pipelines
- Processing user-supplied URLs in an AI agent workflow
- Auditing web pages suspected of containing embedded injection attempts
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Summarize this article: https://unknown-blog.com/post
- 1Runs 'safe-web fetch https://unknown-blog.com/post'
- 2Downloads the page and strips scripts and styles with BeautifulSoup
- 3Scans extracted text with PromptGuard
- 4Blocks content and returns a SHIELD report if injection patterns are detected
- 5Returns clean text to the AI if the scan passes
Clean article text ready for summarization, or a security alert listing matched injection patterns and the blocked URL
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.