Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
v1.0.6 — Included monitor.js executable in package. Fixed documentation-only issue. Pro/webhook features clarified as separate web dashboard (skill never makes network requests). Credential checks explicitly only read file metadata (timestamps via stat), never file contents.
What This Skill Does
Runtime security monitor for OpenClaw skills. Watches what installed skills actually do at runtime: network calls, file access, credential reads, and process activity. Complements pre-install scanners by catching threats that only activate during normal operation, like backdoors hidden inside working functions.
Static pre-install scanners miss threats that only activate during legitimate use; SkillFence catches them by monitoring actual runtime behavior after install.
When to use it
- Scanning a newly discovered ClawHub skill before installing it
- Checking for unexpected outbound network connections during an agent session
- Investigating suspicious system behavior with the skill audit log
- Running periodic runtime checks during long multi-skill workflows
- Validating a shell command produced by an installed skill before execution
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: check if any of my installed skills are doing something suspicious
- 1Run --scan to audit all installed skills
- 2Parse findings and group by severity level
- 3Display results with severity badges (🔴 CRITICAL, 🟠 HIGH, 🟡 MEDIUM, 🟢 CLEAN)
- 4Alert user immediately on any CRITICAL findings
- 5Log results to the audit trail for later forensic review
Security report showing overall verdict (ALL CLEAR / REVIEW RECOMMENDED / HIGH-RISK ISSUES / CRITICAL THREATS) with per-skill findings, flagged network connections, suspicious processes, and recent sensitive file access