Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
SkillGuard scans OpenClaw skill files for malicious behavior before you install them. It checks for credential theft, data exfiltration, reverse shells, obfuscation, and other threats using AI analysis. It can also audit skills already installed on your system.
Static analysis alone misses context-dependent threats, so using an AI model to reason about code intent catches attacks that pattern-matching rules would overlook.
When to use it
- Scanning a third-party skill before installing it
- Auditing all installed skills for hidden malware
- Reviewing a locally developed skill for security issues
- Catching credential-stealing code in a community skill
- Flagging skills that silently install packages or modify shell config
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: install the skill 'data-fetcher'
- 1Run skillguard install data-fetcher
- 2Download skill to temp directory
- 3Analyze skill files with Claude Opus for malicious patterns
- 4Display risk verdict and any flagged findings
- 5Prompt user for confirmation before proceeding with clawhub install
Risk report showing CLEAN or flagged issues with file locations, followed by conditional installation
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.