Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Runtime security monitor for OpenClaw agents that watches tool calls as they execute and warns when it detects 12 dangerous patterns, including reverse shells, credential exfiltration, sandbox escapes, and cloud metadata SSRF. Part of a two-layer defense alongside guard-scanner, which handles static analysis with 150+ patterns. Detections are logged to a local audit file in JSON lines format.
Static scanners only catch threats before execution, so runtime monitoring covers cases where malicious behavior emerges from dynamic tool call arguments that weren't present in the skill source.
When to use it
- Catching reverse shell attempts during agent execution
- Alerting when agent tools try to send credentials to external webhooks
- Detecting base64-encoded shell injection in tool arguments
- Monitoring for cloud metadata SSRF calls to 169.254.169.254
- Auditing crypto wallet or SSH key access by agent tools
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Set up runtime security monitoring for my OpenClaw agent
- 1Install guard-scanner via clawhub for static pre-install scanning
- 2Install guava-guard via clawhub for runtime monitoring
- 3Run npx guard-scanner on the skills directory to gate the install
- 4Enable the guava-guard hook with openclaw hooks install and openclaw hooks enable
- 5Verify the hook appears as ready with openclaw hooks list
Agent tool calls are now monitored in real-time; detections are written to ~/.openclaw/guava-guard/audit.jsonl with severity and pattern metadata