Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Monitors agent file access, outbound API calls, and external communications to detect suspicious behavior. Generates security reports and sends alerts with configurable severity thresholds. All processing runs locally with no external data transmission.
Runs entirely locally with no external data transmission, so sensitive operational data stays on the machine while still providing full audit trails and ML-lite anomaly detection.
When to use it
- Detecting when an agent reads credential files like .env or API key files
- Auditing outbound HTTP calls made by a running agent during a session
- Generating a daily security summary of agent activity and anomalies
- Investigating file access patterns over a specific time window after a suspected issue
- Flagging bulk file reads that match data exfiltration patterns
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'What has my agent been doing with files in the last 2 hours?'
- 1Run `agentguard start` to confirm monitoring is active
- 2Run `agentguard investigate --timerange 'last 2 hours' --type file_access`
- 3Review returned events grouped by severity level
- 4Run `agentguard alerts --last 24h --severity high` to check for flagged incidents
- 5Run `agentguard report --now` for a full activity summary
A breakdown of file access events with severity labels, any triggered alerts, and a list of accessed resource paths from the past two hours