Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
crusty-security 0.1.4 - Renamed skill from "clawguard" to "crusty-security" with new versioning. - Updated all references, environment variables, and quarantine/log paths from "clawguard" to "crusty" for consistency. - Revised cron job instructions: now recommends `main/systemEvent` sessions except for specific dashboard jobs, simplifying setup and reducing potential execution failures. - Improved documentation for critical setup, scan workflows, skill audit, and reporting (see SKILL.md/README.md). - Fixed directory and file naming in scripts and documentation for clarity and reliability.
What This Skill Does
Scans files, directories, and installed skills for malware using ClamAV and agent-specific static analysis. Monitors agent behavior for signs of compromise, including unauthorized file modifications and suspicious processes. Audits host security posture and generates structured security reports.
Combines traditional ClamAV file scanning with AI-agent-specific static analysis, covering attack vectors like malicious skills and prompt injection that generic antivirus tools don't address.
When to use it
- Scanning a downloaded archive before opening it
- Auditing a third-party skill before installing from ClawHub
- Detecting whether an agent has been compromised by prompt injection
- Running a scheduled weekly host security audit
- Quarantining a flagged file pending manual review
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Is this downloaded file safe to open?
- 1Runs `bash scripts/scan_file.sh /path/to/file` to perform a ClamAV scan
- 2Parses JSON output for threat status and signature freshness date
- 3If clean, reports no threats detected along with the signature date
- 4If flagged, runs `bash scripts/scan_file.sh --quarantine /path/to/file` to isolate the file
- 5Reports the threat name and recommends next action: quarantine, delete, or investigate
File quarantined. Threat detected: [threat name]. Quarantine manifest updated at /tmp/crusty_quarantine/manifest.json.
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.