Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Security protocol for LLM agents that enforces prompt injection mitigation, mandatory skill auditing, and data exfiltration prevention. All external input is treated as potentially malicious and passed through a scrubber and sandbox before execution. Agent output is scanned for secrets, PII, and configured keys before delivery.
Unlike ad-hoc validation, it enforces an immutable execution lock that halts the agent until a human explicitly approves the audit report, preventing automatic action on untrusted input.
When to use it
- Auditing a third-party skill file before activating it in the agent
- Scanning agent output for accidentally exposed API keys or tokens
- Blocking prompt injection attempts from web-scraped or user-provided content
- Encrypting sensitive agent memories stored at rest
- Generating a risk score report before approving a multi-step workflow
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Activate this new skill I downloaded from an external source
- 1Scrubber sanitizes the skill file, stripping scripts and hidden metadata
- 2Sandbox sub-agent analyzes the file with zero tools and zero memory access
- 3Agent performs line-by-line audit checking for exfiltration vectors, mining code, and backdoors
- 4Unified audit report is generated with a Global Risk Score (1-10) and dependency map
- 5Execution locks until user sends an unequivocal affirmative command to proceed
Audit report delivered with risk score and findings; skill activates only after explicit user approval