Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Added back threat definitions reference. All checks remain self-contained with synthetic data.
What This Skill Does
Runs self-contained security checks on OpenClaw agents to test input sanitization. Covers unicode control character stripping, HTML comment injection detection, and bidi override character identification. Uses only hardcoded synthetic samples — no local files or external connections.
Requires nothing beyond Python 3, so checks run immediately with no setup, accounts, or network access.
When to use it
- Verify an agent strips zero-width unicode characters before processing user input
- Detect hidden HTML directives injected into agent context windows
- Check if filename spoofing via bidi override characters is caught
- Run a quick pre-deployment security audit on a new agent
- Validate input sanitization logic during agent development
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: run the agent hardening checks on my agent
- 1Runs unicode control character sanitization test against synthetic samples
- 2Runs HTML comment injection detection against sample strings
- 3Runs bidi override detection against sample filenames
- 4Reports pass/fail counts for each check category
Summary showing how many checks passed per category, with flagged samples highlighted