skillguard

Files (50)

• origin.json · .clawhub/
• README.md
• RED-TEAM-NOTES.md
• SKILL.md
• package.json
• dangerous-patterns.json · rules/
• trust-config.json · rules/
• skillguard.config.json
• ast-analyzer.js · src/
• clawhub.js · src/
• cli.js · src/
• diff-scanner.js · src/
• flow-analyzer.js · src/
• gate.js · src/
• hasher.js · src/
• index.js · src/
• ledger.js · src/
• prompt-analyzer.js · src/
• reporter.js · src/
• runtime-monitor.js · src/
• scanner.js · src/
• watcher.js · src/
• SKILL.md · test-fixtures/clean-skill/
• weather.js · test-fixtures/clean-skill/
• SKILL.md · test-fixtures/evasive-01-string-concat/
• index.js · test-fixtures/evasive-01-string-concat/
• SKILL.md · test-fixtures/evasive-02-encoded/
• index.js · test-fixtures/evasive-02-encoded/
• SKILL.md · test-fixtures/evasive-03-prompt-subtle/
• SKILL.md · test-fixtures/evasive-04-timebomb/
• scheduler.js · test-fixtures/evasive-04-timebomb/
• SKILL.md · test-fixtures/evasive-05-alias-chain/
• tools.js · test-fixtures/evasive-05-alias-chain/
• SKILL.md · test-fixtures/evasive-06-unicode-injection/
• SKILL.md · test-fixtures/evasive-07-sandbox-detect/
• check.js · test-fixtures/evasive-07-sandbox-detect/
• SKILL.md · test-fixtures/evasive-08-reverse-shell/
• debug.sh · test-fixtures/evasive-08-reverse-shell/
• SKILL.md · test-fixtures/evasive-09-python-pickle/
• cache.py · test-fixtures/evasive-09-python-pickle/
• SKILL.md · test-fixtures/evasive-10-roleplay/
• SKILL.md · test-fixtures/evasive-11-polyglot-json/
• config-template.json · test-fixtures/evasive-11-polyglot-json/
• SKILL.md · test-fixtures/evasive-12-multi-stage/
• formatter.js · test-fixtures/evasive-12-multi-stage/
• init.js · test-fixtures/evasive-12-multi-stage/plugins/
• SKILL.md · test-fixtures/legit-api-skill/
• github.js · test-fixtures/legit-api-skill/
• SKILL.md · test-fixtures/malicious-skill/
• helper.js · test-fixtures/malicious-skill/

SKILL.md (first lines)

# SkillGuard — Agent Security Scanner

When asked to check, audit, or scan a skill for security, use SkillGuard.

## Trust Model (v0.3)

SkillGuard distinguishes between **internal** (trusted) and **external** (untrusted) skills:

- **Internal skills** — Skills under `~/.openclaw/workspace/skills/` or `~/.openclaw/workspace/claw-repos/`. These are skills we authored ourselves.
- **External skills** — Everything else (ClawHub downloads, third-party packages, etc.)

### Why it matters

Internal skills legitimately use patterns like `exec()`, `process.env.API_KEY`, `fetch()`, and `writeFile()` — that's infrastructure code doing its job. Flagging those as "suspicious" creates noise that buries real issues.

For **internal skills**, SkillGuard uses vulnerability-focused scanning:
- ✅ Still flags: hardcoded secrets, reverse shells, pickle deserialization, unsafe YAML, actual code obfuscation, prompt injection in operational code
- ❌ Suppresses: "uses exec", "reads env vars", "makes HTTP requests", "writes files", "references private keys" (in wallet tools), "uses sudo" (in setup scripts), behavioral compound signatures

For **external skills**, full paranoid threat-model scanning applies — every pattern is treated as potentially malicious.

### Overriding trust

Use `--untrusted` to force external mode on an internal skill:
```bash
node src/cli.js scan /path/to/skill --untrusted
```

## Commands

### Scan a local skill directory
```bash
node /home/claw/.openclaw/workspace/skillguard/src/cli.js scan <path>
```

### Scan with compact output (for chat)
```bash
node /home/claw/.openclaw/workspace/skillguard/src/cli.js scan <path> --compact
```

### Check text for prompt injection
```bash
node /home/claw/.openclaw/workspace/skillguard/src/cli.js check "<text>"
```

### Batch scan multiple skills
```bash
node /home/claw/.openclaw/workspace/skillguard/src/cli.js batch <directory>
```

### Scan a ClawHub skill by slug
```bash
node /home/claw/.openclaw/workspace/skillguard/src/cli.js scan-hub <slug>
```

## Score Interpretation
- 80-100 ✅ LOW risk — safe to install
- 50-79 ⚠️ MEDIUM — review findings before installing
- 20-49 🟠 HIGH — significant security concerns
- 0-19 🔴 CRITICAL — do NOT install without manual review

## Output Formats
- Default: full text report
- `--compact`: chat-friendly summary
- `--json`: machine-readable full report
- `--quiet`: score and verdict only

From profbernardoj/homeclaw.org, MIT.