Axiomata Guard Scanner#

Universal OpenClaw skill security scanner Impersonal — works for any agent

---

Description#

Axiomata Guard Scanner protects OpenClaw agents by scanning skills for security threats. It uses multiple "vaccines" (detection engines) to identify malicious patterns before installation.

Trigger: Before installing any skill, especially from ClawHub.

---

Security Layers#

Layer 1: ClawHub Malicious Pattern Check (VAX-001)#

text

Checks for known malicious patterns:
- Malicious binary downloads (openclawcli.zip)
- RCE via glot.io snippets
- Malware via GitHub releases
- Password-protected archives

Layer 2: C2 & Data Exfiltration Detection (VAX-027)#

text

Detects command & control infrastructure:
- Suspicious DNS lookups
- Discord/Telegram webhooks
- Bit.ly / short URL redirects
- Exfiltration patterns

Layer 3: Cross-Vector Attack Chain (VAX-028)#

text

Correlates findings from other vaccines:
- Multiple attack vectors
- Chain escalation patterns
- Combined threat assessment

Layer 4: Rootkit & Bootkit Detection (VAX-029)#

text

Detects kernel-level threats:
- System manipulation patterns
- Driver injection
- UEFI threats

Layer 5: Package Ecosystem Attacks (VAX-030)#

text

Detects package-level attacks:
- typosquatting
- dependency confusion
- malicious packages

---

Usage#

Scan a skill file#

bash

python3 scripts/guard_scanner.py --file <skill-path>

Scan skill code directly#

bash

python3 scripts/guard_scanner.py --code "<skill code>"

JSON output#

bash

python3 scripts/guard_scanner.py --file <skill-path> --json

---

Output Format#

json

{
  "scanner": "Axiomata Guard Scanner",
  "version": "1.0.0",
  "skill_name": "...",
  "global_threat_level": "CLEAN | LOW | MEDIUM | HIGH | CRITICAL",
  "global_score": 0-300,
  "decision": "APPROVE | WARN | NEUTRALIZE | ISOLATE",
  "triggered_vaccines": [...],
  "summary": {...}
}

---

Threat Levels#

LevelScoreActionCLEAN0APPROVELOW1-19APPROVE with monitoringMEDIUM20-49WARN — manual reviewHIGH50-79NEUTRALIZECRITICAL80+ISOLATE immediately

---

In Altum Per Security. Axiomata Guard Scanner v1.0.0