SkillGuard#

Security scanner for OpenClaw agent skills.

What It Does#

SkillGuard audits agent skills from ClawHub before you install them, detecting:

• Dangerous code patterns (command injection, eval usage)
• File system access risks
• Network call vulnerabilities
• Suspicious shell commands
• Known vulnerable dependencies

Usage#

CLI#

bash

# Audit by skill name
npx skillguard-audit --name <skill-slug>

# Audit local skill folder
npx skillguard-audit --path ./my-skill

API Server#

bash

# Start the API server
npx skillguard-audit serve --port 3402

# Audit via API
curl -X POST http://localhost:3402/api/audit -d '{"name": "some-skill"}'

Verdict#

RatingMeaning🟢 SAFENo significant security issues🟡 CAUTIONPotential risks, review recommended🔴 DANGEROUSHigh-risk patterns, do not install

Integration#

See CLAWHUB_INTEGRATION.md for ClawHub integration patterns.

Example Output#

json

{
  "skill": "some-skill",
  "verdict": "CAUTION",
  "score": 65,
  "risks": [
    {"type": "shell_command", "severity": "medium", "file": "index.js", "line": 42}
  ]
}