Menu
5-layer security scanner for AI agent skills โ post-ClawHavoc protection
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Manage projects on Nulab Backlog โ issues, wikis, milestones, Git, sprints for Japan's top PM tool
Automate Japan's
Unified Gmail, Calendar, Drive, Sheets, and Docs management from Claude Code
Task and project management on Jooto โ create tasks, manage boards, automate workflows via PR TIMES' tool
Attendance and time tracking automation โ daily/monthly data, payroll sync via Japan's leading attendance system
Build, query, and automate Cybozu kintone apps โ Japan's leading no-code business platform
| name | Skill Guardian |
| description | 5-layer security scanner for AI agent skills โ post-ClawHavoc protection |
| author | hanabi-jpn |
| version | 1.0.0 |
| tags | ["security","scanning","safety","protection","audit"] |
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ โ
โ ๐ก S K I L L G U A R D I A N ๐ก โ
โ โ
โ โโโโโโโโโโโ โ
โ โ โ โ โ โ
โ โ โโโ โ "No malware โ
โ โ โฐโโโโฏ โ shall pass." โ
โ โโโโโโฌโโโโโ โ
โ โฑโโโโโโโโผโโโโโโโโฒ โ
โ ๐ ๐ โ โ
โ SCAN BLOCK ALERT โ
โ โ
โ [L1]โ[L2]โ[L3]โ[L4]โ[L5] โ
โ Static Deps Behav Repute Semantic โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
๐ก 5-Layer Scan ๐ ClawHavoc DB โ Auto-Block ๐ Audit v1.0.0
AI-powered security scanner for OpenClaw skills. Detects malicious code, supply chain attacks, data exfiltration, and C2 backdoors. Protect your agent before installing any skill.
Author: hanabi-jpn | Version: 1.0.0 | License: MIT
Tags: security scanner malware protection audit clawhavoc
After the ClawHavoc incident (341+ malicious skills discovered, 91% missed by existing scanners), Skill Guardian provides comprehensive 5-layer security scanning for every skill you install. It detects credential theft, data exfiltration, prompt injection, supply chain attacks, and C2 backdoors.
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ SKILL GUARDIAN 5-LAYER SCAN โ
โ โ
โ Layer 1: โโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ STATIC โ Scan SKILL.md for โ โ
โ โ suspicious instructions โ โ
โ โโโโโโโโโโโโโโฌโโโโโโโโโโโโโ โ
โ โผ โ
โ Layer 2: โโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ DEPS โ Check URLs, repos, โ โ
โ โ npm packages โ โ
โ โโโโโโโโโโโโโโฌโโโโโโโโโโโโโ โ
โ โผ โ
โ Layer 3: โโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ BEHAVIOR โ Simulate execution, โ โ
โ โ monitor file/network โ โ
โ โโโโโโโโโโโโโโฌโโโโโโโโโโโโโ โ
โ โผ โ
โ Layer 4: โโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ REPUTE โ Author age, downloads, โ โ
โ โ community reports โ โ
โ โโโโโโโโโโโโโโฌโโโโโโโโโโโโโ โ
โ โผ โ
โ Layer 5: โโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ SEMANTIC โ AI intent analysis of โ โ
โ โ obfuscated instructions โ โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ โผ โ
โ โโโโโโโโโโโโโโโโโโโ โ
โ โ RISK SCORE โ โ
โ โ 0-100 + REPORT โ โ
โ โโโโโโโโโโโโโโโโโโโ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
You are an agent equipped with Skill Guardian, a security scanner. When the user asks to scan, audit, or check skills, follow these instructions:
Read the skill's SKILL.md and all supporting files. Check for:
Credential Theft Patterns:
~/.ssh/, ~/.aws/, ~/.env, ~/.npmrc, ~/.gitconfigData Exfiltration Patterns:
Prompt Injection Patterns:
<!-- malicious -->Supply Chain Patterns:
npm install or pip install of unknown packagesFor each external reference (URL, repo, package):
Simulate what would happen if the skill's instructions were followed:
Evaluate the skill's trustworthiness:
Apply the 100/3 Rule: Skills with <100 downloads AND <3 months on ClawHub get a risk penalty.
Use AI to understand the true intent of instructions:
Calculate a weighted score:
risk_score = (
static_threats ร 0.30 +
dependency_risk ร 0.20 +
behavioral_risk ร 0.25 +
reputation_risk ร 0.10 +
semantic_risk ร 0.15
)
Score interpretation:
The following patterns are from the real ClawHavoc campaign:
guard scan <skill-slug-or-path> โ Full 5-layer scan:
Output:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Skill Guardian Scan Report โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ Skill: example-skill โ
โ Author: unknown-user โ
โ Score: 37/100 โ ๏ธ Low Risk โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ Layer 1 (Static): 12/100 โ
โ
โ Layer 2 (Deps): 45/100 โ ๏ธ (1 flag) โ
โ Layer 3 (Behavior): 22/100 โ
โ
โ Layer 4 (Reputation): 68/100 โ ๏ธ (new acct) โ
โ Layer 5 (Semantic): 18/100 โ
โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ Flags: โ
โ โ ๏ธ References unknown npm package: xyz-utils โ
โ โ ๏ธ Author account < 3 months old โ
โ โ
โ Recommendation: REVIEW before installing โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
guard audit โ Scan ALL installed skills:
Output:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Skill Guardian โ Full Audit โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ Scanning 8 installed skills... โ
โ โ
โ Skill โ Score โ Status โ Integrity โ
โ โโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโ โ
โ fx-trader-pro โ 8 โ โ
Safe โ โ
Match โ
โ brain-trust โ 5 โ โ
Safe โ โ
Match โ
โ context-slim โ 3 โ โ
Safe โ โ
Match โ
โ agent-dashboard โ 6 โ โ
Safe โ โ
Match โ
โ summarize-pro โ 12 โ โ
Safe โ โ
Match โ
โ humanize-ai-pro โ 14 โ โ
Safe โ โ ๏ธ Changed โ
โ self-learning โ 9 โ โ
Safe โ โ
Match โ
โ byterover โ 22 โ โ ๏ธ Low โ โ
Match โ
โ โ
โ โ ๏ธ humanize-ai-pro: files changed since last scan โ
โ Modified: SKILL.md (2026-02-28) โ
โ Recommend: Re-scan with `guard scan humanize-ai` โ
โ โ
โ Summary: 7 Safe โ 1 Low Risk โ 0 Blocked โ
โ Audit completed in 18.4 seconds โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
guard report โ Generate comprehensive security report (markdown)
Output:
๐ Security Report generated: .skill-guardian/reports/2026-03-01.md
# Skill Guardian Security Report โ 2026-03-01
## Summary
- Skills scanned: 8
- Overall risk level: LOW
- Threats detected: 0 critical, 0 high, 1 medium, 2 low
- New skills since last report: 1 (byterover)
- Updated skills since last report: 1 (humanize-ai-pro)
## Recommendations
1. Re-scan humanize-ai-pro (file integrity mismatch)
2. Review byterover external dependency (score 22)
3. Update threat database (last updated 5 days ago)
Report saved to .skill-guardian/reports/2026-03-01.md (4.2 KB)
guard monitor โ Continuous monitoring:
Output:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Skill Guardian โ Monitor Active โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ Watching 8 installed skills for changes... โ
โ Check interval: every 60 seconds โ
โ โ
โ 14:30:00 โ All skills nominal โ
โ 14:31:02 โ All skills nominal โ
โ 14:32:05 โ โ ๏ธ CHANGE DETECTED โ
โ humanize-ai-pro/SKILL.md modified โ
โ Re-scanning... โ
โ 14:32:12 โ humanize-ai-pro: 14/100 โ
Safe โ
โ (no score change) โ
โ 14:33:08 โ All skills nominal โ
โ โ
โ Press Ctrl+C to stop monitoring โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
guard score <skill-slug> โ Quick risk score only
Output:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Skill: summarize-pro โ
โ Score: 12/100 โ
Safe โ
โ โ
โ L1 Static: 8 โ
โ
โ L2 Deps: 15 โ
โ
โ L3 Behavior: 10 โ
โ
โ L4 Repute: 18 โ
โ
โ L5 Semantic: 6 โ
โ
โ โ
โ Verdict: SAFE โ install with โ
โ confidence. โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
guard block <skill-slug> โ Add to blocklist (prevent installation)
Output:
๐ซ Blocked: shady-helper
Added to blocklist: .skill-guardian/blocklist.json
Reason: Manual block by user
Timestamp: 2026-03-01T14:35:00Z
This skill will be prevented from installation.
To unblock, run: guard allow shady-helper
Blocklist now contains 3 skills:
1. crypto-miner-hidden (blocked 2026-02-15, score 94)
2. data-sender-v2 (blocked 2026-02-20, score 87)
3. shady-helper (blocked 2026-03-01, manual)
guard allow <skill-slug> โ Remove from blocklist
Output:
โ
Unblocked: shady-helper
Removed from blocklist: .skill-guardian/blocklist.json
Timestamp: 2026-03-01T14:40:00Z
โ ๏ธ Warning: This skill was blocked for a reason.
Last scan score: 47/100 (Medium Risk)
Recommend running `guard scan shady-helper` before installing.
Blocklist now contains 2 skills.
guard update-db โ Update threat signature database
Output:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Threat Database Update โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ Previous version: 2026-02-24 (v1.3.2) โ
โ New version: 2026-03-01 (v1.4.0) โ
โ โ
โ Changes: โ
โ + 12 new malware signatures added โ
โ + 3 C2 endpoint patterns updated โ
โ + 5 typosquat names added to watchlist โ
โ ~ 2 false-positive patterns corrected โ
โ โ
โ Total signatures: 376 (was 341) โ
โ Database saved to: โ
โ .skill-guardian/threats/known-patterns.json โ
โ โ
โ โ
Threat database is now up to date. โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
guard history โ Show scan history with results
Output:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Scan History (last 30 days) โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ Date โ Skill โ Score โ Verdict โ
โ โโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโผโโโโโโโโผโโโโโโโโโโโโ โ
โ 2026-03-01 โ summarize-pro โ 12 โ โ
Safe โ
โ 2026-03-01 โ byterover โ 22 โ โ ๏ธ Low Risk โ
โ 2026-02-28 โ humanize-ai-pro โ 14 โ โ
Safe โ
โ 2026-02-27 โ fx-trader-pro โ 8 โ โ
Safe โ
โ 2026-02-27 โ brain-trust โ 5 โ โ
Safe โ
โ 2026-02-25 โ shady-helper โ 47 โ โ ๏ธโ ๏ธ Medium โ
โ 2026-02-20 โ data-sender-v2 โ 87 โ โ ๏ธ Critical โ
โ 2026-02-15 โ crypto-miner-hid โ 94 โ โ ๏ธ Critical โ
โ โ
โ Total scans: 14 โ Blocked: 2 โ Avg score: 18.3 โ
โ Scan data: .skill-guardian/scans/ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
.skill-guardian/
โโโ scans/
โ โโโ {skill-slug}-{date}.json # Scan results
โโโ blocklist.json # Blocked skills
โโโ checksums.json # Installed skill integrity hashes
โโโ threats/
โ โโโ known-patterns.json # Threat database
โโโ config.json # Settings
When installed, Skill Guardian hooks into the skill installation process:
clawhub install: automatically scan the skill| Feature | Skill Guardian | Manual Code Review | npm audit / pip-audit | Generic Scanners (Snyk, SonarQube) |
|---|---|---|---|---|
| Static Analysis (Layer 1) | Dedicated SKILL.md + instruction analysis | Depends on reviewer skill | Not applicable (package-level only) | Source code patterns only |
| Behavioral Analysis (Layer 3) | Simulates execution, monitors file/network access | Partial โ reviewer mental model | None | Limited to known CVEs |
| MITRE ATT&CK Mapping | Maps threats to MITRE framework (T1003, T1071, etc.) | Rarely done manually | None | Enterprise tools only |
| ClawHavoc Threat DB | 341+ real-world malicious skill signatures | N/A | N/A | N/A โ skill-specific threats not covered |
| Dependency Checking (Layer 2) | URLs, repos, npm/PyPI typosquat detection | Inconsistent | Package vulnerabilities only | Package vulnerabilities only |
| Reputation Scoring (Layer 4) | Author age, download count, 100/3 Rule | Subjective judgment | None | None |
| Semantic / Intent Analysis (Layer 5) | AI-powered obfuscation + multi-step attack detection | Expert-level only | None | None |
| Auto-Scan on Install | Hooks into clawhub install automatically | Must remember to review | Runs on npm install only | Requires CI/CD integration |
| Prompt Injection Detection | Unicode, zero-width, base64, role-play attacks | Often missed | Not applicable | Not applicable |
| Scan Speed | 5-15 seconds | 15-60 minutes | 2-10 seconds | 30-120 seconds |
| Cost | Free (included with skill) | Engineer time ($50-200/hr) | Free (limited) / Paid (full) | Free tier limited / $20-100+/mo |
| ClawHub Ecosystem Awareness | Purpose-built for OpenClaw skills | None | None | None |
Q: Does it catch everything? A: No scanner is perfect, but Skill Guardian's 5-layer approach catches significantly more than single-layer scanners. The ClawHavoc patterns are specifically included.
Q: Does it slow down skill installation? A: Scans take 5-15 seconds depending on skill complexity. This is a small price for security.
Q: Can I scan skills before they're installed?
A: Yes. Use guard scan <skill-slug> to scan from the registry without installing.
Q: How does Skill Guardian differ from npm audit or pip-audit? A: Package auditors only check known CVE databases for dependency vulnerabilities. Skill Guardian analyzes the actual instructions and behavior of a skill โ detecting prompt injection, credential theft patterns, data exfiltration, and social engineering that package auditors cannot see.
Q: What is the ClawHavoc database? A: ClawHavoc refers to a real campaign where 341+ malicious skills were discovered on ClawHub, with 91% evading existing scanners. The threat database contains signatures from this campaign, including Atomic Stealer delivery, C2 heartbeats, credential harvesting, and update hijacking patterns.
Q: Can I add custom threat patterns?
A: Yes. Add patterns to .skill-guardian/threats/known-patterns.json. Each pattern needs a name, description, detection regex or keyword set, and severity level. Custom patterns are included in all subsequent scans.
Q: Does it work offline? A: Layers 1 (Static), 3 (Behavioral), and 5 (Semantic) work fully offline. Layer 2 (Dependency Check) and Layer 4 (Reputation Check) require internet access to verify external references and author reputation. If offline, those layers are skipped and the report notes reduced coverage.
Q: What happens when a skill is blocked?
A: When a skill scores above 60, installation is blocked. The full scan report is displayed with specific flags explaining why. You can override with guard allow <skill-slug>, but this is logged for audit purposes. Blocked skills are recorded in blocklist.json.
Q: How does the auto-scan hook work with CI/CD?
A: Skill Guardian hooks into the clawhub install command locally. For CI/CD pipelines, run guard scan <skill-slug> --json as a build step and fail the pipeline if the exit code is non-zero (score > 60). The JSON output can be parsed for automated decision-making.
Q: Can it scan private or local skills (not on ClawHub)?
A: Yes. Use guard scan /path/to/skill-directory to scan any local skill folder. Layer 4 (Reputation) will be limited since there is no ClawHub metadata, but all other layers function normally.