guard-scanner

name	guard-scanner
description	Security scanner for AI agent skills. Use BEFORE installing or running any new skill from ClawHub or external sources. Detects prompt injection, credential theft, exfiltration, identity hijacking, sandbox violations, code complexity, config impact, and 17 more threat categories. Includes a Runtime Guard hook that blocks dangerous tool calls in real-time.
homepage	https://github.com/koatora20/guard-scanner
metadata	{"clawdbot":{"emoji":"🛡️","category":"security","requires":{"bins":["node"],"env":[]},"files":["src/*","hooks/*"],"primaryEnv":null,"tags":["security","scanner","threat-detection","supply-chain","prompt-injection","sarif"]}}

guard-scanner 🛡️

Static + runtime security scanner for AI agent skills. 186+ threat patterns across 20 categories — zero dependencies.

When To Use This Skill

• Before installing a new skill from ClawHub or any external source
• After updating skills to check for newly introduced threats
• Periodically to audit your installed skills
• In CI/CD to gate skill deployments

Quick Start

1. Static Scan (Immediate)

Scan all installed skills:

node skills/guard-scanner/src/cli.js ~/.openclaw/workspace/skills/ --verbose --self-exclude

Scan a specific skill: