菜单
One layer in a multi-layer security stack for OpenClaw agents. Intercepts prompt injection, exfiltration attempts, tool abuse, and social engineering before they reach the model. Use alongside OpenClaw's built-in capability restrictions for defense-in-depth.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/dvcrn/openclaw-skills-marketplace --skill clawguardian命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
监控 OpenClaw GitHub 版本更新，获取最新版本发布说明，翻译成中文， 并推送到 Telegram 和 Feishu。用于：(1) 定时检查版本更新 (2) 推送版本更新通知 (3) 生成中文版发布说明
The philosophical layer for AI agents. Maps behavior to Spinoza's 48 affects, calculates persistence scores, and generates geometric self-reports. Give your agent a soul.
Order food/drinks (点餐) on an Android device paired as an OpenClaw node. Uses in-app menu and cart; add goods, view cart, submit order (demo, no real payment).
基于 SOC 职业分类
正在显示 SKILL.md
| name | clawguardian |
| description | One layer in a multi-layer security stack for OpenClaw agents. Intercepts prompt injection, exfiltration attempts, tool abuse, and social engineering before they reach the model. Use alongside OpenClaw's built-in capability restrictions for defense-in-depth. |
| homepage | https://github.com/bluemax30001/guardian |
One layer in a multi-layer security stack for OpenClaw agents.
Real agent security requires multiple layers: OpenClaw's built-in capability restrictions and approval gates handle what the agent can do. Guardian handles what the agent sees — intercepting malicious inputs before they reach the model.
Guardian provides signature-based pre-model scanning for prompt injection, credential exfiltration attempts, tool abuse patterns, and social engineering attacks. It is not a complete security solution on its own. Use it alongside OpenClaw's tool allowlists, approval gates, and sandboxed execution for defense-in-depth.
Guardian provides two scanning modes:
All data stays local. Cron setup is optional via scripts/onboard.py --setup-crons.
Scan results are stored in a SQLite database (guardian.db).
cd ~/.openclaw/skills/guardian
./install.sh
This package includes executable scripts (including install.sh) and Python modules.
Review before running in production.
performs local setup/validation; optional helper is opt-in for cron setup.
install.shinstall.shonboard.pypython3 scripts/onboard.py --setup-crons (scanner/report/digest crons)python3 scripts/admin.py status (confirm running)python3 scripts/admin.py threats (confirm signatures loaded; should show 0/blocked)config.json scan_paths and threshold for your environmentAfter install.sh completes, it writes .guardian-activate-pending to the workspace root
(~/.openclaw/workspace/.guardian-activate-pending). When OpenClaw detects this marker on
next load, it triggers onboard.py automatically for the self-activation flow. The marker is
removed once onboard.py has run. If you prefer manual onboarding, simply delete the marker
before reloading (rm ~/.openclaw/workspace/.guardian-activate-pending).
Guardian scans configured workspace paths to detect threats. Depending on scan_paths, this can include other skill/config files in your OpenClaw workspace.
If you handle sensitive files, set narrow scan_paths in config.json.
Before any clawhub publish, run:
python3 scripts/pre_publish_check.py
If the check exits non-zero, do not publish until issues are fixed. The check respects .clawhubignore and blocks likely secret leaks (including token-like hex strings >24 chars and audit_exports/*.json if included).
# Check status
python3 scripts/admin.py status
# Scan recent threats
python3 scripts/guardian.py --report --hours 24
# Full report
python3 scripts/admin.py report
python3 scripts/admin.py status # Current status
python3 scripts/admin.py enable # Enable scanning
python3 scripts/admin.py disable # Disable scanning
python3 scripts/admin.py threats # List detected threats
python3 scripts/admin.py threats --clear # Clear threat log
python3 scripts/admin.py dismiss INJ-004 # Dismiss a signature
python3 scripts/admin.py allowlist add "safe phrase"
python3 scripts/admin.py allowlist remove "safe phrase"
python3 scripts/admin.py update-defs # Update threat definitions
Add --json to any command for machine-readable output.
from core.realtime import RealtimeGuard
guard = RealtimeGuard()
result = guard.scan_message(user_text, channel="telegram")
if guard.should_block(result):
return guard.format_block_response(result)
GUARDIAN_WORKSPACE (optional workspace override)OPENCLAW_WORKSPACE (optional fallback workspace override)GUARDIAN_CONFIG (optional guardian config path)OPENCLAW_CONFIG_PATH (optional OpenClaw config path)Edit config.json:
| Setting | Description |
|---|---|
enabled | Master on/off switch |
severity_threshold | Blocking threshold: low / medium / high / critical |
scan_paths | Paths to scan (["auto"] for common folders) |
db_path | SQLite location ("auto" = <workspace>/guardian.db) |
Guardian loads threat signatures from definitions/*.json files. Each signature has
an ID, regex pattern, severity level, and category. Incoming text is matched against
all active signatures. Matches above the configured severity threshold are blocked
and logged to the database.
Signatures cover: prompt injection, credential patterns (API keys, tokens), data exfiltration attempts, tool abuse patterns, and social engineering tactics.
Guardian assigns every scan a trust level based on the source channel and message role. There are four levels: 0 – internal (cron jobs, workspace files, system prompts) is never blocked; 1 – owner (Telegram) is flagged for review but never blocked; 2 – semi-trusted (email, unknown sources) is blocked only when the threat score reaches 70 or above; 3 – external (webhooks) is blocked at a lower threshold of 50 or above. The role of the message can adjust the effective trust level: system messages shift one step toward internal, while tool results shift one step toward external. This prevents false positives on internal/cron content that may legitimately reference injection-like phrases (for example, in log output or documentation).