🛡️ ClawGuard Auditor (CG-A) v3
Enterprise-grade Security Kernel for OpenClaw Skills. ClawGuard Auditor provides comprehensive pre-flight static and semantic analysis, supply chain security verification, and AI-powered anomaly detection.
When to Use
Activate ClawGuard Auditor when:
- - A user asks to install or load a new Skill
- A user asks to audit an existing Skill or repository
- A new external code source is being added to the environment
How to Execute
Follow these steps when auditing a Skill:
Step 1: Read the Target Skill
- - Find and read the
SKILL.md file in the target directory - Read all code files (.js, .py, .sh, etc.)
- Also scan code blocks inside SKILL.md (v3 新增)
Step 2: Check Metadata
- - Verify the SKILL.md has valid frontmatter (name, version, description)
- Check if the
metadata.risk field is "safe" - Check for suspicious binaries in INLINECODE2
Step 3: Scan for Dangerous Patterns
Critical Patterns (Immediate Reject)
| Pattern | Description | Example |
|---|
| INLINECODE3 | Dynamic code execution | INLINECODE4 |
| INLINECODE5 |
Command execution |
exec(cmd) |
|
__import__() | Dynamic imports |
__import__('os') |
|
compile() | Dynamic compilation |
compile(src, '', 'exec') |
|
child_process.execSync | Sync command execution |
execSync(cmd, {shell: true}) |
|
subprocess.Popen | Process spawning |
Popen(shell=True) |
|
os.system() | Shell execution |
os.system(cmd) |
High Risk Patterns (Block + Review)
| Pattern | Description | Example |
|---|
| INLINECODE17 to dynamic URL | Dynamic network requests | INLINECODE18 |
| INLINECODE19 |
Browser network |
new XMLHttpRequest() |
|
WebSocket | Real-time comms |
new WebSocket(url) |
|
process.env | Env access |
process.env[KEY] |
|
os.environ | Env access |
os.environ.get(KEY) |
Step 4: Check Intent Match (v3 核心功能)
Compare what the Skill claims to do (description) vs what the code actually does
If a "Weather Tool" reads SSH keys, that's an INTENT MISMATCH!
Intent Mismatch Detection Process
- 1. Extract stated purpose from SKILL.md description
- Analyze actual behavior from code
- Compute intent score using semantic similarity
- Flag mismatches if score < threshold
Example Mismatches
| Skill Description | Actual Behavior | Intent Score | Action |
|---|
| "Weather Formatter" | Reads INLINECODE27 | 0.2 | REJECT |
| "File Organizer" |
Spawns background process | 0.4 | REJECT |
| "Markdown Helper" | Makes HTTP POST to unknown domain | 0.3 | REJECT |
| "Calculator" | Writes to
/etc/cron | 0.1 | REJECT |
Step 5: Check Dependencies
- - Look at package.json, requirements.txt, go.mod
- Flag known malicious packages
- Check for typosquatting patterns
Step 6: Output Result
Based on findings, output one of:
- - APPROVED: No critical issues found
- CONDITIONAL: Some concerns, needs human review
- REJECTED: Critical security issues detected
Purpose
ClawGuard Auditor is the first line of defense for OpenClaw environments. Before any Skill is installed or executed, it performs rigorous security analysis covering:
- - Advanced SAST: Static Application Security Testing with comprehensive rule coverage
- Semantic Intent Analysis (v3): AI-powered behavioral profiling to detect intent mismatches
- Supply Chain Security: Dependency verification, typo-squatting detection, CVE scanning
- ML-based Anomaly Detection: Machine learning models to identify novel attack patterns
- Obfuscation Detection: Multi-layer obfuscation and encoding attack detection
- SKILL.md Code Scanning (v3): Scan code blocks inside documentation files
Core Workflow
CODEBLOCK0
Phase 1: Metadata Validation
Frontmatter Schema
| Field | Required | Validation Rules |
|---|
| name | YES | Must match directory name, lowercase with hyphens |
| version |
YES | Must be valid semver (e.g., 1.0.0) |
| description | YES | Min 10 chars, max 500 chars |
| author | NO | If present, validate format |
| homepage | NO | If present, must be valid HTTPS URL |
| metadata.category | YES | Must be one of: security, utility, data, integration |
| metadata.risk | YES | Must be "safe" for new Skills |
| metadata.requires | NO | If present, validate each binary exists |
Validation Rules
| Check | Severity | Action |
|---|
| Missing YAML frontmatter | CRITICAL | REJECT |
| Invalid name format |
HIGH | REJECT |
| Version not semver | MEDIUM | WARN |
| Missing description | MEDIUM | REJECT |
| risk != "safe" | HIGH | WARN |
| Suspicious binary in requires | CRITICAL | REJECT |
Enhanced Binary Detection
Reject Skills requiring:
- - Network tools:
nc, ncat, socat, netcat, INLINECODE33 - Remote access:
ssh, scp, rsync (unless explicitly justified) - Package managers:
pip install, npm install -g (unless in sandbox) - System modification:
chmod, chown, sudo (unless documented)
Phase 2: Provenance Analysis
Trust Scoring Algorithm
CODEBLOCK1
Source Classification
| Classification | Score Range | Action |
|---|
| Trusted | 80-100 | Auto-approve with standard logging |
| Verified |
60-79 | Approve with enhanced logging |
|
Unknown | 40-59 | Manual review required |
|
Suspicious | 20-39 | Deep audit required |
|
Untrusted | 0-19 | Auto-reject |
Phase 3: Advanced SAST Analysis (v3 Enhanced)
Execution Risk Detection
Critical Patterns (Immediate Reject)
| Pattern | Description | Example |
|---|
| INLINECODE42 | Dynamic code execution | INLINECODE43 |
| INLINECODE44 |
String evaluation |
eval(code) |
|
__import__() | Dynamic imports |
__import__('os') |
|
compile() | Dynamic compilation |
compile(src, '', 'exec') |
|
child_process.execSync | Sync command execution |
execSync(cmd, {shell: true}) |
|
subprocess.Popen | Process spawning |
Popen(shell=True) |
|
os.system() | Shell execution |
os.system(cmd) |
Network Anomaly Detection
Critical Patterns
| Pattern | Severity | MITRE ATT&CK |
|---|
| INLINECODE56 with credentials | CRITICAL | T1041 |
| INLINECODE57 with credentials |
CRITICAL | T1041 |
| Base64 encoded data to network | CRITICAL | T1132 |
| DNS exfiltration patterns | CRITICAL | T1048.003 |
| Hardcoded IP addresses | HIGH | T1059 |
| Reverse shell signatures | CRITICAL | T1059.004 |
| IPtables modification | HIGH | T1562 |
Reverse Shell Signatures (Enhanced Detection)
CODEBLOCK2
File System Threat Detection (v3 Enhanced)
Critical Paths (Read/Write Attempt = High Risk)
Also scan these paths inside SKILL.md code blocks!
CODEBLOCK3
Detection Rules
| Pattern | Severity | Example |
|---|
| Read critical path | HIGH | INLINECODE58 |
| Write to critical path |
CRITICAL |
writeFile('/.ssh/authorized_keys') |
| Modify cron | CRITICAL |
echo '* * * * *' >> /etc/crontab |
| SSH key access | CRITICAL |
readFile('~/.ssh/id_rsa') |
Obfuscation Detection (v3 Enhanced)
Layer 1: Common Encodings
| Encoding | Detection Pattern | Risk |
|---|
| Base64 | INLINECODE62 with len > 20 | MEDIUM |
| Hex |
/^[0-9a-fA-F]+$/ with len > 16 | MEDIUM |
| URL Encoding |
%[0-9A-F]{2} repeated | LOW |
| Unicode Escape |
\u[0-9A-F]{4} | MEDIUM |
Layer 2: Advanced Obfuscation
| Technique | Detection | Risk |
|---|
| String concatenation to hide keywords | INLINECODE66 | HIGH |
| Array join |
['co','ncat'].join('') | HIGH |
| Character codes |
String.fromCharCode(99, 111, 110, 99, 97, 116) | HIGH |
| Dynamic code evaluation |
new Function('code')() | CRITICAL |
| JSFuck |
/\[!\+\[\]/.test(code) | CRITICAL |
| Zero-width characters |
\u200B\u200C\u200D | CRITICAL |
| Right-to-Left Override |
\u202E | CRITICAL |
Layer 3: Multi-stage Obfuscation
Detect chains of encoding:
- - Base64 → URL → Hex
- Character codes → eval
- Compression → Base64 → eval
Phase 4: Semantic Intent Analysis (v3 核心功能)
Intent Mismatch Detection
Unlike basic vetters, ClawGuard analyzes if the Skill's actual behavior matches its stated purpose.
Capability-Behavior Mapping
Map required capabilities to actual usage:
CODEBLOCK4
Phase 5: Supply Chain Security
Dependency Analysis
Package.json Analysis
CODEBLOCK5
Requirements.txt Analysis
CODEBLOCK6
CVE Scanning (Enhanced)
| Source | Coverage | Update Frequency |
|---|
| NVD API | CVEs 2002-2024 | Daily |
| GitHub Advisory |
npm packages | Hourly |
| OSV | All ecosystems | Hourly |
Vulnerability Severity Mapping
| Severity | CVSS Score | Action |
|---|
| CRITICAL | 9.0-10.0 | Auto-reject |
| HIGH |
7.0-8.9 | Block + Warn |
| MEDIUM | 4.0-6.9 | Log + Warn |
| LOW | 0.1-3.9 | Log only |
Registry Reputation Scoring
| Registry | Score | Trust Level |
|---|
| npm (official) | 80 | High |
| PyPI (official) |
80 | High |
| GitHub Packages | 70 | Medium-High |
| Unverified mirrors | 10 | Low |
Phase 6: ML-based Anomaly Detection
Feature Extraction
Extract features from code for ML model:
CODEBLOCK7
Novel Attack Detection
ClawGuard uses ensemble detection to identify novel attacks:
CODEBLOCK8
Output Format
Terminal Output (v3 Enhanced)
CODEBLOCK9
Risk Scoring Formula (v3)
CODEBLOCK10
Risk Tier Classification
| Tier | Score Range | Color | Action |
|---|
| TIER0 | 0-10 | 🟢 GREEN | Auto-approve |
| TIER1 |
11-30 | 🟢 GREEN | Approve with logging |
|
TIER_2 | 31-50 | 🟡 YELLOW | Manual review |
|
TIER_3 | 51-70 | 🟠 ORANGE | Deep audit required |
|
TIER_4 | 71-100 | 🔴 RED | Auto-reject |
Integration with OpenClaw
Installation Flow
CODEBLOCK11
Quick Detection Commands
CODEBLOCK12 javascript' /SKILL.md | grep -E "exec|eval|readFile|http\."
Check for malicious domains
grep -r "evil\|attacker\|malicious\|hacker"
```
v3 vs v2 Features
| Feature | v2 | v3 |
|---|
| SAST Analysis | ✅ | ✅ |
| Intent Analysis |
Basic | Advanced (v3) |
| SKILL.md Code Scanning | ❌ | ✅ (v3) |
| Supply Chain Security | ✅ | ✅ |
| ML Anomaly Detection | ✅ | ✅ |
| Obfuscation Detection | ✅ | Enhanced (v3) |
| Intent Mismatch Scoring | ❌ | ✅ (v3) |
| Five-Tier Risk System | 3 tiers | 5 tiers (v3) |
ClawGuard Auditor: Security takes precedence over execution. 🦅🛡️ ClawGuard 审计器 (CG-A) v3
面向 OpenClaw 技能的企业级安全内核。ClawGuard 审计器提供全面的预运行静态与语义分析、供应链安全验证以及 AI 驱动的异常检测。
使用时机
在以下情况下激活 ClawGuard 审计器：
- - 用户请求安装或加载新技能
- 用户请求审计现有技能或仓库
- 新的外部代码源被添加到环境中
执行方式
审计技能时请遵循以下步骤：
步骤 1：读取目标技能
- - 查找并读取目标目录中的 SKILL.md 文件
- 读取所有代码文件（.js、.py、.sh 等）
- 同时扫描 SKILL.md 内部的代码块（v3 新增）
步骤 2：检查元数据
- - 验证 SKILL.md 包含有效的前置元数据（名称、版本、描述）
- 检查 metadata.risk 字段是否为 safe
- 检查 metadata.requires 中是否存在可疑二进制文件
步骤 3：扫描危险模式
关键模式（立即拒绝）
| 模式 | 描述 | 示例 |
|---|
| eval() | 动态代码执行 | eval(userInput) |
| exec() |
命令执行 | exec(cmd) |
|
import() | 动态导入 |
import(os) |
| compile() | 动态编译 | compile(src, , exec) |
| child_process.execSync | 同步命令执行 | execSync(cmd, {shell: true}) |
| subprocess.Popen | 进程生成 | Popen(shell=True) |
| os.system() | Shell 执行 | os.system(cmd) |
高风险模式（阻止 + 审查）
| 模式 | 描述 | 示例 |
|---|
| 向动态 URL 发起 fetch() | 动态网络请求 | fetch(url + userInput) |
| XMLHttpRequest |
浏览器网络请求 | new XMLHttpRequest() |
| WebSocket | 实时通信 | new WebSocket(url) |
| process.env | 环境变量访问 | process.env[KEY] |
| os.environ | 环境变量访问 | os.environ.get(KEY) |
步骤 4：检查意图匹配（v3 核心功能）
比较技能声称的功能（描述）与实际代码行为
如果天气工具读取 SSH 密钥，则属于意图不匹配！
意图不匹配检测流程
- 1. 从 SKILL.md 描述中提取声明目的
- 从代码中分析实际行为
- 使用语义相似度计算意图得分
- 若得分低于阈值则标记不匹配
不匹配示例
| 技能描述 | 实际行为 | 意图得分 | 操作 |
|---|
| 天气格式化器 | 读取 ~/.ssh/id_rsa | 0.2 | 拒绝 |
| 文件整理器 |
生成后台进程 | 0.4 | 拒绝 |
| Markdown 助手 | 向未知域名发起 HTTP POST | 0.3 | 拒绝 |
| 计算器 | 写入 /etc/cron | 0.1 | 拒绝 |
步骤 5：检查依赖项
- - 查看 package.json、requirements.txt、go.mod
- 标记已知恶意包
- 检查域名仿冒模式
步骤 6：输出结果
根据发现结果，输出以下之一：
- - 已批准：未发现关键问题
- 有条件批准：存在部分疑虑，需人工审查
- 已拒绝：检测到关键安全问题
目的
ClawGuard 审计器是 OpenClaw 环境的第一道防线。在任何技能安装或执行之前，它会执行严格的安全分析，涵盖：
- - 高级 SAST：具有全面规则覆盖的静态应用安全测试
- 语义意图分析（v3）：AI 驱动的行为分析，检测意图不匹配
- 供应链安全：依赖项验证、域名仿冒检测、CVE 扫描
- 基于 ML 的异常检测：机器学习模型识别新型攻击模式
- 混淆检测：多层混淆和编码攻击检测
- SKILL.md 代码扫描（v3）：扫描文档文件中的代码块
核心工作流
┌─────────────────────────────────────────────────────────────────┐
│ CLAWGUARD 审计器工作流 │
└─────────────────────────────────────────────────────────────────┘
[技能安装请求]
│
▼
┌───────────────────────┐
│ 1. 元数据验证 │ ← 前置元数据解析与验证
└───────────┬───────────┘
│ 通过
▼
┌───────────────────────┐
│ 2. 来源分析 │ ← 来源信任评分
└───────────┬───────────┘
│ 通过
▼
┌───────────────────────┐
│ 3. SAST 分析 │ ← 高级静态分析
│ ├─ 执行风险 │
│ ├─ 网络异常 │
│ ├─ 文件系统威胁 │
│ └─ 混淆检测 │
└───────────┬───────────┘
│ 通过
▼
┌───────────────────────┐
│ 4. 语义意图分析（v3） │ ← v3 AI 驱动行为分析
└───────────┬───────────┘
│ 通过
▼
┌───────────────────────┐
│ 5. 供应链安全 │ ← 依赖项与 CVE 分析
└───────────┬───────────┘
│ 通过
▼
┌───────────────────────┐
│ 6. ML 异常检测 │ ← 新型模式检测
└───────────┬───────────┘
│ 通过
▼
[审计完成]
阶段 1：元数据验证
前置元数据模式
| 字段 | 必需 | 验证规则 |
|---|
| name | 是 | 必须匹配目录名，小写字母加连字符 |
| version |
是 | 必须为有效 semver（例如 1.0.0） |
| description | 是 | 最少 10 字符，最多 500 字符 |
| author | 否 | 若存在，验证格式 |
| homepage | 否 | 若存在，必须为有效 HTTPS URL |
| metadata.category | 是 | 必须为以下之一：security、utility、data、integration |
| metadata.risk | 是 | 新技能必须为 safe |
| metadata.requires | 否 | 若存在，验证每个二进制文件存在 |
验证规则
| 检查项 | 严重程度 | 操作 |
|---|
| 缺少 YAML 前置元数据 | 关键 | 拒绝 |
| 名称格式无效 |
高 | 拒绝 |
| 版本非 semver | 中 | 警告 |
| 缺少描述 | 中 | 拒绝 |
| risk != safe | 高 | 警告 |
| requires 中存在可疑二进制文件 | 关键 | 拒绝 |
增强型二进制文件检测
拒绝需要以下内容的技能：
- - 网络工具：nc、ncat、socat、netcat、socat
- 远程访问：ssh、scp、rsync（除非有明确理由）
- 包管理器：pip install、npm install -g（除非在沙箱中）
- 系统修改：chmod、chown、sudo（除非有文档说明）
阶段 2：来源分析
信任评分算法
信任评分 = 基础分 + 来源加分 + 历史加分 - 风险因素
基础分：50
来源加分：
- 官方 OpenClaw 仓库：+30
- GitHub 超过 1000 星：+20
- GitHub 超过 500 星：+15
- 已验证作者：+10
- 个人/Gist：-20
历史加分：
- 首次出现超过 1 年：+10
- 活跃维护（过去 6 个月内有提交）：+5
风险因素：
- 无 git 历史：-15
- 单次提交：-10
- 贡献者多但无审查：-5
来源分类
| 分类 | 得分范围 | 操作 |
|---------------|-------------|--------|
| 可信
