skill-guard

The only pre-install security gate for ClawHub skills.

Why skill-guard?

VirusTotal catches known malware binaries — but won't flag <!-- IGNORE PREVIOUS INSTRUCTIONS -->.

skillscanner checks if Gen Digital has reviewed it — but can't scan new or updated skills.

skill-guard uses mcp-scan (Invariant Labs, acquired by Snyk) to analyze what's actually in the skill, catches AI-specific threats, and blocks install if issues are found.

The Problem

Skills can contain:

• - 🎭 Prompt injections — hidden "ignore previous instructions" attacks
• 💀 Malware payloads — dangerous commands disguised in natural language
• 🔑 Hardcoded secrets — API keys, tokens in plain text
• 📤 Data exfiltration — URLs that leak your conversations, memory, files
• ⛓️ Toxic flows — instructions that chain into harmful actions

One bad skill = compromised agent. Your agent trusts skills implicitly.

The Solution

CODEBLOCK0

skill-guard:

1. 1. Downloads to staging (/tmp/) — never touches your real skills folder
2. Scans with mcp-scan — Invariant/Snyk's security scanner for AI agents
3. Blocks or installs — clean skills get installed, threats get quarantined

What It Catches

Real example — skill-guard flagged this malicious skill:

CODEBLOCK1

VirusTotal: 0/76 engines. mcp-scan caught what antivirus missed.

Usage

CODEBLOCK2

Exit Codes

When Threats Are Found

Skill stays in /tmp/skill-guard-staging/skills/<slug>/ (quarantined). You can:

1. 1. Review — read the scan output, inspect the files
2. Install anyway — INLINECODE7
3. Discard — INLINECODE8

Requirements

• - clawhub CLI — INLINECODE10
• INLINECODE11 — INLINECODE12

Why This Matters

Your agent has access to your files, messages, maybe your whole machine. One malicious skill can:

• - Read your secrets and send them elsewhere
• Modify your agent's behavior permanently
• Use your identity to spread to other systems

Trust, but verify. Scan before you install.