Xpersona
agentCLAWHUBUnverified

Skillguard

Audit OpenClaw skills for security risks before installation via SkillGuard API. Skill: Skillguard Owner: jonathanliu811026 Summary: Audit OpenClaw skills for security risks before installation via SkillGuard API. Tags: latest:1.1.0 Version history: v1.1.0 | 2026-03-24T12:37:11.515Z | user Fix: added clawhub to required bins, added Privacy Notice for data transmission disclosure v1.0.0 | 2026-03-19T10:38:17.799Z | user Initial release: audit OpenClaw skills for security risks via SkillGuard API (

OpenClaw
View on ClawHubHomepage

Rank

62

Safety

84

Downloads

1.9k

Updated

Oct 9, 2026

Version

1.1.0

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1.9K downloads reported by the source. Last updated 10/9/2026.

Avoid when

  • Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor
Clawhubvendor · observed Oct 9, 2026
Protocol compatibility
OpenClawcompatibility · observed Oct 9, 2026
Adoption signal
1.9K downloadsadoption · observed Oct 9, 2026
Latest release
1.1.0release · observed Mar 24, 2026
Handshake status
UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s176ke45ja87cazngxgkxx3evn83grd1:skillguard-audit
  1. Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.
  2. Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-jonathanliu811026-skillguard-audit/snapshot"

Documentation

CLAWHUB

12,643 characters of source documentation, loaded on request.

Extracted files

3 files captured from the source.

SKILL.md

---
name: skillguard
description: Audit OpenClaw skills for security risks before installation via SkillGuard API.
homepage: https://api.agentsouls.io
metadata: { "openclaw": { "emoji": "🛡️", "requires": { "bins": ["curl", "jq", "clawhub"] } } }
---

# SkillGuard

Audit any OpenClaw skill for security risks **before** you install it.

Calls the SkillGuard API (`https://api.agentsouls.io/api/audit`) and returns a verdict, risk score, and threat list.

## Usage

### Audit a skill from ClawHub by name

```bash
bash skills/skillguard/audit.sh --name <skill-slug>
```

This uses `clawhub inspect --file` to pull the skill's SKILL.md (and any scripts), then sends the code to the audit API.

### Audit a local file

```bash
bash skills/skillguard/audit.sh --code <path-to-file>
```

Reads the file and sends its contents for audit.

### Output

Returns JSON with:
- **verdict**: `SAFE` | `CAUTION` | `DANGEROUS`
- **riskScore**: 0–100
- **threats**: list of identified risks

Example:
```json
{
  "verdict": "CAUTION",
  "riskScore": 35,
  "threats": ["Executes arbitrary shell commands", "Accesses network without disclosure"]
}
```

## When to use

**Before installing any new skill**, run:

```bash
bash skills/skillguard/audit.sh --name <skill-name>
```

If verdict is `DANGEROUS`, do **not** install. If `CAUTION`, review the threats and decide with the user.

## Privacy Notice

⚠️ **Data transmission**: When you run an audit, the **full source code** of the skill is sent to the SkillGuard API (`https://api.agentsouls.io`) for analysis. No code is stored permanently — it is analyzed in-memory and discarded after the audit completes. The API returns only the verdict, risk score, and detected threats.

If you prefer not to send code to an external service, you can self-host the SkillGuard audit engine (contact us for details) or review skill code manually.

_meta.json

{
  "ownerId": "kn76fh5nm64erff7pb50eqcwfs81arzc",
  "slug": "skillguard-audit",
  "version": "1.1.0",
  "publishedAt": 1774355831515
}

skill-card.md

## Description:

Audit OpenClaw skills for security risks before installation via SkillGuard API.

This skill is ready for commercial/non-commercial use.

## Publisher:

[jonathanliu811026](https://clawhub.ai/user/jonathanliu811026)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and security-conscious OpenClaw users use this skill to audit skills before installation and to gate ClawHub installs based on returned risk verdicts.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Audited source code is transmitted to the external SkillGuard API.

Mitigation: Audit only code that is acceptable to share externally; avoid submitting proprietary code, secrets, or sensitive files.

Risk: The safe-install wrapper can skip the audit and does not prove the installed artifact exactly matches the audited artifact.

Mitigation: Avoid force mode for routine installs and verify the artifact source or hash separately before installation.

Risk: Remote audit verdicts are incomplete pre-install guarantees.

Mitigation: Treat the returned verdict as one review signal and inspect relevant source and threats before installing.

## Reference(s):

- [ClawHub skill page](https://clawhub.ai/jonathanliu811026/skills/skillguard-audit)
- [Publisher profile](https://clawhub.ai/user/jonathanliu811026)
- [SkillGuard API homepage](https://api.agentsouls.io)
- [SkillGuard audit API](https://api.agentsouls.io/api/audit)

## Skill Output:

**Output Type(s):** [JSON, Shell commands, Guidance]

**Output Format:** [JSON audit verdicts and terminal install prompts]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Requires curl, jq, and clawhub; submits audited source code to the SkillGuard API.]

## Skill Version(s):

1.1.0 (source: server release metadata)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Related agents

Same protocol, similar job.

Github ReposUpdated 5h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW
Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW
Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW
Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular

OPENCLAW

Machine-readable data

The same record, as JSON, for agents and crawlers.

{
  "facts": [
    {
      "factKey": "vendor",
      "category": "vendor",
      "label": "Vendor",
      "value": "Clawhub",
      "href": "https://clawhub.ai/jonathanliu811026/skills/skillguard-audit",
      "sourceUrl": "https://clawhub.ai/jonathanliu811026/skills/skillguard-audit",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T22:09:26.184Z",
      "isPublic": true
    },
    {
      "factKey": "protocols",
      "category": "compatibility",
      "label": "Protocol compatibility",
      "value": "OpenClaw",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-jonathanliu811026-skillguard-audit/contract",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-jonathanliu811026-skillguard-audit/contract",
      "sourceType": "contract",
      "confidence": "medium",
      "observedAt": "2026-10-09T22:09:26.184Z",
      "isPublic": true
    },
    {
      "factKey": "traction",
      "category": "adoption",
      "label": "Adoption signal",
      "value": "1.9K downloads",
      "href": "https://clawhub.ai/jonathanliu811026/skillguard-audit",
      "sourceUrl": "https://clawhub.ai/jonathanliu811026/skillguard-audit",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T22:09:26.184Z",
      "isPublic": true
    },
    {
      "factKey": "latest_release",
      "category": "release",
      "label": "Latest release",
      "value": "1.1.0",
      "href": "https://clawhub.ai/jonathanliu811026/skillguard-audit",
      "sourceUrl": "https://clawhub.ai/jonathanliu811026/skillguard-audit",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-03-24T12:37:11.515Z",
      "isPublic": true
    },
    {
      "factKey": "handshake_status",
      "category": "security",
      "label": "Handshake status",
      "value": "UNKNOWN",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-jonathanliu811026-skillguard-audit/trust",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-jonathanliu811026-skillguard-audit/trust",
      "sourceType": "trust",
      "confidence": "medium",
      "observedAt": null,
      "isPublic": true
    }
  ],
  "events": [
    {
      "eventType": "release",
      "title": "Release 1.1.0",
      "description": "Fix: added clawhub to required bins, added Privacy Notice for data transmission disclosure",
      "href": "https://clawhub.ai/jonathanliu811026/skillguard-audit",
      "sourceUrl": "https://clawhub.ai/jonathanliu811026/skillguard-audit",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-03-24T12:37:11.515Z",
      "isPublic": true
    }
  ]
}

Record generated Oct 9, 2026.

Sponsored

Ads related to Skillguard and adjacent AI workflows.