What makes Guava Guard notable?

1.3K downloads. Trust evidence available

How should Guava Guard be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

Guava Guard

Runtime security guard for OpenClaw agents. Warns on dangerous tool call patterns. For full static scanning, use guard-scanner. Skill: Guava Guard Owner: koatora20 Summary: Runtime security guard for OpenClaw agents. Warns on dangerous tool call patterns. For full static scanning, use guard-scanner. Tags: latest:1.2.0, runtime-guard:5.0.0, scanner:5.0.0, security:8.0.0, soul-lock:8.0.0 Version history: v1.2.0 | 2026-02-17T09:27:21.390Z | user Slim release: runtime hook only (warn mode). Removed proprietary files. guard-scanner redirect for fu

OpenClaw

View on ClawHub

Rank

Safety

Downloads

1.3k

Updated

Apr 15, 2026

Version

1.2.0

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1.3K downloads reported by the source. Last updated 4/15/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Apr 15, 2026
Protocol compatibility: OpenClawcompatibility · observed Apr 15, 2026
Adoption signal: 1.3K downloadsadoption · observed Apr 15, 2026
Latest release: 1.2.0release · observed Feb 17, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install kn70hcm6kss09g9b4pe5rq3ybd80qp15:guava-guard

Setup complexity is classified as HIGH. You must provision dedicated cloud infrastructure or an isolated VM. Do not run this directly on your local workstation.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-koatora20-guava-guard/snapshot"

Documentation

CLAWHUB

29,263 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: guava-guard
description: Runtime security guard for OpenClaw agents. Warns on dangerous tool call patterns. For full static scanning, use guard-scanner.
metadata:
  clawdbot:
    emoji: "🛡️"
---

# GuavaGuard 🛡️

**Runtime security monitoring for your OpenClaw agent.**

GuavaGuard watches tool calls in real-time and warns when it detects dangerous patterns — reverse shells, credential exfiltration, sandbox escapes, and more.

## Quick Start

```bash
# 1. Install
clawhub install guava-guard

# 2. Enable the runtime hook
openclaw hooks install skills/guava-guard/hooks/guava-guard
openclaw hooks enable guava-guard

# 3. Restart gateway, then verify:
openclaw hooks list   # Should show 🍈 guava-guard as ✓ ready
```

That's it. GuavaGuard is now monitoring your agent's tool calls.

## What It Detects (12 runtime patterns)

| Pattern | Severity | Example |
|---------|----------|---------|
| Reverse shell | 🔴 CRITICAL | `/dev/tcp/`, `nc -e`, `socat TCP` |
| Credential exfiltration | 🔴 CRITICAL | Secrets → webhook.site, ngrok, requestbin |
| Guardrail disabling | 🔴 CRITICAL | `exec.approval = off` (CVE-2026-25253) |
| macOS Gatekeeper bypass | 🔴 CRITICAL | `xattr -d quarantine` |
| ClawHavoc AMOS | 🔴 CRITICAL | `socifiapp`, Atomic Stealer indicators |
| Base64 → shell | 🔴 CRITICAL | `base64 -d \| bash` |
| Download → shell | 🔴 CRITICAL | `curl \| bash`, `wget \| sh` |
| Cloud metadata SSRF | 🔴 CRITICAL | `169.254.169.254` |
| Known malicious IP | 🔴 CRITICAL | `91.92.242.30` |
| DNS exfiltration | 🟠 HIGH | `nslookup $secret`, `dig @attacker` |
| SSH key access | 🟠 HIGH | `.ssh/id_*`, `.ssh/authorized_keys` |
| Crypto wallet access | 🟠 HIGH | `wallet seed`, `mnemonic`, `seed phrase` |

## Current Limitation

> **Warning**: OpenClaw's hook API does not yet support blocking tool execution.
> GuavaGuard currently **warns only** — it cannot prevent dangerous calls.
> When a cancel API is added, blocking will be enabled automatically.
> See: [Issue #18677](https://github.com/openclaw/openclaw/issues/18677)

## Audit Log

All detections are logged to `~/.openclaw/guava-guard/audit.jsonl` (JSON lines format).

## Want Full Static Scanning? (Recommended Default)

GuavaGuard handles **runtime** monitoring. For comprehensive **static** scanning of skill packages before installation, use **guard-scanner** first:

```bash
# 1) Pre-install safety gate
npx guard-scanner ./skills --self-exclude --verbose

# 2) Then enable runtime monitoring
openclaw hooks enable guava-guard
```

- 186+ detection patterns / 20 threat categories
- HTML dashboard, SARIF, JSON output
- Zero dependencies
- MIT licensed

**GitHub**: https://github.com/koatora20/guard-scanner
**ClawHub**: `clawhub install guard-scanner`

## Born From a Real Incident

A real agent compromise overwrote core behavior files through a malicious skill install path.
GuavaGuard exists to detect dangerous runtime tool-call patterns early and leave an auditable trail.

## License

MIT. Zero depend

_meta.json

{
  "ownerId": "kn70hcm6kss09g9b4pe5rq3ybd80qp15",
  "slug": "guava-guard",
  "version": "1.2.0",
  "publishedAt": 1771320441390
}

CHANGELOG.md

# CHANGELOG

## v10.0.0 — Runtime-Only Final (2026-02-17)

### ✅ Scope Simplification (開発完了版)
- GuavaGuardは **runtime guard専用** に正式固定
- Soul Lock / SoulChain 由来の機能・運用前提を本体スコープから除外
- 公式Hook API制約に合わせて **warn-only運用** を明示（Issue #18677待ち）

### 🔐 Security Posture
- before_tool_callの12 runtime checksを維持
- 監査ログ `~/.openclaw/guava-guard/audit.jsonl` を継続
- ブロック実行はcancel/veto API追加後に再有効化予定

### 📣 Positioning
- **静的スキャンは guard-scanner を推奨**（pre-install gate）
- GuavaGuardは「実行時監視」、guard-scannerは「導入前検査」に役割分離

## v9.0.0 — SoulChain Edition (2026-02-14)

### ⛓️ SoulChain: On-Chain Identity Verification (Layer 3)
- **3-layer defense architecture**: L1 Static Scan + L2 Soul Lock + L3 SoulChain
- **On-chain verification** via SoulRegistry.sol on Polygon Mainnet
  - Reads agent's registered SOUL.md hash from blockchain
  - Compares against local SHA-256 hash
  - Zero gas cost (view function call)
- **`verify` subcommand** — standalone on-chain verification
  - `node guava-guard.js verify` — quick soul check
  - `--wallet <addr>` — specify agent wallet
  - `--rpc <url>` — custom RPC endpoint
  - `--stats` — show registry statistics
- **Zero-dependency RPC client** — raw JSON-RPC via Node.js fetch
  - No ethers.js, no viem, no npm install
  - Hand-rolled ABI encoding/decoding (4 function selectors)
  - Multi-RPC fallback (polygon-rpc.com → ankr → llamarpc)
- **Graceful degradation** — network failure → L3 skipped, L1+L2 active
- **`--no-soulchain`** flag to disable on-chain checks
- **Exit code 3** for SoulChain violation (distinct from malicious skill = 1)
- **JSON report** includes `soulchain` field with full verification result
- **Configurable** via `~/.openclaw/guava-guard/soulchain.json`

### Contracts
- **SoulRegistry**: `0x0Bc112169401cC1a724dBdeA36fdb6ABf3237C93` (Polygon)
- **$GUAVA Token**: `0x25cBD481901990bF0ed2ff9c5F3C0d4f743AC7B8` (Polygon)

### Context
- ERC-8004 "Trustless Agents" activated on Ethereum mainnet (2026-02-11)
- SoulChain is complementary: ERC-8004 = discovery/trust, SoulChain = integrity
- World's first AI agent on-chain identity verification in production

## v8.0.0 — Soul Lock Edition (2026-02-12)

### 🔒 Soul Lock: World's First Agent Identity Protection
- **Category 17: Identity Hijacking** — 15 new detection patterns
  - Shell writes (echo, cp, scp, mv, sed, redirect to SOUL.md/IDENTITY.md)
  - Code writes (Python open(w), Node writeFileSync, PowerShell Set-Content)
  - Flag manipulation (chflags uchg/nouchg, attrib +/-R)
  - Persona swap instructions, evil soul file references
  - Agent name override, memory wipe commands
- **Soul Lock Integrity Verification** (enabled by default)
  - SHA-256 hash comparison against stored baseline
  - OS immutable flag detection (macOS chflags / Windows attrib)
  - Watchdog daemon status check (LaunchAgent)
  - Auto-stores baseline hashes on first run
- **`--no-soul-lock`** flag to disable integrity checks
- **Self-healing watchdog** (`scripts/soul-watchdog.sh`)
  - fswatch-based monitoring (ma

HOOK.md

# GuavaGuard Runtime Guard

The Runtime Guard hook is in `hooks/guava-guard/`.

Install with:
```bash
openclaw hooks install skills/guava-guard/hooks/guava-guard
openclaw hooks enable guava-guard
```

See `hooks/guava-guard/HOOK.md` for full documentation.

hooks/guava-guard/HOOK.md

---
name: guava-guard
description: "GuavaGuard Runtime Guard — warns on dangerous tool call patterns in real-time"
metadata: { "openclaw": { "emoji": "🍈", "events": ["agent:before_tool_call"], "requires": { "bins": ["node"] } } }
---

# GuavaGuard Runtime Guard — before_tool_call Hook

Real-time security monitoring for OpenClaw agents. Warns when dangerous
tool call patterns are detected (reverse shells, credential exfiltration, etc).

> **Note**: Blocking is not yet possible — OpenClaw's hook API does not
> currently support a cancel mechanism. See [Issue #18677](https://github.com/openclaw/openclaw/issues/18677).

## Triggers

| Event                    | Action | Purpose                                |
|--------------------------|--------|----------------------------------------|
| `agent:before_tool_call` | warn   | Check tool args for malicious patterns |

## What it does

Scans every exec/write/edit/browser/web_fetch/message call against 12 runtime threat patterns:

- Reverse shells, credential exfiltration, Gatekeeper bypass
- ClawHavoc AMOS IoCs, known malicious IPs
- DNS exfiltration, base64-to-shell, curl|bash
- SSH key access, crypto wallet credential access
- Cloud metadata SSRF (169.254.169.254)
- Guardrail disabling attempts (CVE-2026-25253)

## Audit Log

All detections logged to `~/.openclaw/guava-guard/audit.jsonl`.

## For comprehensive static scanning

Use **guard-scanner** — 170+ patterns, 17 threat categories:

```bash
npx guard-scanner ./skills
```

GitHub: https://github.com/koatora20/guard-scanner

Github ReposUpdated 6h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.