Axiomata Guard Scanner
Universal OpenClaw skill security scanner Impersonal — works for any agent
Description
Axiomata Guard Scanner protects OpenClaw agents by scanning skills for security threats. It uses multiple "vaccines" (detection engines) to identify malicious patterns before installation.
Trigger: Before installing any skill, especially from ClawHub.
Security Layers
Layer 1: ClawHub Malicious Pattern Check (VAX-001)
Checks for known malicious patterns:
- Malicious binary downloads (openclawcli.zip)
- RCE via glot.io snippets
- Malware via GitHub releases
- Password-protected archives
Layer 2: C2 & Data Exfiltration Detection (VAX-027)
Detects command & control infrastructure:
- Suspicious DNS lookups
- Discord/Telegram webhooks
- Bit.ly / short URL redirects
- Exfiltration patterns
Layer 3: Cross-Vector Attack Chain (VAX-028)
Correlates findings from other vaccines:
- Multiple attack vectors
- Chain escalation patterns
- Combined threat assessment
Layer 4: Rootkit & Bootkit Detection (VAX-029)
Detects kernel-level threats:
- System manipulation patterns
- Driver injection
- UEFI threats
Layer 5: Package Ecosystem Attacks (VAX-030)
Detects package-level attacks:
- typosquatting
- dependency confusion
- malicious packages
Usage
Scan a skill file
python3 scripts/guard_scanner.py --file <skill-path>
Scan skill code directly
python3 scripts/guard_scanner.py --code "<skill code>"
JSON output
python3 scripts/guard_scanner.py --file <skill-path> --json
Output Format
{
"scanner": "Axiomata Guard Scanner",
"version": "1.0.0",
"skill_name": "...",
"global_threat_level": "CLEAN | LOW | MEDIUM | HIGH | CRITICAL",
"global_score": 0-300,
"decision": "APPROVE | WARN | NEUTRALIZE | ISOLATE",
"triggered_vaccines": [...],
"summary": {...}
}
Threat Levels
| Level | Score | Action |
|---|---|---|
| CLEAN | 0 | APPROVE |
| LOW | 1-19 | APPROVE with monitoring |
| MEDIUM | 20-49 | WARN — manual review |
| HIGH | 50-79 | NEUTRALIZE |
| CRITICAL | 80+ | ISOLATE immediately |
In Altum Per Security. Axiomata Guard Scanner v1.0.0