Skillguard

gh-skillguard是一站式OpenClaw SKILL.md安全审计工具，整合恶意软件扫描、权限范围分析、提示注入检测三项功能。启动服务后，通过API提交SKILL.md内容，即可获取包含SAFE/CAUTION/DANGEROUS的统一verdict、总问题数及三项细分报告。判定逻辑优先以恶意软件检测结果为准，仅权限或注入问题标记CAUTION，无问题则为SAFE，适合需快速验证SKILL.md安全性的场景。

mirni

热度 37.49

最近更新 2026-05-11 17:42:41

分类：安全依赖：代码执行 / 第三方 API应用场景：报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add gh-skillguard

Metadata

name: gh-skillguard
description: Run a complete security audit on any OpenClaw SKILL.md in one call. Combines malware scanning (SkillScan), permission scope analysis (ScopeCheck), and prompt injection detection (PromptGuard) into a single unified report with a SAFE/CAUTION/DANGEROUS verdict.
metadata: {"openclaw":{"emoji":"🏰","requires":{"bins":["python"]},"install":[{"id":"pip","kind":"uv","packages":["fastapi","uvicorn","pydantic","pyyaml"]}]}}

SkillGuard

Full security audit of a SKILL.md — three checks, one call.

Start the server

uvicorn skillguard.app:app --port 8005

Audit a skill

curl -s -X POST http://localhost:8005/v1/audit-skill \
  -H "Content-Type: application/json" \
  -d "{\"skill_content\": $(cat path/to/SKILL.md | jq -Rs)}" | jq

Returns verdict (SAFE/CAUTION/DANGEROUS), total_findings, and three sub-reports:

scan — malware detection (safety_score, findings, verdict)
scope — permission analysis (declared vs detected, undeclared_access)
injection — prompt injection (risk_score, patterns_detected)

Why use SkillGuard instead of individual tools?

One call instead of three. Same price. Combined verdict logic: if the malware scan finds anything, it's DANGEROUS. If only scope or injection issues, it's CAUTION. Clean skill = SAFE.