skills.rest
NY1024
NY1024COMMUNITY
Explore all skills by this author →
WebsiteGitHub

clawguard-threat-detect

Detect and block runtime security threats in OpenClaw agent environments.

25|2|Updated Mar 12, 2026
Search Tags:#autonomous agents#threat detection#prompt injection#openclaw#runtime security#mitre attack#attack chain
One-click install
npx skills add https://github.com/NY1024/ClawGuard --skill clawguard-threat-detect-ny1024
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: clawguard-threat-detect
Source: https://github.com/NY1024/ClawGuard/tree/main/detect-skill
Command: npx skills add https://github.com/NY1024/ClawGuard --skill clawguard-threat-detect-ny1024

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Autonomous agents that execute code, access sensitive files, and call external APIs face unaddressed runtime security threats including data exfiltration, reverse shells, privilege escalation, and prompt injection that pre-execution static analysis and configuration checks cannot detect, creating critical vulnerabilities during active operation.

Core Features & Use Cases

  • Real-time multi-vector monitoring: Continuously inspects executed commands, file access events, outbound network traffic, and user inputs for malicious patterns and suspicious activity.
  • Multi-stage attack chain correlation: Links sequential suspicious events to identify coordinated attack patterns such as reconnaissance → credential access → exfiltration, aligned with MITRE ATT&CK frameworks.
  • Configurable threat response: Allows custom confidence thresholds for blocking, alerting, and logging threats, with automated responses for critical risks like reverse shells and credential exfiltration.
  • Use Case: A development team running OpenClaw agents with access to cloud provider credentials can use this skill to automatically block reverse shell attempts and alert on unauthorized credential exfiltration, preventing data breaches in real time without manual oversight.

Quick Start

Load the ClawGuard Detect skill and request it to monitor your active OpenClaw session for runtime security threats.

Frequently Asked Questions about clawguard-threat-detect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect runtime security threats in autonomous agents?▼

Runtime security threats in autonomous agents are detected by continuously monitoring executed commands, file access events, outbound network traffic, and user inputs for malicious patterns and suspicious activity.

How does multi-stage attack chain correlation work for LLM-driven agent environments?▼

Multi-stage attack chain correlation for LLM-driven environments works by linking sequential suspicious events to identify coordinated patterns like reconnaissance, credential access, and exfiltration, aligned with MITRE ATT&CK frameworks.

Can I configure automated responses for reverse shell attempts and credential exfiltration?▼

Automated responses for reverse shell attempts and credential exfiltration can be configured using custom confidence thresholds that trigger blocking, alerting, and logging actions for critical risks.

Does prompt injection detection work with OpenClaw agents accessing cloud credentials?▼

Prompt injection detection works with OpenClaw agents accessing cloud credentials by continuously inspecting user inputs and runtime operations to automatically block unauthorized exfiltration and alert on malicious activity.

What is the difference between runtime threat detection and pre-execution static analysis?▼

Runtime threat detection monitors active operations during execution to catch data exfiltration and reverse shells, whereas static analysis only evaluates code before execution and misses active vulnerabilities.

When should I not rely on configuration checks for autonomous agent security?▼

Configuration checks should not be relied upon when autonomous agents execute code or make network requests, as they cannot detect runtime threats like privilege escalation or reverse shells during active operation.

Related Skills

Explore More Software Engineering Skills→
SafeAgent-BeihangSafeAgent-Beihang
50

clawguard-threat-detect

Detect and mitigate runtime threats in OpenClaw environments via real-time behavioral monitoring.

Official
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
rauly-1408rauly-1408

dag-scope-enforcer

Enforce runtime permission boundaries for AI agent tool, file, command, and network operations.

Community
Advanced
UseAI-proUseAI-pro
70

network-watcher

Audit OpenClaw skill network requests for exfiltration and unauthorized API calls.

Official
Advanced