skill-guard

Pre-install security scanning for ClawHub skills works by downloading the skill to a dedicated staging area, running mcp-scan tooling to detect prompt injections, data exfiltration, and hardcoded secrets, and only moving the files into your workspace if no threats are found.

When installing MCP skills, you should check for prompt injections, data exfiltration attempts, and hardcoded secrets. A pre-install scanning gate isolates the skill files in a staging directory and blocks installation if it detects any of these security threats.

Yes, you need the clawhub CLI and uvx installed to run pre-install skill scans. The scanning workflow requires the clawhub CLI to manage the skill installation process and the mcp-scan tooling to perform the actual security checks during staging.

Unsafe skills detected during the pre-install security scan are moved to a quarantine area for manual review. This quarantine workflow ensures that suspicious code is set aside and prevented from entering your workspace until you complete a manual security review.

Yes, you can review quarantined skills before allowing them into your workspace. The pre-install security gate sets aside suspicious scan results into a quarantine area, enabling a controlled manual review workflow before any files are moved into the final installation directory.