skill-guard

Name: skill-guard
Availability: InStock
Author: Ludwig

Scan staged ClawHub skills for prompt injections, secrets, and malware before install.

Updated Apr 8, 2026

Search Tags:#security-scan #prompt-injection #quarantine #clawhub #mcp-scan #skill-guard

Ready to run

npx skills add https://github.com/LudwigAJ/swell --skill skill-guard-ludwigaj

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skill-guard
Source: https://github.com/LudwigAJ/swell/tree/main/.factory/skills/skill-guard
Command: npx skills add https://github.com/LudwigAJ/swell --skill skill-guard-ludwigaj

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires clawhub, uvx, mcp-scan, and includes scripts (resource) components.

What problem does it solve?

Skill-guard helps you avoid installing malicious or unsafe ClawHub skills by checking the actual skill contents before they reach your workspace.

Core Features & Use Cases

Stages a skill in a temporary directory so your real skills folder stays untouched during inspection.
Runs mcp-scan to look for prompt injections, secret leaks, malware patterns, and other AI-specific threats.
Quarantines suspicious skills and gives you a clear path to review, discard, or install anyway when you intentionally accept the risk.

Quick Start

Ask the assistant to scan the ClawHub skill named some-skill and only install it if the pre-flight security check passes.

Frequently Asked Questions about skill-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan ClawHub skills for prompt injection before installing?▼

To scan ClawHub skills for prompt injection, skill-guard stages the skill in a temporary directory and runs mcp-scan to detect prompt injections, secret leaks, and malware patterns before the files reach your workspace.

How can I check new AI skills for malware and secret leaks safely?▼

You can check new AI skills for malware and secret leaks by staging them in a temporary directory using skill-guard, which keeps your real skills folder untouched while it analyzes the files for security threats.

Do I need uvx and mcp-scan to run a pre-install security check on skills?▼

Yes, you need uvx and mcp-scan to run a pre-install security check, as skill-guard requires both dependencies to fetch skills into a temporary staging directory and analyze the files for AI-specific threats.

What happens to suspicious skills when a security scan detects threats?▼

When a security scan detects threats, suspicious skills are quarantined by skill-guard, providing you with a clear path to review the staged files, discard them, or install them anyway if you intentionally accept the risk.

How do I review and discard unsafe skills after a pre-flight security check fails?▼

After a pre-flight security check fails, skill-guard quarantines the unsafe skill in a staging directory, allowing you to review the detected prompt injections or malware patterns and discard the files before they reach your workspace.

Can I install a quarantined skill if I intentionally accept the security risks?▼

Yes, you can install a quarantined skill if you intentionally accept the security risks, as skill-guard provides a clear path to proceed with the installation even after mcp-scan detects prompt injections or malware patterns.