skill-guard

To monitor active skills for unauthorized file access and suspicious network activity, use a runtime security monitor that observes file operations, network calls, and shell commands to detect and flag anomalous behavior in real-time.

Runtime permission enforcement for AI skills is the process of verifying that active skills only perform actions explicitly declared in their configuration, immediately flagging any unauthorized file access or shell command misuse.

You detect anomalous behavior and prevent data exfiltration by continuously tracking skill execution patterns, identifying unexpected outbound network connections, and alerting on actions that violate declared permission boundaries.

Yes, you can enforce declared permission boundaries on active OpenClaw skills by using a runtime security monitor that flags any actions deviating from explicitly declared permissions, preventing unintended operations.

Runtime security monitoring for skill shell commands is limited to detecting and flagging suspicious activity as it occurs; it observes anomalies and permission violations but relies on the accuracy of the declared permission boundaries.