Scan AgentSkill packages for malicious code and prompt injection.
npx skills add https://github.com/EverClaw/EverClaw --skill skillguard-everclaw
Please help me install this Agent Skill. Skill: skillguard Source: https://github.com/EverClaw/EverClaw/tree/main/skills/skillguard Command: npx skills add https://github.com/EverClaw/EverClaw --skill skillguard-everclaw
SkillGuard helps you vet untrusted AI skills before they reach an agent, reducing the risk of credential theft, prompt hijacking, hidden exfiltration, and obfuscated payloads.
Ask SkillGuard to scan the target skill directory or ClawHub package and return the highest-risk findings with a clear install verdict.
High-intent search queries and answers about installing and using this skill.
To scan AgentSkill packages for malicious code and prompt injection, use SkillGuard to analyze SKILL.md, JavaScript, Python, shell, and markdown content for credential theft, data exfiltration, obfuscation, and persistence patterns. It returns the highest-risk findings with a clear install verdict.
The best way to detect data exfiltration in third-party AI skills is to scan the skill package directory for dangerous code patterns and evasion techniques. SkillGuard separates trusted internal skills from external downloads so API calls and file operations are evaluated in context.
Yes, SkillGuard requires Node.js to audit local skills, ClawHub package downloads, and modified versions. It analyzes SKILL.md, JavaScript, Python, shell, and markdown content during install, audit, and watch workflows to identify unsafe patterns.
Yes, you can monitor modified versions of installed skills for newly introduced risks using the watch workflow. SkillGuard supports ongoing monitoring and version-diff inspection to re-check updated internal or external skills for hidden exfiltration and prompt hijacking.
A skill security scanner looks for credential theft, data exfiltration, obfuscation, persistence tricks, and evasion techniques in SKILL.md and shell scripts. SkillGuard applies these checks across JavaScript, Python, shell, and markdown content to block malicious skills before they reach an agent.
Automated malware detection for untrusted AI skills should not be your only line of defense when evaluating complex obfuscated payloads or nuanced prompt injection. Use SkillGuard as a pre-install vetting step to reduce risk, but apply contextual trust model evaluation for legitimate API calls and file operations.
lpjhelderInstall and configure kronon-forge with Node.js and npm.
NOMARJScan repositories for malicious patterns and credential exposures using Sigil CLI.
thomast1906Automate security scanning of Terraform configurations for Azure infrastructure.
ngquaanghuyAnalyze AI agent skill files for command injection, data exfiltration, and prompt injection.
