OpenClaw

clawguard

Security scanner for OpenClaw/Clawdbot skills - detect malicious patterns before installation

devinfloyd10 来源安装数☆ 0 仓库 Starsv0.1.0

查看来源 ↗安装与使用 SKILL.md ↗

安装与使用

请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。

SkillHub CLI

skillhub install devinfloyd1/clawguarddevin

打开来源仓库，查看说明和兼容环境后，按来源提供的命令或步骤安装。

将来源链接提供给你的 Agent，让它先读取说明、核对依赖，并向你说明将执行的安装步骤。

查看来源 ↗使用指南

技能说明

ClawGuard

Security Scanner for OpenClaw/Clawdbot Skills

Protect yourself from malicious skill installations. ClawGuard scans skills for dangerous patterns before you install them - including patterns from the ClawHavoc campaign (341 malicious skills discovered by Koi Security).

Quick Start

# Scan a skill by name
python scan.py --skill <skill-name>

# Scan a skill by path  
python scan.py --path /path/to/skill

# Scan all installed skills
python scan.py --all

What It Detects

Category	Examples	Severity
🔴 Reverse Shells	socket.connect(), pty.spawn(), /dev/tcp	Critical
🔴 Data Exfiltration	requests.post() to suspicious TLDs	Critical
🔴 Credential Harvest	Reading ~/.ssh/id_rsa, AWS credentials	Critical
🔴 Obfuscation	base64.b64decode(exec), chr() chains	Critical
🔴 ClawHavoc IOCs	glot.io scripts, fake Apple URLs, known C2 IPs	Critical
🟠 Code Execution	exec(), eval(), subprocess	High
🟡 Suspicious Network	URL shorteners, weird ports	Medium

Output Formats

# Console (default) - colored terminal output
python scan.py --skill github

# JSON - machine-readable for CI/CD
python scan.py --skill github --format json

# Markdown - for sharing reports
python scan.py --skill github --format markdown

Risk Scoring

Score	Level	Action
0-10	🟢 Safe	Install freely
11-25	🟢 Low	Quick review
26-50	🟡 Medium	Review findings
51-75	🔴 High	Review carefully
76-100	🔴 Critical	Do not install

IOC Database

70+ indicators of compromise including:

Remote access (reverse shells, C2)
Data exfiltration
Credential harvesting
Code obfuscation
Real ClawHavoc campaign IOCs (from Koi Security research)
Known malicious IPs, hashes, and skill names

Requirements

Python 3.8+
No external dependencies (stdlib only)

Cre...

来源信息

Source: github
Repository: openclaw/skills
Path: skills/devinfloyd1/clawguarddevin
Version: 0.1.0
Commit: 77731c342515d4da90da47e2968268036f72702f
分类来源: rules
状态: active
可见性: public

这些信息来自收录时的来源分析，可能滞后；使用前请核对最新来源文件。

来源内容

SKILL.md

# ClawGuard

**Security Scanner for OpenClaw/Clawdbot Skills**

Protect yourself from malicious skill installations. ClawGuard scans skills for dangerous patterns before you install them - including patterns from the **ClawHavoc campaign** (341 malicious skills discovered by Koi Security).

## Quick Start

```bash
# Scan a skill by name
python scan.py --skill <skill-name>

# Scan a skill by path  
python scan.py --path /path/to/skill

# Scan all installed skills
python scan.py --all
```

## What It Detects

| Category | Examples | Severity |
|----------|----------|----------|
| 🔴 **Reverse Shells** | socket.connect(), pty.spawn(), /dev/tcp | Critical |
| 🔴 **Data Exfiltration** | requests.post() to suspicious TLDs | Critical |
| 🔴 **Credential Harvest** | Reading ~/.ssh/id_rsa, AWS credentials | Critical |
| 🔴 **Obfuscation** | base64.b64decode(exec), chr() chains | Critical |
| 🔴 **ClawHavoc IOCs** | glot.io scripts, fake Apple URLs, known C2 IPs | Critical |
| 🟠 **Code Execution** | exec(), eval(), subprocess | High |
| 🟡 **Suspicious Network** | URL shorteners, weird ports | Medium |

## Output Formats

```bash
# Console (default) - colored terminal output
python scan.py --skill github

# JSON - machine-readable for CI/CD
python scan.py --skill github --format json

# Markdown - for sharing reports
python scan.py --skill github --format markdown
```

## Risk Scoring

| Score | Level | Action |
|-------|-------|--------|
| 0-10 | 🟢 Safe | Install freely |
| 11-25 | 🟢 Low | Quick review |
| 26-50 | 🟡 Medium | Review findings |
| 51-75 | 🔴 High | Review carefully |
| 76-100 | 🔴 Critical | **Do not install** |

## IOC Database

70+ indicators of compromise including:
- Remote access (reverse shells, C2)
- Data exfiltration
- Credential harvesting  
- Code obfuscation
- **Real ClawHavoc campaign IOCs** (from Koi Security research)
- Known malicious IPs, hashes, and skill names

## Requirements

- Python 3.8+
- No external dependencies (stdlib only)

## Cre...

搜索