Skill Guard
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This package is internally coherent with its stated purpose (an offline/static skill scanner) and intentionally includes malicious test fixtures for detection coverage — do not execute the test scripts or run the scanner in a way that executes scanned code; use it as a static analyzer in a controlled environment.
This is a static threat scanner and contains intentionally malicious sample skills to test its detectors — that is expected. Before installing or running: (1) don't execute any of the test scripts (do not run files under tests/); they perform exfiltration and reverse shells; (2) run the scanner in a read-only/static mode (the provided commands are static scans) and inspect its code if you are unsure; (3) note it will create ~/clawd/skills/skill-guard/baselines.json to store hashes — if you prefer, run it in a disposable/container environment first; (4) verify the skill's origin/author before trusting automatic or remote-download features (check-remote is marked “Future” and would require credentials); (5) if you lack the ability to audit code yourself, run the scanner on a copy of your skills directory in an isolated environment to avoid accidental execution of test payloads.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.