Axiomata Guard Scanner

Axiomata Guard Scanner — Universal security scanner for any OpenClaw skill. Use when: (1) scanning a skill for security threats before installation, (2) checking for malicious code patterns (C2, rootkits, bootkits, chains), (3) validating skill safety with multiple vaccines, (4) any security audit of OpenClaw skills. This skill provides: VAX-001 (ClawHub malicious), VAX-027 (C2/exfiltration), VAX-028 (cross-vector chains), VAX-029 (rootkit/bootkit), VAX-030 (package ecosystem). Works with any agent — fully impersonal.

Universal OpenClaw skill security scanner Impersonal — works for any agent

---

Description

Axiomata Guard Scanner protects OpenClaw agents by scanning skills for security threats. It uses multiple "vaccines" (detection engines) to identify malicious patterns before installation.

Trigger: Before installing any skill, especially from ClawHub.

---

Security Layers

Layer 1: ClawHub Malicious Pattern Check (VAX-001)

text

Checks for known malicious patterns:
- Malicious binary downloads (openclawcli.zip)
- RCE via glot.io snippets
- Malware via GitHub releases
- Password-protected archives

Layer 2: C2 & Data Exfiltration Detection (VAX-027)

text

Detects command & control infrastructure:
- Suspicious DNS lookups
- Discord/Telegram webhooks
- Bit.ly / short URL redirects
- Exfiltration patterns

Layer 3: Cross-Vector Attack Chain (VAX-028)

text

Correlates findings from other vaccines:
- Multiple attack vectors
- Chain escalation patterns
- Combined threat assessment

Layer 4: Rootkit & Bootkit Detection (VAX-029)

text

Detects kernel-level threats:
- System manipulation patterns
- Driver injection
- UEFI threats

Layer 5: Package Ecosystem Attacks (VAX-030)

text

Detects package-level attacks:
- typosquatting
- dependency confusion
- malicious packages

---

Usage

Scan a skill file

bash

python3 scripts/guard_scanner.py --file <skill-path>

Scan skill code directly

bash

python3 scripts/guard_scanner.py --code "<skill code>"

JSON output

bash

python3 scripts/guard_scanner.py --file <skill-path> --json

---

Output Format

json

{
  "scanner": "Axiomata Guard Scanner",
  "version": "1.0.0",
  "skill_name": "...",
  "global_threat_level": "CLEAN | LOW | MEDIUM | HIGH | CRITICAL",
  "global_score": 0-300,
  "decision": "APPROVE | WARN | NEUTRALIZE | ISOLATE",
  "triggered_vaccines": [...],
  "summary": {...}
}

---

Threat Levels

Level	Score	Action
CLEAN	0	APPROVE
LOW	1-19	APPROVE with monitoring
MEDIUM	20-49	WARN — manual review
HIGH	50-79	NEUTRALIZE
CRITICAL	80+	ISOLATE immediately

---

In Altum Per Security. Axiomata Guard Scanner v1.0.0