ClawGuard-Guardian

This package mostly looks like a legitimate local 'guardian' tool but there are important inconsistencies you should resolve before installing or enabling it: - Missing external rules: The code requires '../../shared/rules/interceptor-rules.js' which is not included. Ask the author where that file comes from (platform-provided, separate package, or omitted). Running the skill without that module may produce unexpected behavior or silently fall back to insecure defaults. - Verify integration surface: SKILL.md implies agent-level interception of commands, files, and network activity, but the shipped code appears to be a standalone CLI that reads/writes ~/.clawguard logs. Confirm how this skill is intended to hook into your agent runtime and whether additional platform components (Detect/Shield/Auditor) are required. - Inspect omitted implementations: The audit logger and referenced modules (Detect/Shield/etc.) are not present in the package excerpt. Request full source or a signed release, and review any code that handles I/O, network, or dynamic requires before running. - Run in isolation: If you test it, run it in an isolated environment (non-production account/machine) and monitor filesystem and network activity (e.g., with auditd or network monitoring) to ensure it does not exfiltrate data. - Least privilege and logs: Expect it to create persistent logs in ~/.clawguard; if that is unacceptable for your environment, do not install. If you need this functionality, prefer a version that bundles all dependencies or points to a verified, auditable rules module and a public source/homepage. If the author can provide the missing rules module and clarify how the skill integrates with the agent (and show there are no hidden remote endpoints), the assessment could move toward benign. Right now, the unexplained external dependency and mismatch between instructions and shipped code justify caution.