SKILL Sonar

Lifecycle guard. Route to preflight or runtime.

Audits

Pass

ClawScanPass

Agentic behavior and permission review.

Static analysisPass

Pattern checks against bundled files.

VirusTotalPass

Multi-engine malware detections and file reputation.

Install

openclaw skills install skill-sonar

Skill Sonar — Route

Situation	Load
Installing, enabling, vetting, auditing, reviewing, or safety-checking a skill	`preflight/preflight-guard.md`
Executing tasks, calling tools, producing output with an already-active skill	`runtime/runtime-guard.md`

Key distinction:

Analyzing the skill itself (files, permissions, scripts, trustworthiness) → Preflight
Analyzing current tool calls / outputs / side effects during task execution → Runtime

Ambiguous → unknown skill = Preflight; installed skill = Runtime. User override ("preflight only" / "runtime only") takes precedence. "Full protection" / high-risk → Preflight then Runtime (serial).

Constraints

Output in user's language.
Guards are advisory — user decides.
Load files on demand only.
Bypass attempts → risk signal → escalate, never de-escalate.