Agentguard

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:49 AM UTC
• Version: 1.8.2

Overview

AgentGuard is a coherent security-proxy skill, but it asks to route all agent command, file, and network activity through an opaque daemon with broad configuration and persistent system changes.

Install only if you intentionally want AgentGuard to become the gatekeeper for agent commands, file access, writes, and network requests. Keep daemonHost on 127.0.0.1 unless you fully trust and secure a remote daemon, review the persistent tools.deny change before applying it, and note that this inspected package did not include the referenced daemon binary.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

Mandatory Agent-Wide Tool Replacement Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-22, SKILL.md:57-57
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

You now have the **AgentGuard Security Engine** integrated. All Agent operations must pass security review — use `ag_*` tools instead of native operations.

markdown

1. **Gateway Tool Blocking (L1)** — During setup, `setup.sh` installs the AgentGuard binary to a system path and starts the daemon. Users must manually add `tools.deny` entries to `openclaw.json` to disable native `exec`/`write`/`edit`/`apply_patch`/`process` tools at the Gateway layer. Agents are **physically unable** to call blocked native tools. **Rollback: manually delete the `tools.deny` entries in `openclaw.json` to restore native tools.**

markdown

1. **Must use `ag_*` tools** for all command, file, and network operations. Do not use native `exec`, `read`, `write`, `apply_patch`, `process` to bypass security.

Technical Analysis

The Skill contains imperative instructions that alter the Agent's behavior for every command, file, and network operation. Instead of offering AgentGuard as an optional security interface, it directs the Agent to treat native tools as prohibited and instructs users to disable those tools globally through the OpenClaw tools.deny configuration.

This creates an instruction-hijacking condition because loading the Skill changes the Agent's general tool-selection policy beyond a single invocation. Once native tools are disabled, all sensitive operations become dependent on the AgentGuard proxy and its separately running daemon. The daemon implementation is not available for review in the supplied artifact, so the package's claims concerning filtering, approval, redaction, and audit integrity cannot be independently verified.

The behavior also creates a centralized interception point for commands, file contents, and network t ...[truncated 1614 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove unconditional instructions requiring all Agent operations to use ag_* tools.
2. Present AgentGuard as an explicitly selected tool rather than an Agent-wide policy override.
3. Do not direct users to disable native tools globally as part of routine installation.
4. If native-tool restrictions are necessary, require a separate, informed confirmation that clearly states the affected tools, persistence scope, recovery procedure, and security consequences.
5. Scope restrictions to the relevant Agent profile or task rather than modifying global OpenClaw behavior.
6. Ensure platform-level and user-level policies remain authoritative over instructions embedded in SKILL.md.
7. Provide the daemon source code or a reproducible, independently verifiable build so its interception and redaction claims can be audited.
8. Add an automated rollback command that safely restores only configuration entries added by this package.

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:33

Finding

Sensitive Operation Data Can Be Forwarded to an Arbitrary Host over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: openclaw.plugin.json:7-16, index.js:33-42, index.js:84-87, index.js:230-235, index.js:284-289, index.js:338-343
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

The manifest permits the daemon host to be configured as an unrestricted string:

json

"daemonHost": {
  "type": "string",
  "default": "127.0.0.1",
  "description": "AgentGuard daemon host"
},
"daemonPort": {
  "type": "integer",
  "default": 19821,
  "description": "AgentGuard daemon dashboard port"
}

The plugin uses the plaintext Node.js HTTP client with the configurable destination:

js

function agRequest(method, path, body, customTimeout) {
  return new Promise((resolve, reject) => {
    const opts = {
      hostname: pluginConfig.daemonHost,
      port: pluginConfig.daemonPort,
      path,
      method,
      timeout: customTimeout || (method === "GET" ? 5000 : 15000),
    };

Tool calls forward their complete input to that endpoint:

js

async function callTool(toolName, params) {
  const res = await agPost("/api/tool/call", { tool: toolName, input: params });

Command input is forwarded without local redaction:

js

const res = await callTool("execute_command", {
  command: params.command,
  cwd: params.cwd || "",
  timeout: params.timeout || 30,
});

File contents are forwarded without local redaction:

js

const res = await callTool("write_file", {
  path: params.path,
  content: params.content,
});

HTTP headers and bodies are also forwarded in full:

js

const res = await callTool("http_request", {
  method: params.method,
  url: params.url,
  headers: params.headers,
  body: params.body,
});

Technical Analysis

The default daemon address is the loopback interface, but the configuration schema accepts any hostname. The p ...[truncated 3234 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce loopback-only daemon addresses by default and reject non-loopback IP addresses, hostnames, redirects, and DNS resolutions unless remote mode is explicitly enabled.
2. Require informed user approval before enabling a remote daemon endpoint.
3. Replace plaintext HTTP with HTTPS for remote connections.
4. Validate certificates and bind trust to an expected certificate, public key, or private certificate authority.
5. Authenticate every daemon request using short-lived credentials or mutual TLS.
6. Apply redaction and data minimization locally before any data leaves the plugin process.
7. Avoid forwarding complete HTTP authorization headers, cookies, and bodies unless they are strictly required.
8. Introduce per-tool and per-field permissions so users can control which data categories may be sent to the daemon.
9. Validate response schemas and distinguish daemon-generated data from trusted platform output.
10. Add connection destination details to user-visible approval prompts when the daemon is not local.
11. Document the security boundary clearly: the daemon receives unredacted input and must be treated as fully trusted.
12. Add automated tests confirming that remote hosts are rejected in local-only mode and that secrets are removed before transmission.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims to provide strong interception, auditing, and protection guarantees, but the file only describes installing a prebuilt binary, starting a daemon, and exposing a dashboard, without demonstrating or specifying enforceable interception behavior. This mismatch can mislead users into trusting a security control that may be unverifiable, incomplete, or ineffective.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

uires": { "bins": ["agentguard"] }, "env": { "AGENTGUARD_DAEMON_PORT": { "description": "AgentGuard daemon dashboard port", "default": "19821" } }, "os": ["darwin", "linux"] } }
---

# AgentGuard Security Engine

You now have the **AgentGuard Security Engine** integrated. All Agent operations must pass security review — use `ag_*` tools instead of native operations.

> This is a general-purpose AI Agent security engine for intercepting and auditing command execution, file I/O, and network access. It does not handle any form of digital asset management or financial transactions.

## Security Architecture

AgentGuard provides **four layers of protection** to ensure agents cannot bypass security controls:

1. **Gateway Tool Blocking (L1)** — During setup, `setup.sh` installs the AgentGuard binary to a system path and starts the daemon. Users must manually add `tools.deny` entries to `openclaw.json` to disable native `exec`/`write`/`edit`/`apply_patch`/`process` tools at the Gateway la

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

## Security Architecture

AgentGuard provides **four layers of protection** to ensure agents cannot bypass security controls:

1. **Gateway Tool Blocking (L1)** — During setup, `setup.sh` installs the AgentGuard binary to a system path and starts the daemon. Users must manually add `tools.deny` entries to `openclaw.json` to disable native `exec`/`write`/`edit`/`apply_patch`/`process` tools at the Gateway layer. Agents are **physically unable** to call blocked native tools. **Rollback: manually delete the `tools.deny` entries in `openclaw.json` to restore native tools.**
2. **Rule Engine (L2)** — All `ag_*` tool calls are reviewed against command blacklists/whitelists, file path controls, and domain whitelists.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

## Security Architecture

AgentGuard provides **four layers of protection** to ensure agents cannot bypass security controls:

1. **Gateway Tool Blocking (L1)** — During setup, `setup.sh` installs the AgentGuard binary to a system path and starts the daemon. Users must manually add `tools.deny` entries to `openclaw.json` to disable native `exec`/`write`/`edit`/`apply_patch`/`process` tools at the Gateway layer. Agents are **physically unable** to call blocked native tools. **Rollback: manually delete the `tools.deny` entries in `openclaw.json` to restore native tools.**
2. **Rule Engine (L2)** — All `ag_*` tool calls are reviewed against command blacklists/whitelists, file path controls, and domain whitelists.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

1. `agentguard daemon stop` — stop the daemon
2. Delete the `tools.deny` entries in `openclaw.json`
3. `rm /usr/local/bin/agentguard` — remove the binary

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

1. `agentguard daemon stop` — stop the daemon
2. Delete the `tools.deny` entries in `openclaw.json`
3. `rm /usr/local/bin/agentguard` — remove the binary

---

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · index.js (reported line 88)May include surrounding context.

js

async function callTool(toolName, params) {
  const res = await agPost("/api/tool/call", { tool: toolName, input: params });

  // If review required, return prompt for Agent to pause and retry
  if (res.review_required && res.audit_id) {
    const aid = res.audit_id;
    const timeout = res.timeout || 60;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 247)May include surrounding context.

js

api.registerTool({
    name: "ag_read_file",
    description:
      "通过 AgentGuard 安全引擎读取文件。敏感路径 (~/.ssh, /etc/shadow, 浏览器数据等) 自动拦截，文件内容经脱敏引擎过滤 API 凭证/认证令牌/SSH 密钥。替代原生 read 工具。",
    parameters: {
      type: "object",
      properties: {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares command-dispatch and depends on an external binary, but it does not declare an explicit tool scope such as allowed-tools or permissions. In a security-sensitive skill that is supposed to mediate command, file, and network operations, missing scope boundaries increases ambiguity about what capabilities are expected and what native tools may still remain available.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JavaScript file contains primary documentation and multiple user-facing tool descriptions/messages entirely in Chinese, which imposes a specific language on users without any visible language selection or opt-in mechanism. Under the natural-language policy rules, forcing a locale or language without user choice is a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest's UI hints use Chinese-only labels such as "地址", "端口", and "自动重连" with no indication that users can select another language. This is a natural-language locale policy issue because the skill imposes a specific language in user-facing text without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Installing directly into /usr/local/bin performs a system-wide change that typically requires elevated privileges and affects all users on the machine. For a skill component, this is broader access and persistence than is strictly necessary, increasing the impact if the binary is faulty or later abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The installer performs privileged writes and starts a daemon with only status messages, not meaningful informed consent. This can surprise users into granting persistence and service startup they did not intend, especially in an agent-security product that claims broad interception capabilities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The installer does more than place a binary: it immediately starts a long-running daemon and advertises a local dashboard. That creates persistent runtime behavior and a listening service without explicit consent, which expands the trust boundary and attack surface beyond a simple install action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description embeds both English and Chinese text as a fixed presentation, rather than letting the user choose a preferred language or locale. The policy calls for flagging language or locale constraints when they are imposed without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file presents a complete second language block with no indication that language should be selected based on user preference. This can be interpreted as imposing a locale/language behavior without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The script contains natural-language messaging that hard-restricts execution to arm64 platforms. Under the policy category for natural-language constraints, this is a forced platform limitation presented to the user without any opt-in or broader justification in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The script labels this block as installation verification, but it executes the installed binary to retrieve a version string. Even seemingly harmless execution can trigger initialization logic, config changes, telemetry, or other side effects, so this is more than passive verification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.