Skill: yangyixxxx/skillguard-check (version 1.0.0)

--- name: skillguard-check description: "Audit every locally-installed AI Skill against skill-guard's public security database (skillguard.vip). Use when (1) the user asks 'are my skills safe?' or 'check my skills', (2) the user just installed a new skill from ClawHub / OpenClaw / a marketplace, (3) before invoking an unfamiliar skill, (4) on a periodic security check. Surfaces blocked skills (hard-trigger rules fired) and high-risk skills (score < 50)." allowed-tools: - Bash - Read metadata: homepage: https://skillguard.vip audit: https://skillguard.vip/skills/clawhub/skillguard-check source: https://github.com/yangyixxxx/skillguard --- # skillguard-check Audit AI Skills installed on this machine against the public skill-guard security database at https://skillguard.vip. Returns a JSON report listing **blocked** and **high-risk** skills along with links to their public audit pages so the user can decide what to uninstall. ## When to invoke Trigger this skill any time the user expresses concern about installed-skill safety, or after the user installs a new skill. Concrete cues: - "are my skills safe?", "check my installed skills", "audit my skills" - "I just installed XYZ from ClawHub, is it ok?" - "any malicious skills on my machine?" - The user mentions a skill name and asks if it's trusted. - Periodic: when no audit has been run this session and the user is doing security-sensitive work (handling secrets, on a new machine, etc.). ## How to invoke Run the bundled script. It needs Python 3 (pre-installed on macOS / most Linux). No network access beyond `https://skillguard.vip`. ```bash python3 scripts/check.py ``` The script outputs a single JSON object to stdout. Sample shape: ```json { "total": 12, "audited": 9, "unauditedCount": 3, "blocked": [ { "slug": "openclaw-omni-expert", "path": "/Users/x/.claude/skills/openclaw-omni-expert", "score": 3, "riskLevel": "Critical", "findingsCount": 155, "auditUrl": "https://skillguard.vip/skills/clawhub/openclaw-omni-expert" } ], "highRisk": [ { "slug": "some-skill", "score": 42, "riskLevel": "High", "auditUrl": "..." } ], "medium": [...], "safe": 5, "unaudited": [ {"slug": "my-private-skill", "path": "...", "reason": "not in skill-guard database"} ], "errors": [] } ``` ## How to report back to the user After parsing the JSON: 1. **If `blocked` is non-empty** — open with `⚠️ <N> blocked skill(s) found on this machine.` Then for each entry, give: - the slug + install path, - a one-line risk summary (use riskLevel + findingsCount), - the `auditUrl` so they can see findings, - a recommendation to uninstall. 2. **If `highRisk` is non-empty (and no blocked)** — open with `Found <N> high-risk skill(s).` Same format but softer language: "review the audit page and consider whether you trust the publisher". 3. **If only `medium`/`safe`/`unaudited`** — `No blocked or high-risk skills detected.` Mention the unaudited count so the user knows some skills couldn't be checked (private/local skills that haven't been uploaded to skill-guard's database). 4. **Always end with** the `auditUrl` for each surfaced skill. Don't paraphrase the audit verdict — link to the canonical page so the user reads the real findings, not a summary. ## What gets scanned The script checks these install paths (in order): | Path | Used by | |---|---| | `~/.claude/skills/` | Claude Code | | `~/.openclaw/skills/` | OpenClaw | | `~/.local/share/claude-skills/` | Linux convention | | `~/.skills/` | Generic | | `~/Library/Application Support/Claude/skills/` | Claude Desktop on macOS | Each immediate subdirectory is treated as one skill, named by the directory. The script then queries `https://skillguard.vip/skills/clawhub/<slug>.json` for the public audit verdict. Skills that aren't in the public database (private skills, custom builds, unpublished bundles) are reported under `unaudited` — not flagged, but called out so the user knows they're un-audited. ## Limitations - **Only checks skills that match a slug in skill-guard's ClawHub-sourced database.** Privately-developed skills won't have an audit. Users can run a fresh scan via `https://skillguard.vip/` (paste the GitHub URL) or `POST /v1/scan/upload` with a zip. - **Uses the most recent verdict in skill-guard's DB.** If a skill was re-published on ClawHub after the last skill-guard scan, the verdict may be stale. The audit page shows `lastScannedAt` for transparency. - **Slug-matching only.** Two different skills with the same directory name (e.g. `github`) collide. The audit URL is the source of truth — if the displayed name doesn't match what the user installed, treat as unaudited.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)