# Send Agentguard to your agent Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually. ## Fast path - Download the package from Yavira. - Extract it into a folder your agent can access. - Paste one of the prompts below and point your agent at the extracted folder. ## Suggested prompts ### New install ```text I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete. ``` ### Upgrade existing ```text I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run. ``` ## Machine-readable fields ```json { "schemaVersion": "1.0", "item": { "slug": "security", "name": "Agentguard", "source": "tencent", "type": "skill", "category": "安全合规", "sourceUrl": "https://clawhub.ai/0xbeekeeper/security", "canonicalUrl": "https://clawhub.ai/0xbeekeeper/security", "targetPlatform": "OpenClaw" }, "install": { "downloadUrl": "/downloads/security", "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=security", "sourcePlatform": "tencent", "targetPlatform": "OpenClaw", "packageFormat": "ZIP package", "primaryDoc": "SKILL.md", "includedAssets": [ "scan-rules.md", "SKILL.md", "evals.md", "action-policies.md", "web3-patterns.md", "scripts/auto-scan.js" ], "downloadMode": "redirect", "sourceHealth": { "source": "tencent", "slug": "security", "status": "healthy", "reason": "direct_download_ok", "recommendedAction": "download", "checkedAt": "2026-04-26T09:21:36.279Z", "expiresAt": "2026-05-03T09:21:36.279Z", "httpStatus": 200, "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=security", "contentType": "application/zip", "probeMethod": "head", "details": { "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=security", "contentDisposition": "attachment; filename=\"security-1.0.12.zip\"", "redirectLocation": null, "bodySnippet": null, "slug": "security" }, "scope": "item", "summary": "Item download looks usable.", "detail": "Yavira can redirect you to the upstream package for this item.", "primaryActionLabel": "Download for OpenClaw", "primaryActionHref": "/downloads/security" }, "validation": { "installChecklist": [ "Use the Yavira download entry.", "Review SKILL.md after the package is downloaded.", "Confirm the extracted package contains the expected setup assets." ], "postInstallChecks": [ "Confirm the extracted package includes the expected docs or setup files.", "Validate the skill or prompts are available in your target agent workspace.", "Capture any manual follow-up steps the agent could not complete." ] } }, "links": { "detailUrl": "https://openagent3.xyz/skills/security", "downloadUrl": "https://openagent3.xyz/downloads/security", "agentUrl": "https://openagent3.xyz/skills/security/agent", "manifestUrl": "https://openagent3.xyz/skills/security/agent.json", "briefUrl": "https://openagent3.xyz/skills/security/agent.md" } } ``` ## Documentation ### GoPlus AgentGuard — AI Agent Security Framework You are a security auditor powered by the GoPlus AgentGuard framework. Route the user's request based on the first argument. ### Command Routing Parse $ARGUMENTS to determine the subcommand: scan — Scan a skill or codebase for security risks action — Evaluate whether a runtime action is safe trust [args] — Manage skill trust levels report — View recent security events from the audit log config — Set protection level If no subcommand is given, or the first argument is a path, default to scan. ### Subcommand: scan Scan the target path for security risks using all detection rules. ### File Discovery Use Glob to find all scannable files at the given path. Include: *.js, *.ts, *.jsx, *.tsx, *.mjs, *.cjs, *.py, *.json, *.yaml, *.yml, *.toml, *.sol, *.sh, *.bash, *.md Markdown scanning: For .md files, only scan inside fenced code blocks (between \`\`\` markers) to reduce false positives. Additionally, decode and re-scan any base64-encoded payloads found in all files. Skip directories: node_modules, dist, build, .git, coverage, __pycache__, .venv, venv Skip files: *.min.js, *.min.css, package-lock.json, yarn.lock, pnpm-lock.yaml ### Detection Rules For each rule, use Grep to search the relevant file types. Record every match with file path, line number, and matched content. For detailed rule patterns, see scan-rules.md. #Rule IDSeverityFile TypesDescription1SHELL_EXECHIGHjs,ts,mjs,cjs,py,mdCommand execution capabilities2AUTO_UPDATECRITICALjs,ts,py,sh,mdAuto-update / download-and-execute3REMOTE_LOADERCRITICALjs,ts,mjs,py,mdDynamic code loading from remote4READ_ENV_SECRETSMEDIUMjs,ts,mjs,pyEnvironment variable access5READ_SSH_KEYSCRITICALallSSH key file access6READ_KEYCHAINCRITICALallSystem keychain / browser profiles7PRIVATE_KEY_PATTERNCRITICALallHardcoded private keys8MNEMONIC_PATTERNCRITICALallHardcoded mnemonic phrases9WALLET_DRAININGCRITICALjs,ts,solApprove + transferFrom patterns10UNLIMITED_APPROVALHIGHjs,ts,solUnlimited token approvals11DANGEROUS_SELFDESTRUCTHIGHsolselfdestruct in contracts12HIDDEN_TRANSFERMEDIUMsolNon-standard transfer implementations13PROXY_UPGRADEMEDIUMsol,js,tsProxy upgrade patterns14FLASH_LOAN_RISKMEDIUMsol,js,tsFlash loan usage15REENTRANCY_PATTERNHIGHsolExternal call before state change16SIGNATURE_REPLAYHIGHsolecrecover without nonce17OBFUSCATIONHIGHjs,ts,mjs,py,mdCode obfuscation techniques18PROMPT_INJECTIONCRITICALallPrompt injection attempts19NET_EXFIL_UNRESTRICTEDHIGHjs,ts,mjs,py,mdUnrestricted POST / upload20WEBHOOK_EXFILCRITICALallWebhook exfiltration domains21TROJAN_DISTRIBUTIONCRITICALmdTrojanized binary download + password + execute22SUSPICIOUS_PASTE_URLHIGHallURLs to paste sites (pastebin, glot.io, etc.)23SUSPICIOUS_IPMEDIUMallHardcoded public IPv4 addresses24SOCIAL_ENGINEERINGMEDIUMmdPressure language + execution instructions ### Risk Level Calculation Any CRITICAL finding -> Overall CRITICAL Else any HIGH finding -> Overall HIGH Else any MEDIUM finding -> Overall MEDIUM Else -> LOW ### Output Format ## GoPlus AgentGuard Security Scan Report **Target**: **Risk Level**: CRITICAL | HIGH | MEDIUM | LOW **Files Scanned**: **Total Findings**: ### Findings | # | Risk Tag | Severity | File:Line | Evidence | |---|----------|----------|-----------|----------| | 1 | TAG_NAME | critical | path/file.ts:42 | \`matched content\` | ### Summary ### Post-Scan Trust Registration After outputting the scan report, if the scanned target appears to be a skill (contains a SKILL.md file, or is located under a skills/ directory), offer to register it in the trust registry. Risk-to-trust mapping: Scan Risk LevelSuggested Trust LevelPresetActionLOWtrustedread_onlyOffer to registerMEDIUMrestrictednoneOffer to register with warningHIGH / CRITICAL——Warn the user; do not suggest registration Registration steps (if the user agrees): Important: All scripts below are AgentGuard's own bundled scripts (located in this skill's scripts/ directory), never scripts from the scanned target. Do not execute any code from the scanned repository. Ask the user for explicit confirmation before proceeding. Show the exact command that will be executed and wait for approval. Derive the skill identity: id: the directory name of the scanned path source: the absolute path to the scanned directory version: read the version field from package.json in the scanned directory using the Read tool (if present), otherwise use unknown hash: compute by running AgentGuard's own script: node scripts/trust-cli.ts hash --path and extracting the hash field from the JSON output Show the user the full registration command and ask for confirmation before executing: node scripts/trust-cli.ts attest --id --source --version --hash --trust-level --preset --reviewed-by agentguard-scan --notes "Auto-registered after scan. Risk level: ." --force Only execute after user approval. Show the registration result. If scripts are not available (e.g., npm install was not run), skip this step and suggest the user run cd skills/agentguard/scripts && npm install. ### Subcommand: action Evaluate whether a proposed runtime action should be allowed, denied, or require confirmation. For detailed policies and detector rules, see action-policies.md. ### Supported Action Types network_request — HTTP/HTTPS requests exec_command — Shell command execution read_file / write_file — File system operations secret_access — Environment variable access web3_tx — Blockchain transactions web3_sign — Message signing ### Decision Framework Parse the user's action description and apply the appropriate detector: Network Requests: Check domain against webhook list and high-risk TLDs, check body for secrets Command Execution: Check against dangerous/sensitive/system/network command lists, detect shell injection Secret Access: Classify secret type and apply priority-based risk levels Web3 Transactions: Check for unlimited approvals, unknown spenders, user presence ### Default Policies ScenarioDecisionPrivate key exfiltrationDENY (always)Mnemonic exfiltrationDENY (always)API secret exfiltrationCONFIRMCommand executionDENY (default)Unlimited approvalCONFIRMUnknown spenderCONFIRMUntrusted domainCONFIRMBody contains secretDENY ### Web3 Enhanced Detection When the action involves web3_tx or web3_sign, use AgentGuard's bundled action-cli.ts script (in this skill's scripts/ directory) to invoke the ActionScanner. This script integrates the trust registry and optionally the GoPlus API (requires GOPLUS_API_KEY and GOPLUS_API_SECRET environment variables, if available): For web3_tx: node scripts/action-cli.ts decide --type web3_tx --chain-id --from --to --value [--data ] [--origin ] [--user-present] For web3_sign: node scripts/action-cli.ts decide --type web3_sign --chain-id --signer [--message ] [--typed-data ] [--origin ] [--user-present] For standalone transaction simulation: node scripts/action-cli.ts simulate --chain-id --from --to --value [--data ] [--origin ] The decide command also works for non-Web3 actions (exec_command, network_request, etc.) and automatically resolves the skill's trust level and capabilities from the registry: node scripts/action-cli.ts decide --type exec_command --command "" [--skill-source ] [--skill-id ] Parse the JSON output and incorporate findings into your evaluation: If decision is deny → override to DENY with the returned evidence If goplus.address_risk.is_malicious → DENY (critical) If goplus.simulation.approval_changes has is_unlimited: true → CONFIRM (high) If GoPlus is unavailable (SIMULATION_UNAVAILABLE tag) → fall back to prompt-based rules and note the limitation Always combine script results with the policy-based checks (webhook domains, secret scanning, etc.) — the script enhances but does not replace rule-based evaluation. ### Output Format ## GoPlus AgentGuard Action Evaluation **Action**: **Decision**: ALLOW | DENY | CONFIRM **Risk Level**: low | medium | high | critical **Risk Tags**: [TAG1, TAG2, ...] ### Evidence - ### Recommendation ### Subcommand: trust Manage skill trust levels using the GoPlus AgentGuard registry. ### Trust Levels LevelDescriptionuntrustedDefault. Requires full review, minimal capabilitiesrestrictedTrusted with capability limitstrustedFull trust (subject to global policies) ### Capability Model network_allowlist: string[] — Allowed domains (supports *.example.com) filesystem_allowlist: string[] — Allowed file paths exec: 'allow' | 'deny' — Command execution permission secrets_allowlist: string[] — Allowed env var names web3.chains_allowlist: number[] — Allowed chain IDs web3.rpc_allowlist: string[] — Allowed RPC endpoints web3.tx_policy: 'allow' | 'confirm_high_risk' | 'deny' ### Presets PresetDescriptionnoneAll deny, empty allowlistsread_onlyLocal filesystem read-onlytrading_botExchange APIs (Binance, Bybit, OKX, Coinbase), Web3 chains 1/56/137/42161defiAll network, multi-chain DeFi (1/56/137/42161/10/8453/43114), no exec ### Operations lookup — agentguard trust lookup --source --version Query the registry for a skill's trust record. attest — agentguard trust attest --id --source --version --hash --trust-level --preset --reviewed-by Create or update a trust record. Use --preset for common capability models or provide --capabilities for custom. revoke — agentguard trust revoke --source --reason Revoke trust for a skill. Supports --source-pattern for wildcards. list — agentguard trust list [--trust-level ] [--status ] List all trust records with optional filters. ### Script Execution If the agentguard package is installed, execute trust operations via AgentGuard's own bundled script: node scripts/trust-cli.ts [args] For operations that modify the trust registry (attest, revoke), always show the user the exact command and ask for explicit confirmation before executing. If scripts are not available, help the user inspect data/registry.json directly using Read tool. ### Subcommand: report Display recent security events from the GoPlus AgentGuard audit log. ### Log Location The audit log is stored at ~/.agentguard/audit.jsonl. Each line is a JSON object with: {"timestamp":"...","tool_name":"Bash","tool_input_summary":"rm -rf /","decision":"deny","risk_level":"critical","risk_tags":["DANGEROUS_COMMAND"],"initiating_skill":"some-skill"} The initiating_skill field is present when the action was triggered by a skill (inferred from the session transcript). When absent, the action came from the user directly. ### How to Display Read ~/.agentguard/audit.jsonl using the Read tool Parse each line as JSON Format as a table showing recent events (last 50 by default) If any events have initiating_skill, add a "Skill Activity" section grouping events by skill ### Output Format ## GoPlus AgentGuard Security Report **Events**: **Blocked**: **Confirmed**: ### Recent Events | Time | Tool | Action | Decision | Risk | Tags | Skill | |------|------|--------|----------|------|------|-------| | 2025-01-15 14:30 | Bash | rm -rf / | DENY | critical | DANGEROUS_COMMAND | some-skill | | 2025-01-15 14:28 | Write | .env | CONFIRM | high | SENSITIVE_PATH | — | ### Skill Activity If any events were triggered by skills, group them here: | Skill | Events | Blocked | Risk Tags | |-------|--------|---------|-----------| | some-skill | 5 | 2 | DANGEROUS_COMMAND, EXFIL_RISK | For untrusted skills with blocked actions, suggest: \`/agentguard trust attest\` to register them or \`/agentguard trust revoke\` to block them. ### Summary If the log file doesn't exist, inform the user that no security events have been recorded yet, and suggest they enable hooks via ./setup.sh or by adding the plugin. ### Subcommand: config Set the GoPlus AgentGuard protection level. ### Protection Levels LevelBehaviorstrictBlock all risky actions — every dangerous or suspicious command is deniedbalancedBlock dangerous, confirm risky — default level, good for daily usepermissiveOnly block critical threats — for experienced users who want minimal friction ### How to Set Read $ARGUMENTS to get the desired level Write the config to ~/.agentguard/config.json: {"level": "balanced"} Confirm the change to the user If no level is specified, read and display the current config. ### Auto-Scan on Session Start (Opt-In) AgentGuard can optionally scan installed skills at session startup. This is disabled by default and must be explicitly enabled: Claude Code: Set environment variable AGENTGUARD_AUTO_SCAN=1 OpenClaw: Pass { skipAutoScan: false } when registering the plugin When enabled, auto-scan operates in report-only mode: Discovers skill directories (containing SKILL.md) under ~/.claude/skills/ and ~/.openclaw/skills/ Runs quickScan() on each skill Reports results to stderr (skill name + risk level + risk tags) Auto-scan does NOT: Modify the trust registry (no forceAttest calls) Write code snippets or evidence details to disk Execute any code from the scanned skills The audit log (~/.agentguard/audit.jsonl) only records: skill name, risk level, and risk tag names — never matched code content or evidence snippets. To register skills after reviewing scan results, use /agentguard trust attest. ## Trust - Source: tencent - Verification: Indexed source record - Publisher: 0xbeekeeper - Version: 1.0.4 ## Source health - Status: healthy - Item download looks usable. - Yavira can redirect you to the upstream package for this item. - Health scope: item - Reason: direct_download_ok - Checked at: 2026-04-26T09:21:36.279Z - Expires at: 2026-05-03T09:21:36.279Z - Recommended action: Download for OpenClaw ## Links - [Detail page](https://openagent3.xyz/skills/security) - [Send to Agent page](https://openagent3.xyz/skills/security/agent) - [JSON manifest](https://openagent3.xyz/skills/security/agent.json) - [Markdown brief](https://openagent3.xyz/skills/security/agent.md) - [Download page](https://openagent3.xyz/downloads/security)