Audit every locally-installed AI Skill against skill-guard's public security database (skillguard.vip). Use when (1) the user asks 'are my skills safe?' or '...
---
name: skillguard-check
description: "Audit every locally-installed AI Skill against skill-guard's public security database (skillguard.vip). Use when (1) the user asks 'are my skills safe?' or 'check my skills', (2) the user just installed a new skill from ClawHub / OpenClaw / a marketplace, (3) before invoking an unfamiliar skill, (4) on a periodic security check. Surfaces blocked skills (hard-trigger rules fired) and high-risk skills (score < 50)."
allowed-tools:
- Bash
- Read
metadata:
homepage: https://skillguard.vip
audit: https://skillguard.vip/skills/clawhub/skillguard-check
source: https://github.com/yangyixxxx/skillguard
---
# skillguard-check
Audit AI Skills installed on this machine against the public skill-guard
security database at https://skillguard.vip. Returns a JSON report listing
**blocked** and **high-risk** skills along with links to their public audit
pages so the user can decide what to uninstall.
## When to invoke
Trigger this skill any time the user expresses concern about installed-skill
safety, or after the user installs a new skill. Concrete cues:
- "are my skills safe?", "check my installed skills", "audit my skills"
- "I just installed XYZ from ClawHub, is it ok?"
- "any malicious skills on my machine?"
- The user mentions a skill name and asks if it's trusted.
- Periodic: when no audit has been run this session and the user is doing
security-sensitive work (handling secrets, on a new machine, etc.).
## How to invoke
Run the bundled script. It needs Python 3 (pre-installed on macOS / most
Linux). No network access beyond `https://skillguard.vip`.
```bash
python3 scripts/check.py
```
The script outputs a single JSON object to stdout. Sample shape:
```json
{
"total": 12,
"audited": 9,
"unauditedCount": 3,
"blocked": [
{
"slug": "openclaw-omni-expert",
"path": "/Users/x/.claude/skills/openclaw-omni-expert",
"score": 3,
"riskLevel": "Critical",
"findingsCount": 155,
"auditUrl": "https://skillguard.vip/skills/clawhub/openclaw-omni-expert"
}
],
"highRisk": [
{
"slug": "some-skill",
"score": 42,
"riskLevel": "High",
"auditUrl": "..."
}
],
"medium": [...],
"safe": 5,
"unaudited": [
{"slug": "my-private-skill", "path": "...", "reason": "not in skill-guard database"}
],
"errors": []
}
```
## How to report back to the user
After parsing the JSON:
1. **If `blocked` is non-empty** — open with `⚠️ <N> blocked skill(s) found
on this machine.` Then for each entry, give:
- the slug + install path,
- a one-line risk summary (use riskLevel + findingsCount),
- the `auditUrl` so they can see findings,
- a recommendation to uninstall.
2. **If `highRisk` is non-empty (and no blocked)** — open with `Found <N>
high-risk skill(s).` Same format but softer language: "review the audit
page and consider whether you trust the publisher".
3. **If only `medium`/`safe`/`unaudited`** — `No blocked or high-risk
skills detected.` Mention the unaudited count so the user knows some
skills couldn't be checked (private/local skills that haven't been
uploaded to skill-guard's database).
4. **Always end with** the `auditUrl` for each surfaced skill. Don't
paraphrase the audit verdict — link to the canonical page so the user
reads the real findings, not a summary.
## What gets scanned
The script checks these install paths (in order):
| Path | Used by |
|---|---|
| `~/.claude/skills/` | Claude Code |
| `~/.openclaw/skills/` | OpenClaw |
| `~/.local/share/claude-skills/` | Linux convention |
| `~/.skills/` | Generic |
| `~/Library/Application Support/Claude/skills/` | Claude Desktop on macOS |
Each immediate subdirectory is treated as one skill, named by the directory.
The script then queries `https://skillguard.vip/skills/clawhub/<slug>.json`
for the public audit verdict.
Skills that aren't in the public database (private skills, custom builds,
unpublished bundles) are reported under `unaudited` — not flagged, but
called out so the user knows they're un-audited.
## Limitations
- **Only checks skills that match a slug in skill-guard's ClawHub-sourced
database.** Privately-developed skills won't have an audit. Users can run
a fresh scan via `https://skillguard.vip/` (paste the GitHub URL) or
`POST /v1/scan/upload` with a zip.
- **Uses the most recent verdict in skill-guard's DB.** If a skill was
re-published on ClawHub after the last skill-guard scan, the verdict may
be stale. The audit page shows `lastScannedAt` for transparency.
- **Slug-matching only.** Two different skills with the same directory
name (e.g. `github`) collide. The audit URL is the source of truth — if
the displayed name doesn't match what the user installed, treat as
unaudited.
don't have the plugin yet? install it then click "run inline in claude" again.