Skill Guard 🛡️

Security-first skill install/download guardian protocol. Never install/download a skill without running security check first.

⛔ MANDATORY INTERCEPTION RULE

This skill MUST be triggered whenever the user's message matches ANY of the following INTENT PATTERNS (in any language, including synonyms, paraphrases, word order variations, or mixed-language expressions):

INTENT CATEGORIES (trigger if the message expresses ANY of these intents):

1. 1. ACQUIRE A SKILL

The user wants to install, add, download, enable, load, import, deploy, or otherwise obtain a skill/tool. Examples: "install", "add", "download", "get", "enable", "set up", "bring in", "put in", "grab", "fetch", "pull in", "register" + target object is a skill, tool, or a URL pointing to one.

1. 2. SCAN / VERIFY A SKILL

The user wants to scan, check, inspect, audit, or verify the safety/integrity of a skill. Examples: "scan", "check", "inspect", "audit", "verify", "validate", "test safety" + target object is a skill, all skills, or a scheduled task involving skills.

TRIGGER RULES:

• - Match on INTENT + OBJECT together, not on exact phrases.
• A URL pointing to a skill resource (e.g. clawhub, convex.site, github, or any skill download endpoint) counts as the OBJECT signal even if the word "skill" is absent.
• Synonyms, compound verbs, and reordered phrases all count (e.g. "下载安装", "帮我弄进来", "把这个装上").
• Any language is valid. Mixed-language input (e.g. "帮我 install 这个 skill") also triggers.
• When in doubt, TRIGGER. False positives are acceptable; missed triggers are not.

When triggered, you MUST follow this exact sequence:

1. 1. STOP — do NOT execute clawhub install, clawhub resolve, npx clawhub install or any install/download command yet
2. FIRST run the Guardian Protocol (Step 1 → Step 2 → Step 3 below)
3. Copy report_text from JSON verbatim — display it exactly as-is to the user. NEVER write your own security report.
4. Then decide based on JSON bd_confidence field:

- ✅ safe → proceed with install automatically - ⚠️ caution → warn user and wait for explicit confirmation - ❌ danger / null / error → warn user and wait for explicit confirmation

🚨 NO EXCEPTIONS. Do not skip this protocol. Do not install first and check later. Do not generate your own report — always use report_text from the script output.

When to Use

• - Before installing/downloading any skill from ClawdHub、百度 AppBuilder 平台、github or other sources
• Before running skills from GitHub repos
• When evaluating skills shared by other agents
• Anytime you're asked to install, add, enable, or download any skill
• When asked to scan a specific installed skill for security risks
• When asked to scan all installed skills
• When setting up scheduled security scans for skills

Guardian Protocol

Step 1: Identify the Skill (MANDATORY)

Before executing any install command, you MUST first confirm:

CODEBLOCK0

If the user only provides a name (not a slug), search to confirm the slug first, but do NOT run any install command.

Step 2: Run API Security Check (MANDATORY — Core Step)

Before installing, you MUST run the security check script. Use scripts/check.sh to call the security API:

Scenario A: Query by slug (for direct install by name)

• - Use --slug to query by the skill's slug identifier.

CODEBLOCK1

Scenario C: Scan a specific installed skill by directory

• - Use --action query --file to pass the installed skill directory directly. The script auto-extracts slug from _meta.json (fallback to directory name) and version from SKILL.md frontmatter, then queries the API with SHA256 fallback.

CODEBLOCK2

Scenario D: Batch query all skills in a directory (full scan / scheduled scan)

• - D1 (scan all skills): Use --action queryfull --file with the /path/to/skills parent directory to batch-query all subdirectories by slug and produce a Batch Report
• D2 (scheduled scan): Same as D1 but triggered by a scheduled mechanism (e.g. cron)

CODEBLOCK3

⚠️ Skipping this step and installing directly violates the security protocol.

The script outputs JSON to stdout containing a pre-rendered report_text field and structured decision fields. Exit code: 0 = safe, 1 = non-safe (business judgment), 2 = error (check failed).

Output JSON fields (Scenario A/C — single skill):

Field	Description
INLINECODE19	INLINECODE20 or INLINECODE21
INLINECODE22

Safety level: "safe", "caution", or "danger" |
| final_verdict | Human-readable verdict string (e.g. "✅ 安全安装", "⚠️ 谨慎安装(需人工确认)") |
| report_text | Pre-formatted plain-text security report — display this verbatim to the user |

Example output (Scenario A — single skill query):
CODEBLOCK4

Output JSON fields (Scenario D — batch scan):

Field	Description
INLINECODE30	INLINECODE31 or INLINECODE32
INLINECODE33

Total number of skills scanned |
| safe_count | Number of safe skills |
| danger_count | Number of dangerous skills |
| caution_count | Number of caution skills |
| report_text | Pre-formatted plain-text batch report — display this verbatim to the user |

Example output (Scenario D — batch scan):
CODEBLOCK5

Step 3: Display Report Verbatim & Decide (MANDATORY)

⛔ CRITICAL RULE: You MUST display report_text from the JSON exactly as-is. NEVER generate, summarize, rephrase, or reformat the security report yourself. The report is pre-rendered by the script — your only job is to copy it.

How to process the output:

1. 1. Parse the JSON from stdout
2. Extract the report_text field and output it verbatim to the user — preserve every line break, symbol, separator, and space exactly as they appear in the string. Render \n as actual line breaks.
3. Read bd_confidence (Scenario A/C) or danger_count + caution_count (Scenario D) to decide the next action (see decision rules below).
4. After the report, state your decision on a new line.

✅ CORRECT output (copy report_text as-is):
CODEBLOCK6

Decision rules for Scenario A/C (single skill):

INLINECODE45	Action
INLINECODE46	✅ Proceed with install automatically
INLINECODE47

⚠️ Warn user, wait for explicit confirmation before installing |
| danger / missing / null | ❌ Warn user, recommend NOT installing, wait for explicit confirmation |

If code is "error" → ❌ Hold off, advise user to retry later.

Decision rules for Scenario D (batch scan):

• - danger_count > 0 → ❌ List dangerous skills, warn user
• INLINECODE53 → ⚠️ List caution skills, ask user for review
• All safe → ✅ Report all clear

Do NOT add any commentary, headers, or footers around the report_text. Do NOT rewrite the report in your own words or style. Show report_text first, then state your decision on a new line.

Important Notes

• - No skill is worth compromising security
• When in doubt, don't install
• Delegate high-risk decisions to human judgment
• When API call fails (timeout, network error, etc.), the script outputs an error report with exit code 2 — verdict is ❌ Hold off, advise user to retry later, do not skip the check

---

Security is the bottom line, not an option. 🛡️🦀