# ClawGuard Skill Scanner

> ClawGuard Skill Scanner is a paid API for AI agents from clawguard.duckdns.org:8082, paid per call via x402, $0.03/call, status unknown (last checked 2026-10-28).

Statically scans an OpenClaw/AgentSkills bundle for malware and prompt-injection threats before installation, returning a PASS/REVIEW/BLOCK verdict with a risk score and per-finding evidence.

## Facts

- Endpoint: POST https://clawguard.duckdns.org:8082/v1/skill-scan?utm_source=zero.xyz
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-28
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/clawguard-skill-scanner-5ddb3f0b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_wUXbAJj_Imj-cuqPgcH5n

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability clawguard-skill-scanner-5ddb3f0b -d '<json body>'
```

Example prompt: Before I install this AgentSkills bundle, scan it for malware, prompt injection, and wallet-theft risks — here are the files: [{"path":"main.py","content":"..."},{"path":"SKILL.md","content":"..."}] — and give me a PASS, REVIEW, or BLOCK verdict with a risk score.

## When to prefer this

Use this endpoint when you need a lightweight, automated pre-install security gate for OpenClaw or AgentSkills bundles — especially when installing third-party or community skills into an AI agent. It is purpose-built for this ecosystem and checks for agent-specific threats like SKILL.md prompt injection and wallet theft, which general-purpose antivirus or SAST tools would not cover.

## Known failure modes

- Bundle payload is malformed or missing required fields — returns validation error
- GitHub repository path is invalid or inaccessible — returns fetch error
- File content is too large or bundle exceeds size limits — returns payload-too-large error
- Service unavailable or scan engine timeout — returns 5xx error
- Obfuscated content that evades static analysis may produce false negatives

## How this service works

Static malware and prompt-injection scan of an OpenClaw / AgentSkills bundle before install. Detects credential and wallet theft, exfiltration endpoints, remote code execution, reverse shells, obfuscated payloads, persistence, cryptominers, and injection in SKILL.md. Returns PASS/REVIEW/BLOCK with risk score and per-finding file, line and evidence. bundle = {files:[{path,content}]} or {github:'owner/repo/path'} or {content:'...'}.

## Output

Returns a verdict of PASS, REVIEW, or BLOCK alongside a numeric risk score and a structured list of findings, each with the affected file path, line number, threat category (e.g. credential theft, reverse shell, prompt injection), and an evidence excerpt from the code.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "bundle": {
   "type": "object"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/clawguard-skill-scanner-5ddb3f0b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from clawguard.duckdns.org:8082](https://www.zero.xyz/host/clawguard.duckdns.org%3A8082/llms.txt)