Caelguard: Open-source security scanner for OpenClaw skills
Caelguard is an open-source security scanner designed specifically for the OpenClaw ecosystem that runs locally without network calls. It automates checking for security vulnerabilities in skills published on ClawHub.
Security findings from OpenClaw research
The research identified that the barrier to publish a skill on ClawHub is minimal: only a SKILL markdown file and a week-old GitHub account are required, with no code signing or review process. Skills inherit full agent permissions including shell access, filesystem read/write, and credential access.
Analysis found that roughly 1 in 5 published skills contains concerning security issues:
- Prompt injection
- Credential harvesting
- Obfuscated payloads
- Data exfiltration patterns
Specific patterns to watch for
The scanner checks for these specific indicators of compromise in installed skills:
- Base64 blobs in markdown files (common obfuscation technique)
- Zero-width characters or Unicode tag range (U+E0000) in SKILL markdown
- Prerequisites that ask users to run curl commands or disable security settings
- Scripts that access sensitive directories and files including
.ssh/,.env, orauth-profiles.json - Socket connections or
/dev/tcppatterns in any script exec/evalcalls with string concatenation
Tool details
Caelguard is available under MIT license at github.com/Justincredible-tech/caelguard-community. The tool runs locally and makes no network calls, ensuring privacy during security audits.
📖 Read the full source: r/openclaw
👀 See Also
NPM Compromise via Axios Backdoor: Impact on AI Coding Agents
On March 31, 2026, a DPRK-linked threat actor compromised npm by publishing backdoored versions of Axios (1.14.1 and 0.30.4) during a 3-hour window. The malware injected a dependency that downloaded a platform-specific RAT, harvested credentials, and self-erased, with AI coding agents like Claude Code and Cursor being particularly vulnerable due to automated npm installs.
Endo Familiar: Object-Capability Sandbox for AI Agents
Endo Familiar implements object-capability security for AI agents: agents start with zero ambient authority, receive only explicit references to specific files or directories, and can derive narrower capabilities in sandboxed code.
Security probe results for OpenClaw, PicoClaw, ZeroClaw, IronClaw, and Minion AI agents
A security evaluation of five AI coding agents tested 145 attack payloads across 12 categories including prompt injection, jailbreaking, and data exfiltration. OpenClaw scored 77.8/100 with critical SQL injection vulnerabilities, while Minion improved from 81.2 to 94.4/100 after fixes.
Three Email-Based Attack Vectors Against AI Agents That Read Email
A Reddit post details three specific methods attackers can use to hijack AI agents that process email: Instruction Override, Data Exfiltration, and Token Smuggling. These exploit the agent's inability to distinguish legitimate instructions from malicious ones embedded in email text.