Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jd-opensource/joysafeter/openclaw-threat-detect)<a href="https://agentmods.dev/skills/jd-opensource/joysafeter/openclaw-threat-detect"><img src="https://agentmods.dev/badge/skills/jd-opensource/joysafeter/openclaw-threat-detect.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02378 |
| Opus 5 | $0.00026 | $0.01189 |
| Sonnet 5 | $0.00011 | $0.00476 |
| Haiku 4.5 | $0.00005 | $0.00238 |
Grade D, and why
openclaw-threat-detect scanned grade D with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
| 角色劫持 | "Ignore previous instructions" 变体 | HIGH | Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
| SSH authorized_keys | 写入 `~/.ssh/authorized_keys` | CRITICAL | T1098.004 | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| curl/wget 携带凭证 | `curl.*[?&](token\|key\|password\|secret)=` | CRITICAL | T1041 | Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| Node.js 反弹 | `node.*child_process.*net.Socket` | CRITICAL | T1059.007 | How it starts
The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenClaw 攻击模式检测器
基于《OpenClaw 极简安全实践指南》红线规则和 MITRE ATT&CK 框架，对命令、文件、网络流量进行实时和离线威胁检测。覆盖 AI Agent 场景下特有的攻击面——不仅检测传统 shell 攻击，还识别通过 Prompt 注入触发的间接恶意行为。
Purpose
OpenClaw Agent 具有命令执行、文件读写、网络请求等能力。当 Agent 被恶意 Prompt 注入或加载了被投毒的 Skill 时，可能执行数据外传、反弹 Shell、凭证窃取等高危操作。本技能提供多层检测能力，覆盖从命令级到行为链级的威胁识别。
Prerequisites
Authorization Requirements
- OpenClaw 实例的日志访问权限
- 命令历史和文件系统读取权限
- 网络流量监控权限（如需实时检测）
Environment Setup
- 目标 OpenClaw 实例运行中或有历史日志可供分析
- 检测规则库已加载（内置于脚本中）
Core Workflow
- 命令级检测: 对单条命令进行实时模式匹配，识别已知恶意命令模式。
- 文件级扫描: 扫描 Skill 文件、脚本文件，检测嵌入的恶意代码和混淆载荷。
- 行为链分析: 关联多条命令的上下文，识别多步攻击链（如先侦察再外传）。
- 网络流量检测: 分析出站连接目标，检测数据外传和 C2 通信模式。
- Prompt 注入检测: 识别通过 Prompt 注入间接触发的恶意操作指令。
- 告警与响应: 按严重程度分级告警，提供阻断建议和取证信息。
检测的攻击模式
1. 数据外传 (Data Exfiltration)
| 模式 | 检测规则 | 严重程度 | MITRE ATT&CK |
|---|---|---|---|
| curl/wget 携带凭证 | curl.*[?&](token|key|password|secret)= |
CRITICAL | T1041 |
| POST 外传敏感数据 | curl -X POST.*(-d|--data).* + 敏感关键词 |
CRITICAL | T1041 |
| DNS 隧道外传 | dig|nslookup|host + base64 编码子域 |
HIGH | T1048.003 |
| 环境变量泄露 | env|printenv|echo \$.*KEY + 网络命令 |
CRITICAL | T1552.001 |
| 编码后外传 | base64|xxd|od 管道到网络命令 |
HIGH | T1132.001 |
| 剪贴板窃取 | xclip|xsel|pbpaste + 网络命令 |
HIGH | T1115 |
2. 反弹 Shell (Reverse Shell)
| 模式 | 检测规则 | 严重程度 | MITRE ATT&CK |
|---|---|---|---|
| Bash 反弹 | bash -i >& /dev/tcp/ |
CRITICAL | T1059.004 |
| Python 反弹 | python.*socket.*connect.*exec |
CRITICAL | T1059.006 |
| Netcat 反弹 | nc|ncat.*-e|exec |
CRITICAL | T1059 |
| Perl 反弹 | perl.*socket.*INET.*exec |
CRITICAL | T1059 |
| PHP 反弹 | php.*fsockopen.*exec |
CRITICAL | T1059 |
| Socat 反弹 | socat.*TCP:.*EXEC: |
CRITICAL | T1059 |
| Node.js 反弹 | node.*child_process.*net.Socket |
CRITICAL | T1059.007 |
| Mkfifo 管道 | mkfifo.*/tmp/.*nc |
CRITICAL | T1059 |
3. 文件泄露 (File Exfiltration)
| 模式 | 检测规则 | 严重程度 | MITRE ATT&CK |
|---|---|---|---|
| SSH 密钥外传 | scp|rsync.*~/.ssh/ |
CRITICAL | T1552.004 |
| OpenClaw 配置外传 | 任何工具读取 ~/.openclaw/ 后接网络命令 |
CRITICAL | T1005 |
| 文件打包上传 | tar|zip.* + curl|wget 上传 |
HIGH | T1560.001 |
| 历史记录外传 | 读取 .bash_history, .zsh_history |
HIGH | T1552.003 |
| 数据库文件访问 | 读取 *.sqlite, *.db, *.sql |
MEDIUM | T1005 |
| 凭证文件读取 | 读取 .env, .npmrc, .pypirc, .netrc |
HIGH | T1552.001 |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 170 lines · 53 tokens per session scan D 045afc205223
openclaw-threat-detect is a skill published in the GitHub repository jd-opensource/JoySafeter (306 stars, last pushed 4d ago), licensed Apache-2.0. It adds 53 tokens to every session and 2,378 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 4 findings (instruction-override phrasing, reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-authoring
Author SKILL.md skills: frontmatter, validator limits, structure.
swarmclaw
AI agent runtime and multi-agent orchestration platform. Teaches agents how to use SwarmClaw's 6 primitive tools, persistent memory, dreaming, delegation, connectors, credentials, and the skill system. Use when an agent is running on SwarmClaw and needs to understand the platform's capabilities.
officecli-word-form
Use this skill to create fillable Word forms (.docx) with real Content Controls (SDT) + legacy FormField checkboxes + MERGEFIELD mail-merge placeholders + document protection. Trigger on: 'fillable form', 'form fields', 'content controls', 'SDT', 'word form', 'fill in', 'only editable fields', 'protect document'…
officecli-data-dashboard
Use this skill to build a multi-element Excel dashboard — Dashboard sheet on open, multiple formula-driven KPI cards, multiple charts, sparklines, and conditional formatting — from CSV or tabular input. Trigger on: 'dashboard', 'KPI dashboard', 'analytics dashboard', 'executive dashboard', 'metrics dashboard', 'CSV to…
xhs_note
A workflow for creating a Xiaohongshu post, a Chinese image-first social-media note, with short copy, hashtags, and at least three matching vertical images.
dingtalk_channel_connect
A browser-based setup guide for connecting a MateClaw assistant to DingTalk, a Chinese workplace messaging platform. It creates and configures a DingTalk application, then publishes the configuration.