Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Zuga-Technologies/ZugaShieldnpx agentmods add skills/zuga-technologies/zugashield/openclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zuga-technologies/zugashield/openclaw)<a href="https://agentmods.dev/skills/zuga-technologies/zugashield/openclaw"><img src="https://agentmods.dev/badge/skills/zuga-technologies/zugashield/openclaw/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zuga-technologies/zugashield/openclaw"><img src="https://agentmods.dev/badge/skills/zuga-technologies/zugashield/openclaw.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.00659 |
| Opus 5.5 | $0.00024 | $0.00264 |
| Sonnet 5.5 | $0.00012 | $0.00132 |
| Haiku 4.5 | $0.00006 | $0.00066 |
Grade A, and why
zugashield scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ZugaShield Security Scanner
7-layer AI security scanning plugin for OpenClaw. Protects all channels simultaneously by hooking into the Gateway — the single chokepoint for all traffic.
What It Blocks
| Attack | Hook | Detection |
|---|---|---|
| Prompt injection | preRequest | 150+ signatures, TF-IDF ML (88.7% recall), unicode smuggling, encoding evasion |
| SSRF / Command injection | preToolExecution | Cloud metadata URLs, shell metacharacters (always fail-closed) |
| Secret / PII leakage | preResponse | API keys, tokens, credentials, high-entropy strings |
| Memory poisoning | preRecall | Embedded instructions, sleeper payloads in recalled memories |
| DNS exfiltration | preResponse | High-entropy subdomains, data-in-DNS patterns |
| Path traversal | preToolExecution | Directory traversal sequences, symlink attacks |
| Supply chain attacks | startup | SHA-256 model verification, canary validation, version pinning |
Install
pip install "zugashield[mcp]"
npm install zugashield-openclaw-plugin
openclaw plugins install ./node_modules/zugashield-openclaw-plugin
openclaw restart
Verify
/shield status
Should show: CONNECTED with 7 active layers.
Configuration
In openclaw.json under plugins.entries.openclaw-plugin.config:
fail_closed(default: true) — Block requests when scanner is downstrict_mode(default: false) — Block medium+ threats (not just high/critical)scan.inputs/scan.outputs/scan.tool_calls/scan.memory— Toggle individual hooks
How It Works
ZugaShield spawns a Python MCP server as a managed child process. Each message, tool call, and response passes through the scanner in <15ms. The plugin uses OpenClaw's Gateway hooks, meaning one install protects Signal + Telegram + Discord + WhatsApp + web simultaneously.
Tool calls are always fail-closed regardless of configuration — SSRF and command injection are too dangerous to allow through even temporarily.
Links
What ships with it
23 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .github/workflows/ci.yml 974 B
- .gitignore 53 B
- .npmrc 14 B
- LICENSE 1.0 KB
- openclaw.plugin.json 2.2 KB
- package-lock.json 90 KB
- package.json 1.3 KB
- README.md 3.9 KB
- src/commands/report.ts 1.7 KB runs code
- src/commands/status.ts 2.6 KB runs code
- src/config.ts 2.5 KB runs code
- src/errors.ts 1012 B runs code
- src/hooks/pre-recall.ts 1.9 KB runs code
- src/hooks/pre-request.ts 1.7 KB runs code
- src/hooks/pre-response.ts 1.8 KB runs code
- src/hooks/pre-tool-exec.ts 2.0 KB runs code
- src/index.ts 5.7 KB runs code
- src/preflight.ts 2.6 KB runs code
- src/shield-client.ts 9.6 KB runs code
- test/hooks.test.ts 11 KB runs code
- test/integration.test.ts 20 KB runs code
- tsconfig.json 509 B
- vitest.config.ts 132 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 71 lines · 61 tokens per session scan A 6fe838782629
zugashield is a skill published in the GitHub repository Zuga-Technologies/ZugaShield (1 stars, last pushed yesterday), licensed MIT. It adds 61 tokens to every session and 659 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
panguard
AI agent security platform — audit skills, scan for threats, and run 24/7 protection with 9,700+ detection rules.
prompt-injection-auditor
Security audit of LLM system prompts, agent instruction files (SKILL.md, AGENTS.md, CLAUDE.md), and agent configurations against prompt injection attacks. Use when the user wants to (1) audit or harden a system prompt or agent instructions against prompt injection, (2) review an agent skill or system prompt for…
clawmoat
Real-time AI agent security scanner. Detects prompt injection, jailbreak attempts, credential/secret leaks, PII exposure, and dangerous tool calls. Activate when: (1) scanning inbound messages or tool outputs for prompt injection, (2) checking outbound content for credential leaks or PII, (3) auditing agent session…
panguard-skill-auditor
Automated security auditor for AI agent skills. Scans SKILL.md files for prompt injection, tool poisoning, hidden Unicode, encoded payloads, secrets, and dangerous permissions. Returns a 0-100 risk score.
integrate-arcjet-guard-mastra
Integrate Arcjet security into a Mastra agent using @arcjet/guard — wrap createTool execute, screen input/output with a Processor tripwire, and gate unwrapped MCP/workspace tools with hooks. Use when asked to add Arcjet to a Mastra agent, rate limit its tools, screen inbound messages, or block prompt injection / PII.
integrate-arcjet-guard-google-adk
Integrate Arcjet security into a Google ADK JS app using @arcjet/guard — put guardPlugin first on Runner({ plugins }) so beforeToolCallback gates tools, and read a caller-owned id from helper options or context. Use when asked to add Arcjet to Google ADK, @google/adk, rate limit its tools, screen inbound messages, or…