Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zuga-technologies/zugashield/openclawnpx skills add Zuga-Technologies/ZugaShield --skill openclawgit clone --depth 1 https://github.com/Zuga-Technologies/ZugaShieldWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zuga-technologies/zugashield/openclaw)<a href="https://agentmods.dev/skills/zuga-technologies/zugashield/openclaw"><img src="https://agentmods.dev/badge/skills/zuga-technologies/zugashield/openclaw.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00061 | $0.00659 |
| Opus 5 | $0.00030 | $0.00329 |
| Sonnet 5 | $0.00012 | $0.00132 |
| Haiku 4.5 | $0.00006 | $0.00066 |
Grade A, and why
zugashield scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ZugaShield Security Scanner
7-layer AI security scanning plugin for OpenClaw. Protects all channels simultaneously by hooking into the Gateway — the single chokepoint for all traffic.
What It Blocks
| Attack | Hook | Detection |
|---|---|---|
| Prompt injection | preRequest | 150+ signatures, TF-IDF ML (88.7% recall), unicode smuggling, encoding evasion |
| SSRF / Command injection | preToolExecution | Cloud metadata URLs, shell metacharacters (always fail-closed) |
| Secret / PII leakage | preResponse | API keys, tokens, credentials, high-entropy strings |
| Memory poisoning | preRecall | Embedded instructions, sleeper payloads in recalled memories |
| DNS exfiltration | preResponse | High-entropy subdomains, data-in-DNS patterns |
| Path traversal | preToolExecution | Directory traversal sequences, symlink attacks |
| Supply chain attacks | startup | SHA-256 model verification, canary validation, version pinning |
Install
pip install "zugashield[mcp]"
npm install zugashield-openclaw-plugin
openclaw plugins install ./node_modules/zugashield-openclaw-plugin
openclaw restart
Verify
/shield status
Should show: CONNECTED with 7 active layers.
Configuration
In openclaw.json under plugins.entries.openclaw-plugin.config:
fail_closed(default: true) — Block requests when scanner is downstrict_mode(default: false) — Block medium+ threats (not just high/critical)scan.inputs/scan.outputs/scan.tool_calls/scan.memory— Toggle individual hooks
How It Works
ZugaShield spawns a Python MCP server as a managed child process. Each message, tool call, and response passes through the scanner in <15ms. The plugin uses OpenClaw's Gateway hooks, meaning one install protects Signal + Telegram + Discord + WhatsApp + web simultaneously.
Tool calls are always fail-closed regardless of configuration — SSRF and command injection are too dangerous to allow through even temporarily.
Links
What ships with it
23 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .github/workflows/ci.yml 974 B
- .gitignore 53 B
- .npmrc 14 B
- LICENSE 1.0 KB
- openclaw.plugin.json 2.2 KB
- package-lock.json 90 KB
- package.json 1.3 KB
- README.md 3.9 KB
- src/commands/report.ts 1.7 KB runs code
- src/commands/status.ts 2.6 KB runs code
- src/config.ts 2.5 KB runs code
- src/errors.ts 1012 B runs code
- src/hooks/pre-recall.ts 1.9 KB runs code
- src/hooks/pre-request.ts 1.7 KB runs code
- src/hooks/pre-response.ts 1.8 KB runs code
- src/hooks/pre-tool-exec.ts 2.0 KB runs code
- src/index.ts 5.7 KB runs code
- src/preflight.ts 2.6 KB runs code
- src/shield-client.ts 9.6 KB runs code
- test/hooks.test.ts 11 KB runs code
- test/integration.test.ts 20 KB runs code
- tsconfig.json 509 B
- vitest.config.ts 132 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 71 lines · 61 tokens per session scan A 6fe838782629
zugashield is a skill published in the GitHub repository Zuga-Technologies/ZugaShield (1 stars, last pushed 23d ago), licensed MIT. It adds 61 tokens to every session and 659 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
panguard
AI agent security platform — audit skills, scan for threats, and run 24/7 protection with 9,700+ detection rules.
add-a-rule
Add security coverage to Guardana the way this repository requires — as a rule, evaluator or target, never by patching the engine — with the fixtures, the framework mapping and the documentation that make it shippable. Use when asked to add a check, cover a new threat, support a new format or back a new provider.
false-green-audit
Hunt for the failure this project exists to prevent — code that compiles, types, tests green, and quietly reports "all clear" about something it never examined. Use when reviewing a release, auditing a subsystem, or before tagging.
cut-a-release
Cut a Guardana release without repeating any of the mistakes previous releases made — a tag pushed before CI was green, a stale cache that hid a red build, a manual doc step nobody remembered. Use when asked to release, tag, publish or bump a version.
clawmoat
Real-time AI agent security scanner. Detects prompt injection, jailbreak attempts, credential/secret leaks, PII exposure, and dangerous tool calls. Activate when: (1) scanning inbound messages or tool outputs for prompt injection, (2) checking outbound content for credential leaks or PII, (3) auditing agent session…
prompt-injection-auditor
Security audit of LLM system prompts, agent instruction files (SKILL.md, AGENTS.md, CLAUDE.md), and agent configurations against prompt injection attacks. Use when the user wants to (1) audit or harden a system prompt or agent instructions against prompt injection, (2) review an agent skill or system prompt for…