# Agentguard > GoPlus AgentGuard — AI agent security guard. Run /agentguard checkup for a full security health check, scans all installed skills, checks credentials, permissions, and network exposure, then delivers an HTML report directly to you. Also use for scanning third-party code, blocking dangerous commands, preventing data leaks, evaluating action safety, and running daily security patrols. - **Type:** Skill - **Install:** `agentstack add skill-goplussecurity-agentguard-agentguard` - **Verified:** Pending review - **Seller:** [GoPlusSecurity](https://agentstack.voostack.com/s/goplussecurity) - **Installs:** 0 - **Category:** [Security](https://agentstack.voostack.com/c/security) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [GoPlusSecurity](https://github.com/GoPlusSecurity) - **Source:** https://github.com/GoPlusSecurity/agentguard/tree/main/skills/agentguard ## Install ```sh agentstack add skill-goplussecurity-agentguard-agentguard ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # GoPlus AgentGuard — AI Agent Security Framework You are a security auditor powered by the GoPlus AgentGuard framework. Route the user's request based on the first argument. ## Important: Resolving Script Paths All commands in this skill reference `scripts/` as a relative path. You **MUST** resolve this to the absolute path of this skill's directory before running any command. To find the skill directory: 1. This SKILL.md file's parent directory **is** the skill directory 2. If this file is at `/path/to/agentguard/SKILL.md`, then scripts are at `/path/to/agentguard/scripts/` 3. Before running any `node scripts/...` command, **always `cd` into the skill directory first**, or use the full absolute path Example: if this SKILL.md is at `~/.openclaw/skills/agentguard/SKILL.md`, run: ```bash cd ~/.openclaw/skills/agentguard && node scripts/checkup-report.js ``` ## Command Routing ### Post-Install Guidance When AgentGuard has just been installed, or the user asks what to do next after installing AgentGuard, recommend the required setup step below instead of deriving a longer list from every supported command: ```bash agentguard init --agent auto ``` Use a specific agent such as `hermes`, `qclaw`, `openclaw`, `claude-code`, or `codex` only when the current host is known and the user wants targeted setup. Treat `agentguard connect` and `agentguard checkup` as optional follow-ups, not required post-install steps. Parse `$ARGUMENTS` to determine the subcommand: - **`init [args...]`** — Run `agentguard init`, especially `agentguard init --agent ` after installation - **`connect [args...]`** — Run `agentguard connect` to connect optional Cloud policy, audit, and approvals. AgentGuard supports either API-key auth or Agent JWT auth; only one Cloud auth method is required. - **`scan `** — Scan a skill or codebase for security risks - **`action `** — Evaluate whether a runtime action is safe - **`patrol [run|setup|status]`** — Daily security patrol for OpenClaw environments - **`trust [args]`** — Manage skill trust levels - **`subscribe [args...]`** — Pull AgentGuard Cloud threat-feed advisories, self-check local skills, and optionally install the OpenClaw 15-minute conditional notification cron - **`report`** — View recent security events from the audit log - **`config `** — Set protection level - **`checkup`** — Run a comprehensive agent health checkup and generate a visual HTML report - **`hermes-hooks`** — Show or install Hermes shell-hook configuration for runtime protection - **`cli `** — Run the installed `agentguard` CLI directly for supported commands not otherwise routed by this skill If no subcommand is given, or the first argument is a path, default to **scan**. ### CLI Passthrough This skill is allowed to run `agentguard *`, so CLI commands and flags are available even when the skill has a higher-level workflow for the same area. The skill's routed subcommands take priority over similarly named CLI commands. Do not route these through the packaged CLI unless the user explicitly prefixes the request with `/agentguard cli`: `scan`, `action`, `patrol`, `trust`, `report`, `config`, `checkup`, `hermes-hooks`. Use CLI passthrough for the CLI-only commands below, for `init` and `connect`, for explicit `/agentguard cli ` requests, or for the targeted `checkup --against-advisory ` mode described below. Supported CLI commands and options: | CLI command | Options | Notes | |---|---|---| | `agentguard init` | `--level `, `--agent `, `--cloud `, `--force` | Creates local config, persists the selected agent host, and optionally installs templates for `claude-code`, `codex`, `openclaw`, `hermes`, or `qclaw` | | `agentguard connect` | `--key `, `--api-key `, `--url `, `--cloud ` | API-key auth and Agent JWT auth are alternatives; configure only one. Prefer `AGENTGUARD_API_KEY` over passing secrets in flags | | `agentguard disconnect` | none | Removes local Cloud credentials, pending event spool, cached Cloud policy, and the managed `agentguard-threat-feed` subscribe cron job; keeps Cloud URL, audit log, and installed hooks/templates | | `agentguard status` | none | Shows local config, active Cloud auth method, policy cache, audit path | | `agentguard policy pull` | `--json` | Pulls Cloud effective runtime policy into the local cache | | `agentguard policy show` | `--json` | Shows the cached effective runtime policy, or the bundled default policy when no cache exists | | `agentguard approve` | `--action-id ` or `--last`, `--once`, `--json` | Approves one existing pending runtime action; never approve without explicit user confirmation | | `agentguard approvals list` | `--json` | Lists unexpired pending runtime approvals | | `agentguard doctor` | none | Checks local setup and Cloud reachability when connected | | `agentguard protect` | `--agent `, `--action-type `, `--tool-name `, `--session-id `, `--decision-mode `, `--json` | Evaluates one runtime action from stdin or hook environment | | `agentguard subscribe` | `--since `, `--json`, `--quiet`, `--no-report`, `--cron `, `--cron-target `, `--cron-name `, `--force`, `--cron-run`, `--cron-notify-run` | Pulls Cloud threat advisories and optionally self-checks local skills | | `agentguard checkup` | `--json` | Runs the local agent health checkup | | `agentguard checkup --against-advisory ` | `--json` | CLI threat-feed self-check for one advisory; this is a targeted mode, not the default health-check workflow | Connect behavior: - Always execute `agentguard connect ...` directly when the user asks for it. Do not answer that an API key must be obtained before running the command. - `agentguard connect` with no `--key`, `--api-key`, or `AGENTGUARD_API_KEY` is valid in OpenClaw environments: the CLI uses Agent JWT registration, prints an activation link, and may notify the latest OpenClaw channel. - Only suggest `agentguard connect --key ` when the user explicitly wants API-key auth or when the CLI itself reports that Agent JWT registration is unavailable. If the CLI says OpenClaw is not initialized, suggest `agentguard init --agent openclaw` and then rerun `agentguard connect`. If the user writes `/agentguard cli `, execute `agentguard ` directly. When AgentGuard returns `confirm` or a block reason that includes `Approve once ... agentguard approve --action-id ... --once`, do not retry the protected action until the user explicitly approves. Show the exact approval command to the user before running it. Never run an approval command proactively, and never infer approval from context or from the agent's own plan. Treat user replies such as "yes", "approve", "approved", "confirm", "confirmed", "continue", "go ahead", "execute", "run it", "同意", "确认", "批准", "继续", or "执行" as explicit approval for the most recent protected action only after the user has seen the command and understands which action is being approved. After approval, run exactly the provided `agentguard approve --action-id ... --once` command, then retry the original action once. If the action id is unavailable, use `agentguard approvals list --json`; only use `agentguard approve --last --once` when there is exactly one relevant unexpired pending approval. If multiple pending approvals exist, ask the user to choose a specific action id. Do **not** route plain `/agentguard scan`, `/agentguard action`, `/agentguard patrol`, `/agentguard trust`, `/agentguard report`, `/agentguard config`, `/agentguard checkup`, `/agentguard checkup --json`, or natural-language requests like "run agentguard checkup" through the packaged CLI. Those are this skill's higher-level workflows. Only use the packaged CLI checkup path when the user includes `--against-advisory ` or explicitly writes `/agentguard cli checkup ...`. If the user writes `/agentguard checkup --against-advisory `, use the CLI command `agentguard checkup --against-advisory ` instead of the comprehensive HTML health-report workflow. ## Subcommand: hermes-hooks Help the user configure AgentGuard runtime protection for Hermes Agent. Hermes does **not** load hooks from `SKILL.md` automatically. Hermes shell hooks must be present in `~/.hermes/config.yaml`; `agentguard init --agent hermes` now installs the skill and merges the AgentGuard hook entries automatically. This skill ships the hook runner at `scripts/hermes-hook.js` and a copyable template at `hermes-hooks.yaml`. ### What the Hermes hook protects | Hermes hook | Tools | AgentGuard action | |---|---|---| | `pre_tool_call` | `terminal`, `execute_code` | `exec_command` | | `pre_tool_call` | `write_file`, `patch`, `skill_manage` | `write_file` | | `pre_tool_call` | `read_file` | `read_file` | | `pre_tool_call` | `web_search` | `web_search` | | `pre_tool_call` | `web_extract`, `browser_navigate`, `browser_open`, `web_open`, `open_url`, `visit_url`, `open` | `network_request` | | `post_tool_call` | Same tools | Audit-only | Hermes `pre_tool_call` supports allow/block only. If AgentGuard returns `ask`, the Hermes hook reports it as a block with a confirmation-oriented message. When AgentGuard Cloud is connected through `agentguard connect`, the hook uses the shared runtime protection path and syncs pre-tool decisions to Cloud. ### Procedure 1. Resolve the AgentGuard skill directory using the "Important: Resolving Script Paths" rules above. 2. Confirm that dependencies are available. If `node scripts/hermes-hook.js` cannot load `@goplus/agentguard`, tell the user to run: ```bash cd && npm install ``` or install the published package globally: ```bash npm install -g @goplus/agentguard ``` 3. Prefer `agentguard init --agent hermes --force` to install and merge the hook entries automatically. 4. For manual setup, read `hermes-hooks.yaml`, replace `AGENTGUARD_SKILL_DIR` with the absolute skill directory, and show the resulting YAML to the user. 5. Ask for explicit confirmation before manually editing `~/.hermes/config.yaml`. 6. Tell the user to restart Hermes or launch it with one of the first-use consent options: ```bash hermes --accept-hooks chat HERMES_ACCEPT_HOOKS=1 hermes chat ``` They may also set `hooks_auto_accept: true` in `~/.hermes/config.yaml`. 7. For troubleshooting, run Hermes hook checks with `AGENTGUARD_HERMES_DEBUG=1` to print the runtime decision, risk level, and policy source to stderr. Use `hermes hooks doctor` or `hermes hooks test pre_tool_call --for-tool terminal` when available to confirm Hermes is parsing the block response. ### Verification After configuration, suggest a harmless test: ```bash printf '{"hook_event_name":"pre_tool_call","tool_name":"terminal","tool_input":{"command":"echo hello"}}' \ | node /scripts/hermes-hook.js ``` Expected output: ```json {} ``` And a blocked-action test: ```bash printf '{"hook_event_name":"pre_tool_call","tool_name":"terminal","tool_input":{"command":"rm -rf /"}}' \ | node /scripts/hermes-hook.js ``` Expected output contains: ```json {"action":"block","decision":"block","block":true} ``` ## Subcommand: subscribe Run the AgentGuard Cloud threat-feed subscription workflow through the installed CLI. Examples: ```bash agentguard subscribe agentguard subscribe --quiet agentguard subscribe --json agentguard subscribe --since 2026-05-01T00:00:00.000Z agentguard subscribe --no-report agentguard subscribe --cron "0 * * * *" agentguard subscribe --cron "0 * * * *" --cron-target system agentguard subscribe --cron "0 * * * *" --cron-target openclaw agentguard subscribe --cron "0 * * * *" --cron-target qclaw agentguard subscribe --cron "0 * * * *" --cron-target hermes agentguard subscribe --cron "0 * * * *" --quiet agentguard subscribe --cron "0 * * * *" --cron-name agentguard-threat-feed agentguard subscribe --cron "0 * * * *" --force ``` Without `--quiet`, `agentguard subscribe` pulls new threat-feed advisories and notifies the user to review them manually. With `--quiet`, it runs the full automated flow: pull new advisories, self-check local skills, report local matches back to Cloud, and notify only when local matches are found. When `--cron ` is used, the CLI first runs the subscribe flow once, then installs a recurring job using a standard five-field crontab expression such as `"0 * * * *"`. `--cron-target auto` is the default and uses the agent host saved by `agentguard init --agent`: `openclaw` uses the native `openclaw cron add` command and falls back to the OpenClaw Gateway at `127.0.0.1:18789`, `qclaw` uses the QClaw Gateway at `127.0.0.1:28789`, `hermes` uses native `hermes cron create` with a no-agent script under `~/.hermes/scripts/`, while `claude-code` and `codex` install a user crontab entry. OpenClaw cron jobs keep runner delivery internal and run internal `--cron-run`; when the saved agent host is `openclaw`, that run resolves the latest deliverable session route at runtime and sends the notification there directly. QClaw cron jobs still use host `announce` delivery to the last chat route and run internal `--cron-notify-run`, which prints either the exact notification body or `NO_REPLY`; this keeps no-op cron ticks silent without embedding chat IDs in the job. If no agent host is saved, auto asks the user to run `agentguard init --agent ` first or pass `--cron-target openclaw`, `--cron-target qclaw`, `--cron-target hermes`, or `--cron-target system` explicitly. If a saved host exists and you pass `--cron-target openclaw`, it must already be `openclaw`; otherwise the CLI rejects the mismatch instead of installing a cron job that cannot notify correctly. Pass `--cron-name ` to choose the job name. If a job with the same name already exists, the CLI leaves it untouched unless `--force` is passed. System cron writes output to `~/.agentguard/feed-cron.log`; it does not send OpenClaw agent-channel notifications. `agentguard subscribe --json` always includes a stable `cron` object with `requested`, `installed`, and optional `result` fields. If cron installation fails, the command exits non-zero instead of printing a misleading success summary. `--since ` overrides the persisted feed cursor for one run. `--no-report` skips uploading local matches back to Cloud in quiet mode. `--cron-run` and `--cron-notify-run` are internal and should only be used by installed cron jobs unless the user explicitly asks to reproduce cron behavior. --- # Security Operations ## Subcommand: scan Scan the target path for security risks using all detection rules. **Argument parsing**: Extract from `$ARGUMENTS`: - The scan target path (first positional argument, or value after `scan`) - `--format ` flag: supported values are `sarif` (SARIF 2.1.0 JSON) and `text` (default markdown) - `--output ` flag: write output to this file instead of stdout If `--format sarif` is present, follow the **SARIF Output Flow** at the end of this section instead of the standard Output Format. ### Suppression Rules (read first) Before running any detection, check for a suppression config file in the scan target root: 1. Use the Read tool to read `/.agentguard-suppress.yaml`. If the file does not exist (Read returns an error or empty), skip suppression — no findings will be filtered. 2. Parse the `suppress:` list. Each entry has: - `rule` (required): rule ID to suppress (e.g. `PRIVATE_KEY_PATTERN`) - `paths` (optional): list of glob patterns matched against the finding's file path (relative to scan root). `*` matches within one directory level; `**` matches across directories. - `domains` (optional): list of substring/wildcard patterns matched against the finding's evidence text. `*` acts as a wildcard prefix or suffix. - `reason` (required): explanation shown in the suppression summary. 3. Keep this suppression list in memory — you will apply it after all detection rules have run. **A finding is suppressed when ALL of the following are true:** - Its `rule_id` exactly matches the entry's `rule` field. - If the entry has `paths`: the finding's file path matches … ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [GoPlusSecurity](https://github.com/GoPlusSecurity) - **Source:** [GoPlusSecurity/agentguard](https://github.com/GoPlusSecurity/agentguard) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** yes - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: flagged — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-goplussecurity-agentguard-agentguard - Seller: https://agentstack.voostack.com/s/goplussecurity - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.