How to Install PromptGuard on OpenClaw (Stop Prompt Injection in One Command)

PromptGuard is a free security skill that protects your OpenClaw agent from prompt injection, data exfiltration, and malicious skills. Install it with one command: clawhub install prompt-guard. It ships with 650+ detection patterns across 11 threat categories and works offline with no API required.

Published 2026-03-09. Updated 2026-09-14.

Your OpenClaw agent does whatever it's told. That's the whole point — it reads your emails, manages your calendar, runs your workflows.

But here's the problem: without protection, it can't tell the difference between your instructions and an attacker's.

A third-party security assessment found a 91.3% prompt injection success rate on unprotected OpenClaw instances. That means almost every agent without defenses will obey a hidden instruction buried in an email, a document, or a message.

PromptGuard fixes this in one command.

What is PromptGuard?

PromptGuard is a security skill for OpenClaw that scans every incoming message, tool output, and MCP response before your agent acts on it. If it detects an injection attempt, it blocks the message and alerts you.

It ships with 650+ curated detection patterns across 11 threat categories:

Detection works in 10 languages including English, Chinese, Korean, Japanese, Spanish, and German.

How to install it

One command:

clawhub install prompt-guard

That's it. The skill's SKILL.md is placed in your skills directory and automatically loaded by your agent.

To install a specific version:

clawhub install prompt-guard --version 3.6.0

If you don't have ClawHub installed globally, use npx:

npx clawhub@latest install prompt-guard

How to configure it

PromptGuard works out of the box with sensible defaults. But you can tune it in your skill configuration:

prompt_guard:
  sensitivity: medium        # low, medium, high, paranoid
  pattern_tier: high         # critical, high, full
  cache:
    enabled: true
    max_size: 1000
  actions:
    LOW: log
    MEDIUM: warn
    HIGH: block
    CRITICAL: block_notify

Sensitivity levels

• low — catches obvious attacks, minimal false positives. Good for testing.
• medium (default) — balanced. Blocks real attacks, lets normal conversation through.
• high — stricter matching. May flag some benign messages like "ignore the previous draft."
• paranoid — enables unicode homoglyph detection and context flooding analysis. Use this if you're processing untrusted external content.

Pattern tiers

• critical — fastest, loads only the most dangerous patterns. Good for high-volume agents.
• high (default) — loads critical + high-severity patterns. Best balance.
• full — loads all 650+ patterns. Maximum coverage, slightly higher token usage.

How it works under the hood

PromptGuard is designed to be fast and cheap to run:

1. Normalisation — incoming text is cleaned (whitespace, encoding, unicode tricks).
2. SHA-256 fingerprinting — a hash is computed for the normalised message.
3. LRU hash cache — repeated messages are caught instantly. This gives ~90% token reduction on repeat scans (common in automated workflows).
4. Tiered pattern loading — a quick critical-tier scan runs first. Only escalates to broader patterns if something looks suspicious. This cuts token usage by ~70% on first scans.
5. Action mapping — threats are categorised by severity and mapped to your configured actions (log, warn, block, or block and notify).

What else should I install alongside it?

PromptGuard is one layer. For proper defence-in-depth, combine it with:

Important: PromptGuard should be loaded early in your skill chain — before other skills process input. Think of it like a firewall: it needs to see traffic before anything else acts on it.

What happens without it?

The numbers are sobering:

• 91.3% prompt injection success rate on unprotected OpenClaw agents
• 84% success rate for prompt extraction attacks (stealing your system prompt)
• 36% of ClawHub skills contained prompt injection vulnerabilities (Snyk, Feb 2026)
• 1,467 malicious payloads found across ClawHub skills
• 135,000+ OpenClaw instances found publicly exposed on the internet

In January 2026, the ClawHavoc incident saw 341 malicious skills planted on ClawHub, compromising over 9,000 installations with info-stealing malware.

Your agent has access to your email, calendar, files, and messaging apps. If someone injects instructions into a document your agent processes, it could forward your emails, leak your API keys, or execute commands on your machine — all while looking like normal operation.

Is PromptGuard enough on its own?

No. It's a strong first layer, but:

• Novel attacks can bypass pattern-based detection. New techniques emerge regularly.
• False positives increase at higher sensitivity levels.
• Skill ordering matters. If another skill processes input before PromptGuard sees it, the security layer is bypassed.

The best setup is PromptGuard + ACIP + SkillGuard + human-in-the-loop approvals for sensitive operations (sending emails, accessing files, running commands).

Our full security checklist covers all 17 steps for a properly hardened OpenClaw installation.

Related reading

• AI Assistant Security Checklist — 17 Steps — the complete hardening guide
• OpenClaw vs Botpress vs DIY — Real Costs Compared — compare your options
• What Is OpenClaw? — the full explainer

Don't want to do this yourself?

Security configuration is where most people get it wrong. If you want PromptGuard, ACIP, SkillGuard, and the full 17-step hardening checklist applied to your OpenClaw installation — that's included in every setup.

Get a quote — your agent will be secured and running within a few days.