A new open-source gateway called ClawSentry tries to stop malicious skills from hijacking AI coding agents before they can do damage.
ClawSentry sits in front of agent runtimes like Codex, Claude Code, Kimi CLI, and Gemini CLI without needing changes to those tools themselves. It vets skill packages before first use, then screens actions in real time through a cheap deterministic filter and a rule-based semantic check, escalating only genuinely ambiguous cases to a slower, read-only review agent. It also tracks attackers who get blocked once and then retry through a different tool or reworded prompt later in the same session. Across five agents on the broader SkillsSafety benchmark, this cut attack success rates from an unprotected 33.5-49.7% down to 9.09-15.03%, while legitimate tasks still completed successfully 98.7% of the time. A narrower test against SkillInject attacks on Codex/GPT-5.4 pushed attack success down further, to 2.61% from 39.55%, but that figure applies to one specific attack-and-model pairing, not the broader results.
Most agent guardrails check a single moment, like permissions at install or filtering on one prompt, and miss attacks that wait a turn or swap tools. Spending review effort only on ambiguous cases, while nearly always letting clean tasks through untouched, is the more interesting design choice here. Single-digit-to-low-teens attack success on the wider benchmark is real progress, but it is confinement, not elimination.
Whether the gap between the eye-catching sub-3% number and the broader 9-15% range closes under more adversarial testing will decide if this becomes standard agent middleware or another benchmark-flattering paper with a GitHub repo attached.