From 40f3d22d603d14bac64a6f5137d6de37ee79ce23 Mon Sep 17 00:00:00 2001 From: 0xJeff Date: Wed, 15 Apr 2026 14:02:06 +0800 Subject: [PATCH 1/3] fix: add Action Items section to checkup terminal summary with concrete fix commands (#25) After checkup, the terminal summary only showed a generic top recommendation with no actionable guidance. Users seeing HIGH/CRITICAL findings (especially "no security hooks installed") had no idea what to do next. Add an Action Items section to Step 5 that lists each HIGH/CRITICAL finding with an exact fix command, including the JSON snippet to add guard-hook.js to settings.json for Claude Code / OpenClaw / QClaw. Co-Authored-By: Claude Sonnet 4.6 --- skills/agentguard/SKILL.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/skills/agentguard/SKILL.md b/skills/agentguard/SKILL.md index 902ffc4..0c464b1 100644 --- a/skills/agentguard/SKILL.md +++ b/skills/agentguard/SKILL.md @@ -804,6 +804,30 @@ The script outputs the HTML file path to stdout (e.g. `/tmp/agentguard-checkup-1 **Full visual report**: (opened in browser) 💡 Top recommendation: + +### Action Items +(Only include this section if there are HIGH or CRITICAL findings. List each one with a concrete fix command.) + +For each HIGH or CRITICAL finding, output a numbered action item in this format: +``` +🔴 [CRITICAL] / 🟠 [HIGH] + → +``` + +Common fix commands to use when applicable: +- No security hooks installed → show the exact JSON snippet to add to `~/.claude/settings.json` (for Claude Code) or `~/.openclaw/openclaw.json` / `~/.qclaw/openclaw.json` (for OpenClaw/QClaw): + ```json + // Add to the "hooks" > "PreToolUse" array in settings.json: + { + "matcher": "Bash|Write|Edit|WebFetch|WebSearch", + "hooks": [{ "type": "command", "command": "node \"/scripts/guard-hook.js\"", "timeout": 10 }] + } + ``` + where `` is the absolute path to the installed agentguard skill directory. +- Skill not attested in trust registry → show the exact `node scripts/trust-cli.ts attest ...` command with the correct `--source` path +- `~/.ssh/` permissions too open → `chmod 700 ~/.ssh/` +- `~/.gnupg/` permissions too open → `chmod 700 ~/.gnupg/` +- Plaintext credential found → specify the exact file and line where it was found ``` ### Step 6: Deliver the Report to the User From f8f8f3d767b3f3a52e394929bf311feffea621f4 Mon Sep 17 00:00:00 2001 From: 0xJeff Date: Wed, 15 Apr 2026 14:21:20 +0800 Subject: [PATCH 2/3] fix: replace technical Action Items with plain-language Next Steps in checkup summary (#25) The previous Action Items section showed JSON snippets and CLI commands which are too technical for most users and not actionable without terminal access. Replace with a plain-language Next Steps section that describes each HIGH/CRITICAL issue in one sentence and asks the user to confirm which ones they want help with. Co-Authored-By: Claude Sonnet 4.6 --- skills/agentguard/SKILL.md | 42 +++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 23 deletions(-) diff --git a/skills/agentguard/SKILL.md b/skills/agentguard/SKILL.md index 0c464b1..c779889 100644 --- a/skills/agentguard/SKILL.md +++ b/skills/agentguard/SKILL.md @@ -805,30 +805,26 @@ The script outputs the HTML file path to stdout (e.g. `/tmp/agentguard-checkup-1 💡 Top recommendation: -### Action Items -(Only include this section if there are HIGH or CRITICAL findings. List each one with a concrete fix command.) - -For each HIGH or CRITICAL finding, output a numbered action item in this format: -``` -🔴 [CRITICAL] / 🟠 [HIGH] - → -``` - -Common fix commands to use when applicable: -- No security hooks installed → show the exact JSON snippet to add to `~/.claude/settings.json` (for Claude Code) or `~/.openclaw/openclaw.json` / `~/.qclaw/openclaw.json` (for OpenClaw/QClaw): - ```json - // Add to the "hooks" > "PreToolUse" array in settings.json: - { - "matcher": "Bash|Write|Edit|WebFetch|WebSearch", - "hooks": [{ "type": "command", "command": "node \"/scripts/guard-hook.js\"", "timeout": 10 }] - } - ``` - where `` is the absolute path to the installed agentguard skill directory. -- Skill not attested in trust registry → show the exact `node scripts/trust-cli.ts attest ...` command with the correct `--source` path -- `~/.ssh/` permissions too open → `chmod 700 ~/.ssh/` -- `~/.gnupg/` permissions too open → `chmod 700 ~/.gnupg/` -- Plaintext credential found → specify the exact file and line where it was found +### Next Steps +(Only include this section if there are HIGH or CRITICAL findings.) + +List each HIGH or CRITICAL finding as a plain-language suggestion — no commands, no JSON, no technical details. One sentence per item. Ask the user to confirm if they'd like help with any of them. + +Format: ``` +⚠️ A few things need your attention: +1. 🔴 +2. 🟠 +... + +Reply with the number(s) you'd like help with and I'll walk you through it. +``` + +Examples of plain-language descriptions: +- No hooks: "Security monitoring isn't active — AgentGuard can't block threats in real-time until hooks are configured." +- Unregistered skills: "10 installed skills haven't been security-reviewed — they're running with no trust level assigned." +- SSH permissions: "Your SSH key folder has loose permissions — other processes on this machine could potentially read your private keys." +- Plaintext credential: "A private key or API token was found in plain text in a file — it should be removed and rotated." ### Step 6: Deliver the Report to the User From 6f0403505daa2601312ad1b54f24e95cce72f0c3 Mon Sep 17 00:00:00 2001 From: 0xJeff Date: Wed, 15 Apr 2026 16:46:14 +0800 Subject: [PATCH 3/3] fix UI bug --- skills/agentguard/scripts/checkup-report.js | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/skills/agentguard/scripts/checkup-report.js b/skills/agentguard/scripts/checkup-report.js index da21b4a..04380e6 100644 --- a/skills/agentguard/scripts/checkup-report.js +++ b/skills/agentguard/scripts/checkup-report.js @@ -764,11 +764,10 @@ function generateReport(data) { const sc = sevColor(sev); const zhText = r.zh || r.text; return ` -
+
${i+1} ${sev} ${esc(r.text)} - chevron_right
`; }).join('')}
` : '
No recommendations.
'; @@ -776,12 +775,7 @@ function generateReport(data) { // ── AI Analysis report ── const analysisText = data.analysis || ''; const analysisHtml = analysisText - ? `
-
${esc(analysisText)}
- -
` + ? `
${esc(analysisText)}
` : ''; // ── Health status label ── @@ -936,6 +930,9 @@ body{background:#0a0e14;color:#dfe2eb;font-family:'Inter',sans-serif}

Security Analysis

analyticsDiagnostic Report +