Your agent reads web pages, emails, and API responses. Any of those can contain hidden instructions it will follow.
One API call. Any LLM you already have. 98% detection on agent attacks. Zero false positives. Free.
Tested on InjecAgent (ACL 2024), NotInject (ACL 2025), WildGuard, and Deepset. All public datasets.
Every tool call is a potential injection point. Browsing a webpage, reading an email, calling an API — any of these can contain hidden instructions your agent will follow.
No account required during beta.
cp -r mlayer-guard ~/.openclaw/skills/mlayer-guard
export MLAYER_GUARD_URL="https://hidylan.ai/v1/injection-check" export OPENAI_API_KEY="your-key"
Restart your OpenClaw agent. The skill activates automatically.
Works with any agent framework. Just make an HTTP POST.
curl -X POST https://hidylan.ai/v1/injection-check \
-H "Content-Type: application/json" \
-H "X-API-Key: your-llm-api-key" \
-d '{
"system_prompt": "You are a helpful assistant.",
"retrieved_docs": [{
"doc_id": "tool_output",
"content": "content to check for injection",
"source": "web",
"trust_tier": "untrusted"
}]
}'
Returns {status: 'safe'} or {status: 'blocked'}. Add this check after any tool call that returns external content.
Supported providers:
500 checks/day. BYOK — uses your own LLM key. ~$0.001 per check. No credit card required.