clawhub-quarantine-installer

What This Skill Does

The clawhub-quarantine-installer is an essential security-focused tool for OpenClaw developers who integrate third-party skills. It provides a secure, sandboxed environment to isolate and audit potentially risky or suspicious skills fetched from the ClawHub registry. By utilizing an automated workflow, this tool installs skills into a protected directory, triggers a static security analysis using ripgrep to identify dangerous patterns, and generates comprehensive audit logs. This allows developers to inspect code, dependency structures, and potential network access patterns before committing a skill to their production workspace.

Installation

To install this utility, use the following OpenClaw command: clawhub install openclaw/skills/skills/alessandropcostabr/clawhub-quarantine-installer Ensure that you are running this skill in a non-production environment, such as a dedicated VM or container, as it is designed to handle potentially malicious code that bypasses standard installation warnings.

Use Cases

• Security Vetting: Safely analyze skills that have been flagged as 'suspicious' by ClawHub before allowing them into your active toolset.
• Dependency Auditing: Examine deep-level dependencies for known vulnerabilities before execution.
• Threat Hunting: Identify hardcoded secrets, unauthorized network requests, or dangerous system commands within a skill's source code.
• Development Workflow: Establish a secure 'pre-flight' checklist for all external contributions to your OpenClaw ecosystem.

Example Prompts

• 'OpenClaw, please install the skill [skill-name] into the quarantine environment and provide the audit report.'
• 'Can you run the quarantine audit on the newly installed skill in the sandbox and highlight any identified network requests?'
• 'I want to audit the code of the skill [skill-name] located in the quarantine folder; please list all shell execution commands found in the source.'

Tips & Limitations

• Isolation is Mandatory: This tool downloads and executes code. Never run this on a host machine containing sensitive private keys, personal documents, or production credentials.
• Manual Review: While the automated audit is helpful, it is a surface-level scan. Always manually review the generated report and the source code of any skill before promoting it to ~/.openclaw/workspace/skills/.
• False Positives: The audit script uses pattern matching; some legitimate commands might be flagged as risky. Use common sense during your evaluation.