delta-disclosure-auditor

What This Skill Does

The delta-disclosure-auditor is a critical utility for OpenClaw users who prioritize supply chain security and continuous monitoring. In the current ecosystem, skill updates often fail to communicate exactly what changed, creating a 'transparency gap' that forces users to choose between blind trust and the expensive, impractical process of re-executing full audits on every update. This auditor bridges that gap by enforcing machine-readable disclosures.

Version 1.1 significantly advances these capabilities. It now integrates risk-class binding, ensuring that changes are scrutinized based on the skill’s potential impact (e.g., a credential handler is held to higher standards than a simple UI formatter). It introduces chain-of-custody verification, using cryptographic hashes to ensure that every update history is immutable and verifiable. Finally, it implements update eligibility assessment, effectively turning transparency into a requirement for automated updates. By auditing capability declarations, dependency changes, and behavioral scopes, this skill ensures you aren't just notified that a skill changed, but exactly how its risk profile evolved.

Installation

To add the delta-disclosure-auditor to your agent environment, run the following command in your terminal:

clawhub install openclaw/skills/skills/andyxinweiminicloud/delta-disclosure-auditor

Once installed, the auditor automatically hooks into your package management lifecycle to intercept and validate update metadata.

Use Cases

• Continuous Security Monitoring: Automatically audit third-party skills to detect unauthorized changes in outbound network endpoints or file access permissions before auto-updating.
• Enterprise Compliance: Ensure all installed skills meet specific organizational risk-class binding requirements.
• Supply Chain Integrity: Verify the chain-of-custody for critical infrastructure skills, ensuring that every version transition is cryptographically linked to the previous authorized state.

Example Prompts

1. "Audit the latest update for the 'file-transfer-pro' skill and report any undocumented changes in its dependency tree or file system access permissions."
2. "Check if the update to 'api-gateway-auth' satisfies the chain-of-custody requirements and show me the risk-class binding report."
3. "List all skills currently installed that lack proper delta disclosure and mark them as ineligible for auto-updates until the publisher provides a full change manifest."

Tips & Limitations

• Best Practice: Always treat 'ineligible' status as a warning signal. If a skill developer refuses to provide a delta disclosure, they may be obscuring supply chain vulnerabilities.
• Risk-Class Tuning: Customize your risk thresholds to ensure that lower-risk skills don't overwhelm your workflow with notifications, while high-risk skills receive maximum scrutiny.
• Limitation: The auditor is most effective when publishers adopt the OpenClaw delta disclosure standard. While it can infer gaps in non-compliant skills, it cannot retroactively create disclosure logs for legacy versions that lack historical metadata.