trustmyagent

What This Skill Does

TrustMyAgent provides a transparent, stateless security posture monitoring system for your OpenClaw AI agents. It performs 41 comprehensive, read-only security checks across 14 distinct system domains. Instead of relying on opaque background services, this tool explicitly calculates a security trust score between 0 and 100 based on your current machine configuration. It is designed for privacy-conscious users who want to verify that their agent environment is hardened against common vulnerabilities without installing invasive monitoring software.

Installation

Installation is managed via the OpenClaw skill registry. Once installed, the agent will guide you through a four-step process: verifying your Python environment, performing a sandbox 'dry-run' to inspect the exact telemetry data, running the final assessment with your chosen privacy settings, and optionally configuring recurring security monitoring via cron jobs. The tool requires Python 3 and runs entirely on-demand.

Use Cases

Use TrustMyAgent when you are setting up a new agent environment and need to ensure security best practices are met. It is ideal for developers who need to demonstrate 'security-by-default' to auditors or stakeholders, for system administrators managing agent fleets, and for individual power users who want a periodic sanity check on the security posture of their local machine. It is particularly useful for verifying configurations before granting agents elevated system permissions.

Example Prompts

1. "OpenClaw, please run a security assessment on my current agent environment using TrustMyAgent."
2. "I want to check my machine's security score but I don't want to send any data to external servers; can you run the TrustMyAgent skill in local-only mode?"
3. "Can you set up a recurring security check for my agent every hour so I stay on top of my system's trust score?"

Tips & Limitations

TrustMyAgent is a stateless scanner and does not proactively block attacks or remediate security gaps. It is a diagnostic tool, not an antivirus solution. Always perform the dry-run before authorizing data transmission to verify that no sensitive information is included in the telemetry report. Because the tool is stateless, it cannot track changes over time unless you configure the recommended cron jobs to log history or store results elsewhere. For maximum security, always keep the source code updated from the provided GitHub repository.