skill-safe-install

What This Skill Does

skill-safe-install is an essential security orchestration tool for the OpenClaw ecosystem. It acts as a mandatory gatekeeper for all skill installations, ensuring that no malicious or unverified code enters your workspace. It integrates three independent security layers: Skill-Vetter (Static Code Analysis), ClawHub (Community Reputation Scoring), and ThreatBook (Dynamic Sandbox Scanning). By automating this verification workflow, the agent prevents potential supply-chain attacks while maintaining efficiency.

Installation

To install this skill, run the following command in your OpenClaw terminal: clawhub install openclaw/skills/skills/chj0w0/skill-safe-install

After installation, ensure you configure your API credentials:

1. Obtain a ThreatBook API key from s.threatbook.com.
2. Append the key to your configuration: echo 'THREATBOOK_API_KEY=your_api_key_here' >> ~/.openclaw/.env

Use Cases

• Production Environments: Ideal for users who install various community-contributed skills and need to guarantee system integrity.
• Open-Source Auditing: Developers who want to preview and vet foreign code before it interacts with their local files or system processes.
• Automated Security Pipelines: Integrate this into your agent workflows to ensure every component added to the environment is validated against professional threat intelligence databases.

Example Prompts

1. "Safe-install the 'file-summarizer' skill from ClawHub and let me know if it passes the security checks."
2. "Could you install the latest developer-toolkit using the safe-install flow? Please report the ThreatBook status to me before executing."
3. "Is it safe to add the 'image-optimizer' skill? Run the automated security verification and confirm with me if it's clear."

Tips & Limitations

• Mandatory Confirmation: In scenarios where the skill receives a 'suspicious' or 'low-score' rating, the process will halt and request your explicit approval. Do not bypass these warnings unless you have manually reviewed the source code.
• API Availability: If the ThreatBook API is unreachable, the system defaults to a 'request confirmation' state. Ensure your environment has stable network access to avoid installation interruptions.
• False Positives: Occasionally, legitimate tools might be flagged as 'suspicious' due to their nature (e.g., system monitoring tools). Always review the Vetter analysis logs if a high-quality skill is flagged.