Openclaw Ledger

Tamper-evident audit trail for agent sessions. Hash-chained logs of workspace changes with cryptographic verification. Know exactly what changed, when, and detect if anyone altered the record. Free alert layer — upgrade to openclaw-ledger-pro for freeze, forensics, and chain restoration.

Before installing or running this skill: (1) Review the full script locally — especially the truncated tail — to confirm there are no file‑moving or deletion operations you don't expect (search for 'shutil.move', 'os.remove', '.quarantine', 'frozen', 'restore', etc.). (2) Note that the ledger records file paths and SHA‑256 hashes in .ledger/session.json and chain.jsonl — this can reveal directory structure and filenames even though it does not store file contents. Don't point it at sensitive or production workspaces until you are comfortable with that data being stored locally. (3) The code will honor OPENCLAW_WORKSPACE if set; this env var was not declared in the skill metadata — be aware of implicit workspace selection. (4) Because the source/homepage is unknown, run the script first in an isolated test workspace or container and verify there are no unexpected network calls or destructive actions. (5) If you plan to rely on the tool for security/auditing, confirm provenance (official repo or signed releases) and consider code review or vendor verification before trusting ledger contents for forensics.

Type: OpenClaw Skill Name: openclaw-ledger Version: 1.0.2 The OpenClaw Ledger skill is designed to provide a tamper-evident audit trail for agent workspaces. The Python script (`scripts/ledger.py`) uses only standard library modules, performs no network calls, and restricts file system operations to the specified workspace and its `.ledger` subdirectory for logging and snapshotting. The `SKILL.md` and `README.md` files clearly describe the skill's purpose and commands without any prompt injection attempts or instructions for malicious actions. The 'protect' command implements defensive measures like freezing compromised chains and auto-restoring from clean backups, which are legitimate security features. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation.