OpenClaw Warden Pro

Full workspace security suite: detect unauthorized modifications, scan for prompt injection patterns, and automatically respond with countermeasures — snapshot restore, skill quarantine, git rollback, and automated protection sweeps. The complete post-installation security layer for agent workspaces.

This skill appears to do what it says: it scans the workspace and can automatically restore files, rename skill directories to quarantine them, and run git rollbacks. Before installing or enabling automatic hooks, do the following: 1) Review the full integrity.py script locally to confirm there are no unexpected network calls or hidden behavior (the provided code appears local only). 2) Ensure you have backups of your workspace (and your git history) — 'protect' may restore or roll back files automatically. 3) Install and verify git is available if you plan to use rollback; the registry entry doesn't list git as a required binary but the feature expects a git repo. 4) Test the tool in a disposable test workspace to observe how snapshots are stored (it uses .integrity/snapshots) and how quarantine renames skill directories (prefix .quarantined-). 5) Be cautious about adding the SessionStart hook or heartbeat automation until you trust the baseline/snapshot state — automatic runs can be disruptive. If you want minimal risk, run the detection commands manually rather than wiring 'protect' to automatic startup.

Type: OpenClaw Skill Name: openclaw-warden-pro Version: 1.0.1 The OpenClaw Warden Pro skill is a security suite designed to detect and respond to unauthorized modifications and prompt injection patterns within an agent's workspace. All code and documentation align with this stated purpose. The skill uses standard Python libraries, performs local file system operations (copy, rename), and executes local `git` commands via `subprocess` for its 'rollback' and 'protect' countermeasures. While these actions involve powerful capabilities, they are directly necessary for the skill's defensive functions (snapshot restore, skill quarantine, git rollback) and are not used for exfiltration, unauthorized remote control, persistence, or any other malicious intent. The skill explicitly states it has no external dependencies, no `pip install`, and no network calls, which is confirmed by the code. The prompt injection patterns listed are for *detection*, not for malicious instruction.