Add 8 security governance layers to your OpenClaw agent — budget controls, permissions, audit logging, kill switch, identity signing, skill vetting, process isolation, and gateway protection.

This skill makes large claims (kill switch, auditing, signing, isolation) but provides no code, repo, or detailed instructions and asks only for an opaque SAMMA_API_KEY from an unknown source. Before installing or supplying an API key, ask the publisher for: (1) a public repository or homepage with source code and releases; (2) detailed docs describing exactly what data is sent to the SAMMA service, endpoints, and retention/acl policies; (3) how the skill modifies agent hooks or runtime configuration and what permissions it needs; (4) a minimal, auditable implementation or a sandboxed demo you can run locally; and (5) recommended scoping/rotation for the API key (least privilege, short-lived token, limited scope). If you must test now, do so in an isolated agent environment with sanitized inputs and an ephemeral API key, and do not provide production credentials or sensitive datasets until you verify provenance and the data-flow. If the publisher cannot produce source or clear data-flow guarantees, treat this skill as untrusted.

Type: OpenClaw Skill Name: samma-suit Version: 0.1.0 The skill bundle describes a security governance framework for OpenClaw and requires a `SAMMA_API_KEY` environment variable, which is a standard practice for API-driven services. Crucially, the `SKILL.md` file, which serves as the instruction set for the AI agent, contains no executable commands, network calls, or any instructions that could lead to data exfiltration, malicious execution, or prompt injection. The 'Installation' section is incomplete, stating 'Run:' but providing no actual commands, rendering the skill inert in terms of execution.