← Back to Skills Marketplace
davida-ps

clawsec-clawhub-checker

by davida-ps · GitHub ↗ · v0.0.3 · MIT-0
cross-platform ✓ Security Clean
389
Downloads
0
Stars
7
Active Installs
3
Versions
Install in OpenClaw
/install clawsec-clawhub-checker
Description
ClawHub reputation checker for clawsec-suite. Adds a standalone reputation gate before guarded skill installation.
README (SKILL.md)

ClawSec ClawHub Checker

Adds a reputation gate on top of the clawsec-suite guarded installer.

Operational Notes

  • Required runtime: node, clawhub, openclaw
  • Depends on: installed clawsec-suite
  • Side effects: none on other skills; this package does not rewrite installed suite files
  • Advisory-hook wiring is optional and manual in this release
  • Network behavior: reputation checks call ClawHub inspect/search endpoints
  • Trust model: scores are heuristic and confirmation-gated

What It Does

  1. Reads skill metadata from ClawHub (inspect --json)
  2. Evaluates scanner status (including VirusTotal summary when present)
  3. Applies additional reputation heuristics (age, updates, author history, downloads)
  4. Requires explicit --confirm-reputation when score is below threshold

Installation

Install after clawsec-suite:

npx clawhub@latest install clawsec-suite
npx clawhub@latest install clawsec-clawhub-checker

Optional preflight check (validates local paths and prints recommended command):

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/setup_reputation_hook.mjs

Usage

Run the enhanced installer directly from this skill:

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/enhanced_guarded_install.mjs \
  --skill some-skill \
  --version 1.0.0

If a skill is below threshold, rerun only with explicit approval:

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/enhanced_guarded_install.mjs \
  --skill some-skill \
  --version 1.0.0 \
  --confirm-reputation

Optional Advisory-Hook Wiring (Manual)

This release does not auto-patch clawsec-suite hook files.
If you rely on advisory alerts that include reputationWarning / reputationWarnings, wire the checker module manually:

  • Source module: ~/.openclaw/skills/clawsec-clawhub-checker/hooks/clawsec-advisory-guardian/lib/reputation.mjs
  • Target hook file: ~/.openclaw/skills/clawsec-suite/hooks/clawsec-advisory-guardian/handler.ts

Treat that wiring as a deliberate local customization and review it before enabling.

Exit Codes

  • 0 safe to install
  • 42 advisory confirmation required (from clawsec-suite)
  • 43 reputation confirmation required
  • 1 error

Configuration

Environment variables:

  • CLAWHUB_REPUTATION_THRESHOLD - Minimum score (0-100, default: 70)

Safety Notes

  • This is defense-in-depth, not a replacement for advisory matching
  • Scanner outputs can produce false positives and false negatives
  • Always review skill code before overriding warnings

Development

Key files:

  • scripts/enhanced_guarded_install.mjs
  • scripts/check_clawhub_reputation.mjs
  • scripts/setup_reputation_hook.mjs
  • hooks/clawsec-advisory-guardian/lib/reputation.mjs

License

GNU AGPL v3.0 or later - Part of the ClawSec security suite

Usage Guidance
This package appears to do exactly what it claims: run ClawHub inspections and apply a reputation heuristic before delegating to the clawsec-suite installer. Before installing: (1) confirm you trust the clawhub and clawsec-suite binaries on your system, since the scripts call them; (2) review the provided scripts (especially enhanced_guarded_install.mjs and check_clawhub_reputation.mjs) if you plan to wire the optional hook into clawsec-suite; (3) be aware the enhanced installer forwards your process environment to the original installer (so any env-held secrets would be available to that child process); and (4) note the behavior is 'fail closed' when scanner metadata is missing — you may encounter blocked installs for packages lacking ClawHub scanner data. If you need higher assurance, run the scripts locally in a controlled environment and inspect outputs before enabling them in production.
Capability Analysis
Type: OpenClaw Skill Name: clawsec-clawhub-checker Version: 0.0.3 The skill is a security utility designed to provide reputation scoring for OpenClaw skills by querying ClawHub metadata. It implements robust input validation using regular expressions for skill slugs and versions in 'check_clawhub_reputation.mjs' and 'enhanced_guarded_install.mjs', preventing shell injection. The code follows its stated purpose of adding a defense-in-depth reputation gate and correctly delegates installation tasks to the 'clawsec-suite' dependency without unauthorized file mutations or data exfiltration.
Capability Assessment
✓ Purpose & Capability
Name/description, declared dependency on clawsec-suite, and required binaries (node, clawhub, openclaw) match the code and CLI behavior. The scripts call clawhub inspect/search and delegate to the clawsec-suite guarded installer as described, so the requested capabilities are appropriate for the stated purpose.
ℹ Instruction Scope
Runtime instructions and scripts stay within the stated scope: they run ClawHub inspect/search, compute heuristics, and optionally instruct a manual integration into clawsec-suite hooks. A caution: the enhanced installer delegates to the suite's guarded installer and streams process.env to it (no new env vars are read by the skill), so the ultimate install flow will run the original installer with the full environment—expected but worth noting.
✓ Install Mechanism
No external install/download is present in the skill bundle (instruction-only install). All code is provided in the package; there are no remote URLs or extract/install steps that would pull arbitrary code at install time.
ℹ Credentials
The skill declares no required secrets and only one optional env var (CLAWHUB_REPUTATION_THRESHOLD), which is proportional. Minor caveat: enhanced_guarded_install passes the parent process.env unchanged to the original guarded installer—this is functionally reasonable but means any environment-level secrets present will also be available to the delegated installer process.
✓ Persistence & Privilege
The skill does not request always:true or automatic mutation of other skills. The setup helper explicitly avoids rewriting other skills and the advisory-hook wiring is manual, which limits persistent/privileged changes.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install clawsec-clawhub-checker
  3. After installation, invoke the skill by name or use /clawsec-clawhub-checker
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.0.3
Release 0.0.3 via CI
v0.0.2
Release 0.0.2 via CI
v0.0.1
Release 0.0.1 via CI
Metadata
Slug clawsec-clawhub-checker
Version 0.0.3
License MIT-0
All-time Installs 7
Active Installs 7
Total Versions 3
Frequently Asked Questions

What is clawsec-clawhub-checker?

ClawHub reputation checker for clawsec-suite. Adds a standalone reputation gate before guarded skill installation. It is an AI Agent Skill for Claude Code / OpenClaw, with 389 downloads so far.

How do I install clawsec-clawhub-checker?

Run "/install clawsec-clawhub-checker" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is clawsec-clawhub-checker free?

Yes, clawsec-clawhub-checker is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does clawsec-clawhub-checker support?

clawsec-clawhub-checker is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created clawsec-clawhub-checker?

It is built and maintained by davida-ps (@davida-ps); the current version is v0.0.3.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463815 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259802 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200680 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191345 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190333 · by oswalpalash

💬 Comments