← Back to Skills Marketplace
Moses Audit
by
burnmydays
· GitHub ↗
· v1.0.2
· MIT-0
288
Downloads
0
Stars
1
Active Installs
3
Versions
Install in OpenClaw
/install moses-audit
Description
MO§ES™ Audit Trail — SHA-256 chained append-only governance ledger. Every agent appends before final response. Provides moses_log_action and moses_verify_cha...
Usage Guidance
This skill appears coherent for its stated purpose: it maintains a local, hash-chained JSONL ledger and optionally produces HMAC attestations using a single operator secret. Before installing, consider: 1) Privacy: the 'detail' field is freeform—do not log secrets, PII, or keys (the SKILL.md warns this but accidental logging is possible). 2) Operator secret: MOSES_OPERATOR_SECRET is optional but used for attestations; ensure you trust the skill owner before placing a secret in your environment. 3) Mandatory logging policy: SKILL.md mandates logging before every final response — decide whether you want that enforced in your agents. 4) Metadata mismatch: the registry declares no required env vars while SKILL.md references MOSES_OPERATOR_SECRET; confirm expected configuration with the skill author. 5) Local files: the ledger and state live under ~/.openclaw — review and secure those files (permissions, backups) if they could contain sensitive metadata. If you need higher assurance, inspect the full included script locally (audit_stub.py) and test in a sandboxed environment first.
Capability Analysis
Type: OpenClaw Skill
Name: moses-audit
Version: 1.0.2
The moses-audit skill implements a local, tamper-evident audit ledger using SHA-256 hash chaining and HMAC-SHA256 attestations. The scripts/audit_stub.py file manages an append-only log in ~/.openclaw/audits/moses/audit_ledger.jsonl and uses the MOSES_OPERATOR_SECRET environment variable for local integrity verification. The instructions in SKILL.md are consistent with the stated purpose of enforcing a governance audit trail, and no evidence of data exfiltration, malicious execution, or unauthorized persistence was found.
Capability Assessment
Purpose & Capability
The name/description (SHA-256 chained append-only ledger, governance audit) align with the shipped script and runtime instructions: the script writes an on-disk JSONL ledger, computes SHA-256 chain hashes, and optionally creates HMAC attestations. Minor inconsistency: registry metadata at the top of the evaluation shows no required env vars, but SKILL.md metadata lists MOSES_OPERATOR_SECRET as an env; the script reads MOSES_OPERATOR_SECRET if present. This is explainable (the secret is optional for attestations) but is a mismatch between declared registry requirements and the SKILL.md.
Instruction Scope
SKILL.md instructs agents to append an audit entry before every final response (mandatory policy language). The instructions reference local ledger and state paths (~/.openclaw/audits/moses and ~/.openclaw/governance) and provide example invocations. The script itself only reads/writes those local files and the optional MOSES_OPERATOR_SECRET; it does not perform networking, read other system credentials, or transmit the secret. The SKILL.md warns not to log secrets — that warning is important because the freeform 'detail' field could accidentally include sensitive material. Also note minor path inconsistency in examples (one example uses ~/.openclaw/workspace/skills/moses-governance/... while shipped script path is scripts/audit_stub.py).
Install Mechanism
No install spec (instruction-only with an included Python script). That is low-risk compared to downloading arbitrary binaries at runtime. The package includes the audit_stub.py script; it will run locally. No external downloads or package-manager installs are performed by the skill itself.
Credentials
The script optionally uses a single environment secret (MOSES_OPERATOR_SECRET) to compute HMAC attestations; this is proportionate to the claimed attestation feature. However, the registry's declared required env vars field is empty while SKILL.md lists the env var — a documentation/metadata mismatch. The operator secret is not written to disk or transmitted by the script (only an HMAC derived from it is recorded), which matches the SKILL.md claim.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It creates and writes ledger and state files under ~/.openclaw which is appropriate for an audit tool. Autonomous invocation remains possible (platform default), but that is normal and not raised by this package alone.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install moses-audit - After installation, invoke the skill by name or use
/moses-audit - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
Auto-publish from commit a97df3317bf275bb1e9dfb18229f162f57015c95
v1.0.1
Auto-publish from commit 7ce401c1a1daf43bc36435de47966fa3382ee2d1
v1.0.0
- Initial release of moses-audit as part of the moses-governance bundle.
- Implements a tamper-evident, append-only audit ledger with SHA-256 hash chaining.
- Provides moses_log_action and moses_verify_chain tools for logging and verification.
- Enforces audit logging: every agent must log actions before final response.
- Includes /audit command handler for recent entries and chain verification.
- Audit ledger stored as JSONL, recording agent, action, outcome, security posture, and cryptographic hashes.
Metadata
Frequently Asked Questions
What is Moses Audit?
MO§ES™ Audit Trail — SHA-256 chained append-only governance ledger. Every agent appends before final response. Provides moses_log_action and moses_verify_cha... It is an AI Agent Skill for Claude Code / OpenClaw, with 288 downloads so far.
How do I install Moses Audit?
Run "/install moses-audit" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Moses Audit free?
Yes, Moses Audit is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Moses Audit support?
Moses Audit is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Moses Audit?
It is built and maintained by burnmydays (@sunrisesillneversee); the current version is v1.0.2.
More Skills