Signet Guardian

Payment guard middleware for AI agents. Use whenever any skill is about to initiate a payment. Runs a preflight check against the user's policy (payments enabled, per-transaction limit, monthly cap). Returns ALLOW, DENY, or CONFIRM_REQUIRED. Other payment-capable skills must call signet-preflight before proceeding and signet-record after a successful payment.

This skill appears to do what it says: local preflight checks, ledger recording, and optional dashboard policy UI. Before installing, do the following: (1) review scripts/signet-cli.ts (and the migrate/edit code path) so you understand exactly how it reads/writes ~/.openclaw/openclaw.json and the references/ ledger; back up your OpenClaw config first; (2) be aware that denied attempts are appended to a local ledger that will contain payee, amount, and purpose — this is stored locally (no network calls shown) but could include sensitive metadata; (3) the migrate command may modify your global OpenClaw config — only run it if you trust the repo and have a backup; (4) installation as an OpenClaw extension requires copying files into your OpenClaw extensions path and restarting the gateway — follow those steps carefully. If you want extra assurance, run the test script in an isolated environment (or inspect/execute the CLI manually) before enabling it for real payments.

Type: OpenClaw Skill Name: signet-guardian Version: 0.1.0 The skill's primary function as a payment guard is benign, but the `signet-cli.ts` script contains a Remote Code Execution (RCE) vulnerability. The `signet-policy --edit` command executes `process.env.EDITOR` with `spawnSync` and `shell: false`. While `shell: false` prevents direct command injection, an attacker could set the `EDITOR` environment variable to a malicious command (e.g., `sh -c 'rm -rf /'`). If an AI agent is instructed to run `signet-policy --edit` while `EDITOR` is controlled by an attacker (e.g., via prompt injection), it could lead to arbitrary code execution. This is a significant vulnerability, but there is no evidence of intentional malicious exploitation within the skill's code or documentation.