← 返回 Skills 市场
Moses Audit
作者
burnmydays
· GitHub ↗
· v1.0.2
· MIT-0
288
总下载
0
收藏
1
当前安装
3
版本数
在 OpenClaw 中安装
/install moses-audit
功能描述
MO§ES™ Audit Trail — SHA-256 chained append-only governance ledger. Every agent appends before final response. Provides moses_log_action and moses_verify_cha...
安全使用建议
This skill appears coherent for its stated purpose: it maintains a local, hash-chained JSONL ledger and optionally produces HMAC attestations using a single operator secret. Before installing, consider: 1) Privacy: the 'detail' field is freeform—do not log secrets, PII, or keys (the SKILL.md warns this but accidental logging is possible). 2) Operator secret: MOSES_OPERATOR_SECRET is optional but used for attestations; ensure you trust the skill owner before placing a secret in your environment. 3) Mandatory logging policy: SKILL.md mandates logging before every final response — decide whether you want that enforced in your agents. 4) Metadata mismatch: the registry declares no required env vars while SKILL.md references MOSES_OPERATOR_SECRET; confirm expected configuration with the skill author. 5) Local files: the ledger and state live under ~/.openclaw — review and secure those files (permissions, backups) if they could contain sensitive metadata. If you need higher assurance, inspect the full included script locally (audit_stub.py) and test in a sandboxed environment first.
功能分析
Type: OpenClaw Skill
Name: moses-audit
Version: 1.0.2
The moses-audit skill implements a local, tamper-evident audit ledger using SHA-256 hash chaining and HMAC-SHA256 attestations. The scripts/audit_stub.py file manages an append-only log in ~/.openclaw/audits/moses/audit_ledger.jsonl and uses the MOSES_OPERATOR_SECRET environment variable for local integrity verification. The instructions in SKILL.md are consistent with the stated purpose of enforcing a governance audit trail, and no evidence of data exfiltration, malicious execution, or unauthorized persistence was found.
能力评估
Purpose & Capability
The name/description (SHA-256 chained append-only ledger, governance audit) align with the shipped script and runtime instructions: the script writes an on-disk JSONL ledger, computes SHA-256 chain hashes, and optionally creates HMAC attestations. Minor inconsistency: registry metadata at the top of the evaluation shows no required env vars, but SKILL.md metadata lists MOSES_OPERATOR_SECRET as an env; the script reads MOSES_OPERATOR_SECRET if present. This is explainable (the secret is optional for attestations) but is a mismatch between declared registry requirements and the SKILL.md.
Instruction Scope
SKILL.md instructs agents to append an audit entry before every final response (mandatory policy language). The instructions reference local ledger and state paths (~/.openclaw/audits/moses and ~/.openclaw/governance) and provide example invocations. The script itself only reads/writes those local files and the optional MOSES_OPERATOR_SECRET; it does not perform networking, read other system credentials, or transmit the secret. The SKILL.md warns not to log secrets — that warning is important because the freeform 'detail' field could accidentally include sensitive material. Also note minor path inconsistency in examples (one example uses ~/.openclaw/workspace/skills/moses-governance/... while shipped script path is scripts/audit_stub.py).
Install Mechanism
No install spec (instruction-only with an included Python script). That is low-risk compared to downloading arbitrary binaries at runtime. The package includes the audit_stub.py script; it will run locally. No external downloads or package-manager installs are performed by the skill itself.
Credentials
The script optionally uses a single environment secret (MOSES_OPERATOR_SECRET) to compute HMAC attestations; this is proportionate to the claimed attestation feature. However, the registry's declared required env vars field is empty while SKILL.md lists the env var — a documentation/metadata mismatch. The operator secret is not written to disk or transmitted by the script (only an HMAC derived from it is recorded), which matches the SKILL.md claim.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It creates and writes ledger and state files under ~/.openclaw which is appropriate for an audit tool. Autonomous invocation remains possible (platform default), but that is normal and not raised by this package alone.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install moses-audit - 安装完成后，直接呼叫该 Skill 的名称或使用
/moses-audit触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
Auto-publish from commit a97df3317bf275bb1e9dfb18229f162f57015c95
v1.0.1
Auto-publish from commit 7ce401c1a1daf43bc36435de47966fa3382ee2d1
v1.0.0
- Initial release of moses-audit as part of the moses-governance bundle.
- Implements a tamper-evident, append-only audit ledger with SHA-256 hash chaining.
- Provides moses_log_action and moses_verify_chain tools for logging and verification.
- Enforces audit logging: every agent must log actions before final response.
- Includes /audit command handler for recent entries and chain verification.
- Audit ledger stored as JSONL, recording agent, action, outcome, security posture, and cryptographic hashes.
元数据
常见问题
Moses Audit 是什么？
MO§ES™ Audit Trail — SHA-256 chained append-only governance ledger. Every agent appends before final response. Provides moses_log_action and moses_verify_cha... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 288 次。
如何安装 Moses Audit？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install moses-audit」即可一键安装，无需额外配置。
Moses Audit 是免费的吗？
是的，Moses Audit 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Moses Audit 支持哪些平台？
Moses Audit 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Moses Audit？
由 burnmydays（@sunrisesillneversee）开发并维护，当前版本 v1.0.2。
推荐 Skills