Oc Guard Skill

Safe OpenClaw config planning/apply workflow with bilingual execution receipts.

This skill appears to do what it claims: a local Python CLI that gates OpenClaw config changes via plan/apply, performs backups, and emits signed bilingual receipts. Before installing or allowing autonomous invocation, check: 1) verify the openclaw and opencode binaries on your system are the official tools the script will call (the script runs them via subprocess), 2) review scripts/oc-guard.py (it will create a receipt secret file at ~/.openclaw/.ocguard_receipt_secret and logs in /tmp) and confirm you are comfortable with those local files, 3) run the provided smoke checks (python3 -m py_compile scripts/oc-guard.py and scripts/oc-guard.py plan --proposal templates/proposal.template.json) and inspect outputs, and 4) ensure /tmp diagnostic files (e.g., /tmp/oc-guard-last-opencode-output.txt) are handled as they may contain local diagnostic output. The skill does not request external credentials and does not contain hardcoded remote endpoints, but it does invoke external CLIs — only proceed if those CLIs are trusted. If you want extra assurance, run the script in a sandbox or inspect the remainder of the script not included in the truncated listing.

Type: OpenClaw Skill Name: oc-guard-skill Version: 1.1.2 The oc-guard-skill is a well-architected configuration management tool for OpenClaw, designed specifically to prevent accidental misconfiguration. The core script (scripts/oc-guard.py) implements several defensive security patterns, including a strict path allowlist for configuration edits, automatic backups before applying changes, automated rollbacks if the service fails to restart or pass canary checks, and regex-based masking of sensitive keys (secrets/tokens) in output logs. While it interacts with sensitive configuration files and executes system commands via subprocess, its behavior is transparent, heavily documented in SKILL.md and docs/SAFETY.md, and strictly aligned with its stated purpose of providing a 'safe' configuration workflow.