Openclaw Signet

Cryptographic skill verification. Sign installed skills with SHA-256 content hashes and verify they haven't been tampered with. Detects modified, added, and removed files within skill directories. Free alert layer — upgrade to openclaw-signet-pro for rejection, quarantine, and trust chain restoration.

This tool appears to do what it says: locally sign and verify skills and optionally quarantine or restore them. Before installing or running: (1) review the included scripts/signet.py yourself (it's a single-file Python tool) because it will write manifests and move/rename skill directories when you use quarantine/reject/restore; (2) back up your workspace (or ensure version control) before using quarantine/reject or restore operations; (3) run sign once after installing trusted skills to create the initial manifest; (4) consider file-permission protection for the .signet/manifest and snapshots if you want to prevent unauthorized local modification; (5) be aware that if you allow autonomous agent invocation, the agent could run this script and perform quarantines or restores — that behavior is expected but may be impactful, so restrict agent privileges if you want to avoid automated modifications.

Type: OpenClaw Skill Name: openclaw-signet Version: 1.0.2 The OpenClaw Signet skill is designed for a security-enhancing purpose (cryptographic verification of other skills) and lacks direct evidence of malicious intent, such as data exfiltration or backdoor installation. However, it is classified as 'suspicious' due to its powerful file system manipulation capabilities (`shutil.move`, `shutil.copytree`, `shutil.rmtree`) within the `scripts/signet.py` file. While these operations are necessary for its stated purpose (quarantining, snapshotting, restoring skills), the script allows the `--workspace` argument to be user-defined or derived from environment variables. This presents a significant vulnerability if an AI agent or user were prompted to specify a malicious workspace path (e.g., a critical system directory), potentially leading to unintended data loss or system disruption, even though the skill itself does not *intend* to cause harm.