Safe Install

Install OpenClaw skills through policy validation, ClawShield scanning, snapshot storage, and rollback controls.

This tool is coherent with its stated purpose, but before installing: (1) review the policy file you will use (allowedSources, blockedPatterns, and registry mappings) so the tool doesn't allow unexpected local paths; (2) inspect or vet the @mike007jd/openclaw-clawshield dependency (it performs scanning and could perform network I/O); (3) confirm the store directory (.openclaw-tools/safe-install) is an acceptable location for snapshots and history and contains no sensitive files you don't want preserved; and (4) run the test fixtures in a sandbox to verify behavior (fixtures intentionally include a curl | sh payload to validate blocking). The package contains code files (bin + src) despite lacking an external install spec—this is normal for a CLI-but-not-automatically-installed skill but worth noting.

Type: OpenClaw Skill Name: safe-install Version: 1.0.1 The safe-install skill is a security utility designed to provide a protected installation flow for other OpenClaw skills, featuring policy validation, risk scanning via ClawShield, and rollback snapshots. While the bundle includes a test fixture (fixtures/avoid-skill/scripts/install.sh) containing a 'curl | sh' payload (IOC: malicious.example), this is explicitly used as a negative test case to verify the tool's detection and blocking logic, as confirmed in test.js. The core implementation in src/index.js follows secure coding practices, including path traversal protections and resource limits.