SchemaPin

SchemaPin enables cryptographic signing and verification of tool schemas to prevent tampering using ECDSA P-256, SHA-256, TOFU pinning, and .well-known key d...

This skill is internally consistent with its purpose of signing and verifying schemas. Before using it: (1) confirm you trust the upstream SchemaPin packages (install from official registries or pinned releases or verify upstream repo/commit), (2) when running sign/verify flows, restrict the agent's filesystem access so it only reads/writes intended skill directories and pin stores, and (3) treat .well-known discovery endpoints as untrusted until verified—use offline trust bundles or TOFU pinning in high-risk environments. If you need additional assurance, ask the publisher for a reproducible release artifact or public signing key to verify the library itself.

Type: OpenClaw Skill Name: schemapin Version: 1.0.0 The OpenClaw AgentSkills skill bundle for 'schemapin' is benign. The `SKILL.md` provides clear instructions and code examples for integrating and using the SchemaPin library, which is designed for cryptographic verification of tool schemas and skill bundles. All described functionalities, including key generation, signing, verification, key pinning, revocation, and the 'SkillSigner' feature for signing directories, are consistent with a legitimate security tool. There is no evidence of prompt injection attempts, data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The external links point to the project's own GitHub documentation, and the `CHANGELOG.md` indicates a focus on security and dependency updates.