Skill Guardian

Safely manage your AI skill collection with trust scoring, security vetting, delayed auto-updates, and pending periods for new skills. Use when adding new sk...

What to check before installing or scheduling Skill Guardian: - Vetting is not implemented in the code provided: add_skill calls a vetter subprocess but returns a placeholder trust score (80) instead of parsing real vetter output. Confirm that a trustworthy skill-vetter (and its scripts/vet.py) exists at the expected path and inspect it before relying on automated vetting. - The scripts will invoke the clawhub CLI to list and update skills. apply_updates will run 'clawhub update', which can download and install third-party code — that's the intended function, but it means a compromised or malicious package reachable via clawhub could be installed automatically based on registry entries. - auto_run uses shell=True to run commands and the README/crontab examples reference running under /root/.openclaw/workspace. Avoid adding the cron entries as root until you've tested behavior in a safe, non-privileged environment. - The check_updates parsing is brittle (parses clawhub list output by splitting lines). Expect false positives/negatives; consider testing check_updates/apply_updates with dry-run to see what would happen. - Before trusting automatic promotions/updates, manually inspect assets/skill-registry.json and the contents of skill-vetter and any skills you add. Prefer initially running scripts manually (use --dry-run where available) and validate that vetter output and trust-score calculations match the policy described in references/trust-ratings.md. If you want to proceed: (1) run the vetter scripts manually and inspect their code, (2) run check_updates/apply_updates with --dry-run, (3) test scheduling in a non-root account, and (4) back up your workspace/registry file so you can roll back if an unexpected update is applied.

Type: OpenClaw Skill Name: skill-guardian Version: 1.0.0 The Skill Guardian bundle is a utility designed to manage and secure an AI agent's skill collection by implementing trust scores, security vetting, and mandatory waiting periods for updates. The Python scripts (e.g., add_skill.py, apply_updates.py) interact with the clawhub CLI and local vetting tools to automate skill lifecycle management. While the scripts use subprocess execution and suggest cron-based persistence for automation, these behaviors are transparently documented and align strictly with the stated purpose of providing a defensive layer against supply chain attacks.