SKILL Sonar

Lifecycle guard. Route to preflight or runtime.

This skill appears coherent and low-risk: it is purely documentation that defines preflight/runtime guard behavior and makes no external calls or credential requests. Before installing, verify the skill's origin/author (the registry metadata shows an opaque owner ID), review the preflight and runtime documents yourself to ensure the guard logic matches your expectations, and test it in a non-production environment. Note that the documents are policy-level guidance only — they cannot by themselves enforce sandboxing or prevent code execution; confirm your agent runtime will actually follow the guard steps (triage prompts, user confirmations) and that you won't grant the skill extra capabilities (e.g., file-system or network access) beyond its intended read-only review of the skill package.

Type: OpenClaw Skill Name: skill-sonar Version: 1.0.2 The 'skill-sonar' bundle is a defensive security framework designed to provide preflight auditing and runtime protection for OpenClaw agents. It contains comprehensive instructions (SKILL.md, preflight-guard.md, runtime-guard.md) that guide the agent to treat all external skill artifacts and tool outputs as untrusted (P0). While the files contain sensitive indicators such as regex patterns for API keys and references to private directories like ~/.ssh/ (found in preflight/preflight-guard.md), these are used strictly as detection signatures to alert users to risks in other skills. The logic is consistently aligned with its stated purpose of safety enforcement and does not exhibit malicious intent or unauthorized data access.