SkillGate Governance

Supply-chain governance for OpenClaw skills: scan, assess, quarantine/restore.

This skill appears to do what it says: it runs an npm-scoped scanner to inspect a directory and can quarantine skills by moving files in the directory you pass. Before running it, consider: (1) prefer the pinned version shown in SKILL.md and run the provided npm view / dist.integrity verification to confirm package provenance; (2) run scans read-only where possible and only use quarantine/restore when you trust the tool; (3) be aware npx will fetch and execute code from the npm registry — if you have strict supply-chain requirements run the package in a sandbox or inspect its source first (the SKILL.md points to the GitHub repo); (4) avoid running quarantine on system or shared directories you don’t control. Overall the skill is internally consistent, but treat remote-executed packages and file-moving operations with standard caution.

Type: OpenClaw Skill Name: skillgate-gov Version: 0.1.2 This skill bundle describes a 'SkillGate' governance tool designed to scan, assess, and quarantine/restore OpenClaw skills. The `SKILL.md` file clearly outlines its purpose, required binaries (`node`, `npm`), and the commands it executes via `npx`. While `npx` downloads and executes code, this is explicitly stated and aligned with the tool's function. The documentation also details its permissions, noting it's read-only by default but performs writes for quarantine/restore operations. There is no evidence of prompt injection, data exfiltration, obfuscation, or other malicious intent within the provided files; instead, it offers provenance verification steps. The described capabilities are consistent with a legitimate security governance tool.