Tool Governance

工具使用安全与可靠性。当工具反复失败、agent 绕过权限否决、或需要破坏性操作保护时使用。不适用于 agent 提前停止（用 execution-loop）或上下文管理（用 context-memory）。参见 error-recovery（限速恢复）。

What to check before installing: - Required tools: the scripts call git, jq, realpath and use md5/md5sum/shasum. Install those or run the skill in an environment that has them. - Files & persistence: the scripts write session state to HOME/.openclaw/shared-context/sessions (tool-errors.json, denials.json). SKILL.md mentions .claude/... but actual scripts use .openclaw — confirm where you want state stored and whether that location is acceptable. - Git side effects: the checkpoint hook can run git add / git stash push / git stash apply; this modifies repo index and stash list and may change working tree state. Do not deploy this on a production repository without backups; test in a disposable repo first. - No network exfiltration appears present, and no credentials are requested, but the skill does inspect assistant messages and tool payloads and persists them locally — consider privacy implications. - If you want to limit blast radius: run hooks in a sandbox or CI/test repo, ensure NC_SESSION is set correctly, or avoid enabling autonomous invocation until you vet behavior. - If you need the skill, consider editing scripts to simplify/limit git operations (e.g., avoid 'git add -A' or require explicit confirmation) and to declare required binaries in metadata so the runtime environment can be prepared. Confidence note: medium — the code is readable and coherent for its purpose, but the undeclared dependencies, path mismatches, and git side effects are significant enough to warrant caution.

Type: OpenClaw Skill Name: tool-governance Version: 2.4.0 The bundle provides a set of safety guardrails for OpenClaw agents, including input validation to block dangerous commands (e.g., 'rm -rf /' or 'curl|sh' in tool-input-guard.sh), automatic backups via git stash before destructive operations (checkpoint-rollback.sh), and circuit breakers to prevent infinite retry loops or denial bypasses (tool-error-advisor.sh, denial-tracker.sh). The behavior is consistent with the stated goal of tool governance and lacks any indicators of malicious intent, data exfiltration, or unauthorized persistence.