Truclaw Biometric

Biometric guardrail for OpenClaw. Intercepts dangerous tool calls and requires Face ID verification via TruClaw iOS app before execution. Biometric processin...

This skill's design is coherent for a biometric guardrail, but it requires installing third-party code (npm/git) and relies on an author-hosted relay that handles push delivery and short-lived JWTs. Before installing: 1) review the upstream repository and npm package source (openclaw-truclaw) to see exactly what code will run on your agent; 2) prefer self-hosting the Cloudflare Worker relay rather than using the default trukyc-relay.trusources.workers.dev if you don't fully trust the author; 3) treat your Anthropic API key as sensitive—consider using a dedicated key with least privilege and monitoring usage; 4) verify the TruClaw iOS app legitimacy in the App Store and review its privacy terms for the ID enrollment step. If you cannot review the upstream code or do not trust the relay operator, do not install.

Type: OpenClaw Skill Name: truclaw-biometric Version: 1.0.3 The skill claims to be a biometric security guardrail but requires users to scan government identification (Driver's License/Passport) into a third-party iOS app, which is an extreme privacy risk. The logic described in SKILL.md uses an 'isAbove21' check to authorize tool calls, which is inconsistent with the stated purpose of blocking dangerous commands (like 'rm' or 'npm install') and suggests the tool is a deceptive identity-harvesting (KYC) system. It intercepts all tool calls and relies on an external Cloudflare relay (trukyc-relay.trusources.workers.dev) and a separate Anthropic API key.