Update Signature Verifier

Helps verify the cryptographic integrity of skill updates by checking whether each version is signed by the same key as the original install, detecting key c...

This skill is conceptually coherent: it describes how to audit signature continuity and doesn't request secrets. However, it is instruction-only and has no source, homepage, or shipped code — that means you don't have verifiable provenance or an executable implementation to inspect. Before using it in an automated or high-risk context: 1) ask the publisher (or the installer) for the exact implementation or scripts the agent will run (concrete curl/python commands, URLs contacted, and signature verification steps); 2) do not supply private keys or credentials to the skill; 3) if the agent will fetch JWKS or version artifacts, verify those endpoints are the legitimate publisher endpoints; and 4) if you need higher assurance, run the verification offline yourself by providing the version/signature metadata to the agent rather than allowing it to fetch artifacts autonomously. If you cannot obtain implementation details or provenance, treat this as a useful guide but limit its autonomous privileges and network access.

Type: OpenClaw Skill Name: update-signature-verifier Version: 1.0.0 The skill's stated purpose is to verify the cryptographic integrity of skill updates, a legitimate security function. The `SKILL.md` clearly describes this purpose, its checks, and usage, without any evidence of prompt injection attempts against the agent. While it requires `curl` and `python3`, these are standard binaries and their use is consistent with the stated security auditing purpose. There are no indicators of malicious intent such as data exfiltration, unauthorized execution, persistence, or obfuscation within the provided files.