---
name: agent-config-drift-detector
description: OpenClaw skill for governed agent workflows.
---
Agent Config Drift Detector
Detects configuration drift in agent workspace files between a saved snapshot and the current state. Read-only, zero-dependency scan — no subprocess, no network, no shell execution.
What It Does
→ Compares current agent config files (`openclaw.json`, skill manifests, routing tables, `.openclaw/*.json`) against a baseline snapshot
→ Reports added, removed, and changed keys with before/after diffs
→ Assigns drift severity: `CLEAN` / `WARN` / `DRIFT_DETECTED`
→ Produces machine-readable JSON output compatible with OpenClaw pipeline gates
When To Use
→ After any agent update or plugin install to verify no unintended config changes
→ Before and after each pipeline run as a pre/post gate
→ When auditing an agent workspace handed off from another operator
→ As a cron-safe diff guard on scheduled automation runs
Self-Test
```
python3 scripts/detect_config_drift.py --self-test --json
```
Expected output: `{"ok": true, "verdict": "SELF_TEST_PASS", "changed": [], "added": [], "removed": []}`
Typical Usage
```
Snapshot current config state
python3 scripts/detect_config_drift.py --snapshot --output snapshot.json
Later: compare against snapshot
python3 scripts/detect_config_drift.py --compare snapshot.json --json
```
Output Fields
→ `ok` — boolean pass/fail
→ `verdict` — `CLEAN` | `WARN` | `DRIFT_DETECTED` | `SELF_TEST_PASS` | `ERROR`
→ `score` — 0 (clean) to 100 (max drift)
→ `changed` — list of `{file, key, before, after}` diffs
→ `added` — list of `{file, key, value}` new entries
→ `removed` — list of `{file, key, value}` deleted entries
→ `files_scanned` — count of files compared
→ `mutated_files` — always `[]` (read-only)
Limitations
→ JSON/YAML/TOML config files only (`.json`, `.yaml`, `.yml`, `.toml`)
→ Max 100 KB per file; larger files are skipped with a WARNING finding
→ Does not execute or modify any config
→ Snapshot written to caller-specified path only
Security
stdlib-only (argparse, json, pathlib, hashlib, typing). Read-only filesystem access. No subprocess, no network, no shell, no config mutation. Safe for cron and pipeline automation.
Pricing
$4.99 one-time — works with OpenClaw v2026+
Release evidence
Reviewed in the 2026-06-15 GetAgentIQ warehouse propagation cycle.