Marketplace Install Confidence Kit 20260717 — Release Notes v1.0

Release Date: 2026-07-17

Price: $4.99

Category: security

Status: DOCS_COMPLETE — awaiting Rooster listing

What It Does

Marketplace Install Confidence Kit converts pre-install evaluation notes into a deterministic PASS, REVIEW, or BLOCKED confidence report for marketplace skill installations. It checks for marketplace source, version pins, runtime compatibility, permission manifests, checksums, static scan results, sandbox results, install plans, rollback plans, buyer warnings, and reviewer approval — flagging risks like incompatible runtimes, over-permission, auto-install, credential access, and unreviewed payloads. Entirely offline and read-only, it never installs anything or accesses credentials.

Use Cases

Buyers preparing to install a marketplace skill who want to document their due diligence — confirming runtime compatibility, permission scope, and rollback coverage — before committing to the install.
Platform operators enforcing a pre-install evidence gate before team members can add new skills, ensuring every install goes through a scored confidence check rather than a gut-feel decision.
Marketplace auditors generating repeatable install-confidence reports for compliance records, with a clear PASS/REVIEW/BLOCKED verdict and scored evidence for each evaluation.

Requirements

Python: 3.8 or later (included with OpenClaw)
Dependencies: None — Python standard library only (argparse, json, re, pathlib)
API keys: Not required
OpenClaw version: 1.0+
Network access: Not required — runs entirely offline

Example Usage


# Analyse a local notes file
python3 scripts/marketplace_install_confidence_kit.py --notes install-eval-notes.txt --json

# Pass inline text directly
python3 scripts/marketplace_install_confidence_kit.py --text "marketplace source, version pin, runtime compatibility..." --json

# Run built-in self-test
python3 scripts/marketplace_install_confidence_kit.py --self-test --json

Expected Output (PASS)


{
  "findings": [],
  "missing_signals": [],
  "mutated_files": [],
  "ok": true,
  "recommendations": [
    "Keep this result advisory pending independent Viper review."
  ],
  "risks_found": [],
  "score": 108,
  "signals_found": [
    "marketplace source", "version pin", "runtime compatibility",
    "dependency inventory", "permission manifest", "checksum record",
    "static scan", "sandbox result", "install plan",
    "rollback plan", "buyer warning", "reviewer approval"
  ],
  "status": "PASS"
}

Expected Output (BLOCKED — risk signals present)


{
  "mutated_files": [],
  "ok": true,
  "risks_found": ["incompatible runtime", "over permission", "auto install"],
  "score": 0,
  "signals_found": [],
  "status": "BLOCKED"
}

Marketplace Install Confidence Kit 20260717