Marketplace Trust Attestation Pack 20260818 — Release Notes

What it does

Marketplace Trust Attestation Pack turns redacted marketplace review notes into a repeatable trust evidence report. It checks whether a skill or agent listing has enough proof around provenance, integrity, permissions, dependencies, security review, data handling, reviewer identity, and rollback before buyers are asked to trust it.

The workflow is advisory and read-only. It helps marketplace operators and publishers spot missing evidence early without changing runtime, billing, deployment, or marketplace state.

Use cases

• Marketplace publishers who need a clean pre-release trust checklist before listing a new skill.
• Security reviewers who want consistent evidence across provenance, permissions, dependencies, and data handling.
• Operations teams that need a documented rollback and reviewer trail before approving marketplace distribution.

Requirements

• Python 3 with standard-library modules only.
• Redacted notes supplied through `--text` or a single local `--notes` file.
• No API keys required.
• OpenClaw workspace capable of running local skill scripts.

Example usage

python3 scripts/marketplace_trust_attestation_pack.py --text "source provenance documented; integrity checksum recorded; permission inventory complete; dependency inventory complete; security scan clean; malicious behavior review clean; data handling note redacted; network behavior note documented; transaction attestation present; reviewer identity recorded; review timestamp present; rollback path documented" --json

Expected output: JSON with `verdict` set to `PASS`, a high evidence score, matched trust signals, and `mutated_files: []`.

Price

$4.99