Skill Supply Chain Auditor 20260712 v1.0

What It Does

Skill Supply Chain Auditor 20260712 reviews third-party skill install notes for practical trust evidence before a buyer or operator installs anything. It checks for provenance, source links, hash records, permission boundaries, static review, sandbox results, rollback notes, owner review, install evidence, and exposed-instance checks.

The skill is a local, stdlib-only analyzer. It produces PASS / REVIEW / BLOCKED output, refuses sensitive-looking inputs, and does not execute, install, fetch, publish, or mutate the reviewed skill.

Use Cases

Marketplace operators who need a repeatable pre-install evidence gate.
Teams reviewing third-party OpenClaw skills for malicious-skill or exposed-instance risk.
Consultants preparing buyer-facing trust evidence before a skill moves into release.

Requirements

Python 3 with standard library only.
No API keys required.
Local, non-sensitive install or review notes.
OpenClaw version: compatible with local skill execution in current OpenClaw skill format.

Example Usage


python3 scripts/skill_supply_chain_auditor.py --text "Provenance evidence, source link, hash record, permission boundary, static review, sandbox result, rollback note, owner review, install evidence, and exposure check are documented." --json

Expected output:


{
  "ok": true,
  "status": "PASS",
  "score": 100,
  "signals_found": ["provenance evidence", "source link", "hash record"],
  "risks_found": [],
  "mutated_files": []
}

Price

$4.99