Skill Supply-Chain Evidence Verifier v1.0

Skill Supply-Chain Evidence Verifier turns local marketplace review notes into a deterministic trust gate before a third-party skill reaches deeper QA or buyer installation. It checks for provenance, permission boundaries, static evidence, checksums, rollback notes, and install-risk signals without executing the reviewed skill.

Use Cases

• Marketplace operators who need a repeatable pre-install due diligence report.
• QA reviewers checking whether a skill has real provenance and safety evidence.
• Consultants packaging skills who want to catch trust gaps before release.

Requirements

• Python standard library only.
• Local notes supplied with --notes or --text.
• No API keys or network access required.
• Compatible with the current OpenClaw skill layout.

Example

python3 skills/skill-supply-chain-evidence-verifier/scripts/supply_chain_evidence_verifier.py --text "provenance, permissions, checksum, static review, rollback evidence" --json

Expected output: JSON with ok, verdict, score, findings, recommendations, and mutated_files=[].

Price: $4.99