Skill Supply-Chain Vetting Pack 20260717 — Release Notes v1.0

Release Date: 2026-07-17

Price: $4.99

Category: security

Status: DOCS_COMPLETE — awaiting Rooster listing

What It Does

The Skill Supply-Chain Vetting Pack converts your operator notes on a third-party skill into a deterministic PASS, REVIEW, or BLOCKED evidence report. It scans for supply-chain evidence signals — source provenance, commit pins, checksums, author identity, license review, permission scope, sandbox results, and rollback plans — then flags risks such as unknown origins, unpinned revisions, hidden dependencies, and unreviewed payloads. Running fully offline with no network or config access, it gives buyers and operators a structured audit trail before any installation decision is made.

Use Cases

Marketplace buyers vetting a third-party skill before installing it into their OpenClaw environment, ensuring provenance and permission evidence are documented before trust is extended.
Security teams creating a repeatable audit trail of supply-chain signals and risk flags before approving a skill for organisation-wide use.
Platform operators enforcing a consistent pre-install evidence gate across all new skill acquisitions to reduce supply-chain blind spots.

Requirements

Python: 3.8 or later (included with OpenClaw)
Dependencies: None — Python standard library only (argparse, json, re, pathlib)
API keys: Not required
OpenClaw version: 1.0+
Network access: Not required — runs entirely offline

Example Usage


# Analyse a local notes file
python3 scripts/skill_supply_chain_vetting_pack.py --notes my-review-notes.txt --json

# Pass inline text directly
python3 scripts/skill_supply_chain_vetting_pack.py --text "repository source, commit pin, checksum record..." --json

# Run built-in self-test
python3 scripts/skill_supply_chain_vetting_pack.py --self-test --json

Expected Output (PASS)


{
  "findings": [],
  "missing_signals": [],
  "mutated_files": [],
  "ok": true,
  "recommendations": [
    "Keep this result advisory pending independent Viper review."
  ],
  "risks_found": [],
  "score": 108,
  "signals_found": [
    "repository source", "commit pin", "checksum record",
    "author identity", "license review", "dependency inventory",
    "permission review", "static scan", "sandbox result",
    "rollback plan", "reviewer approval", "evidence bundle"
  ],
  "status": "PASS"
}

Expected Output (BLOCKED — risk signals present)


{
  "mutated_files": [],
  "ok": true,
  "risks_found": ["unknown source", "missing checksum", "no rollback"],
  "score": 0,
  "signals_found": [],
  "status": "BLOCKED"
}

Skill Supply Chain Vetting Pack 20260717