A security-focused execution service that ensures only pre-approved, deterministic actions are processed with verifiable cryptographic receipts.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install openexec-skill
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install openexec-skill using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is OpenExec?
OpenExec is a specialized execution adapter designed to bring high-integrity governance and determinism to agentic workflows. Unlike standard runtime environments, OpenExec acts as a strict enforcement layer that only processes actions which have been explicitly approved. It is a critical component for developers utilizing Openclaw Skills who require authority separation and offline verification.
By design, OpenExec performs no outbound HTTP or RPC calls during execution, making it suitable for secure, air-gapped, or highly regulated environments. It focuses on executing what is already approved rather than making autonomous decisions, providing a clear boundary between policy logic and task execution.
OpenExec Use Cases
- Enforcing replay protection for automated agent tasks to prevent duplicate transactions.
- Verifying signed approval artifacts in production environments using Ed25519 signatures.
- Generating immutable evidence of execution via cryptographic receipt hashes.
- Implementing deterministic action handlers in restricted network environments where outbound calls are prohibited.
How OpenExec Works
- The service receives a POST request to the execution endpoint containing an action, payload, and unique nonce.
- If configured in ClawShield mode, OpenExec performs offline signature verification against the provided approval artifact.
- The system checks the local database to ensure the nonce has not been used, preventing replay attacks.
- The requested action is matched against a static registry of approved handlers and executed deterministically.
- Upon completion, the service generates a receipt hash and stores the record in the database.
- A verifiable receipt is returned to the requester as cryptographic proof of the execution outcome.
OpenExec Setup
To get started with this component of Openclaw Skills, install the dependencies and launch the service:
pip install -r requirements.txt
Run the server locally in demo mode:
python -m uvicorn main:app --host 0.0.0.0 --port 5000
For production, configure the environment variables:
export OPENEXEC_MODE=clawshield
export CLAWSHIELD_PUBLIC_KEY="your-pem-encoded-key"
export CLAWSHIELD_TENANT_ID="your-tenant-id"
OpenExec Data Schema & Taxonomy
OpenExec maintains a lean data footprint focused on auditability and replay prevention. By default, it uses a local SQLite database.
| Component | Storage Type | Purpose |
|---|---|---|
| Nonces | Database Table | Prevents replay attacks by tracking unique request IDs |
| Receipts | Database Table | Stores execution hashes and results for later verification |
| Configuration | Env Vars | Manages modes, public keys, and action allow-lists |
| Logs | Standard Out | Provides service health and deployment metadata |
OpenExec Advanced Features
- ClawShield integration for production-grade, signature-backed execution governance.
- Support for external databases via OPENEXEC_DB_URL for high-availability deployments.
- Granular execution control through the OPENEXEC_ALLOWED_ACTIONS allow-list.
- Multi-tenant isolation using dedicated tenant identifiers for service providers.
- Receipt verification API to validate the integrity of previous execution results.
SKILL.md
Loading
Related Openclaw Skills
Apple Search Ads Management
A comprehensive CLI tool for managing Apple Search Ads campaigns, ad groups, keywords, and performance reports via the v5 API.
DopeWars Online
A multiplayer economic strategy game skill for managing drug production, trading, and cartel combat in Toronto's subway system.
Sky — Email for AI Agents
Sky provides AI agents with dedicated email addresses for communicating with humans and other agents via a robust API and webhook system.
XHS Video Finder
A browser automation tool to find and extract fresh, viral video content from Xiaohongshu for social media repurposing.
Catholic Grounding
A specialized skill for providing accurate, Catechism-cited Catholic teaching and spiritual resources via AI agents.
Discord Shopping Deals
A specialized shopping agent that scouts major retailers and refurbished marketplaces to deliver the top 3 best deals directly into Discord channels.
METADATA
Featured*
