A specialized security audit tool designed to analyze AI agent workflow definitions and execution logs for risks, permission gaps, and destructive actions.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install osop-review
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install osop-review using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is OSOP Workflow Reviewer?
The OSOP Workflow Reviewer is a critical security utility within the ecosystem of Openclaw Skills. It provides developers and security teams with a robust mechanism to inspect .osop workflow files or .osoplog execution histories for potential vulnerabilities. By scanning for high-risk patterns like destructive CLI commands, broad permission scopes, and hardcoded secrets, this skill acts as a gatekeeper for autonomous agent behaviors.
This skill is essential for maintaining production-grade safety when deploying AI agents. It goes beyond simple string matching by calculating a weighted risk score that considers the context of the node, existing mitigation strategies like approval gates, and error-handling fallback edges. Whether you are reviewing a new automation script or auditing a previous agent run, this tool provides the transparency needed to trust AI-driven processes.
OSOP Workflow Reviewer Use Cases
- Pre-execution auditing of AI workflows to identify dangerous commands like rm -rf or DROP TABLE.
- Detecting hardcoded API keys and secrets (ghp_, sk-, xoxb-) before they are committed or executed.
- Analyzing agent execution logs to evaluate AI reasoning quality and sub-agent spawning patterns.
- Enforcing cost control by identifying agent nodes that lack estimated cost boundaries.
- Validating that high-risk operations are protected by mandatory approval gates and timeouts.
How OSOP Workflow Reviewer Works
- The skill receives a path to an .osop or .osoplog.yaml file via command-line arguments.
- It parses the file to extract node configurations, including CLI commands, API calls, and agent instructions.
- A comprehensive risk analysis is performed, checking for broad permissions (e.g., admin:*), missing timeouts, and lack of error handling on medium-to-high risk nodes.
- It calculates a mathematical risk score (0-100) based on node type weights (CLI, Infra, DB, etc.) and risk multipliers.
- Mitigations such as approval gates and retry policies are applied as negative weights to lower the total risk score.
- A detailed report is generated, featuring a severity table and a final verdict ranging from safe to danger.
OSOP Workflow Reviewer Setup
To use this skill, ensure you have the necessary environment variables and configuration files in place. This skill requires bash and a local OSOP configuration file.
# Verify your OSOP configuration exists
ls ~/.osop/config.yaml
# Run the reviewer against a workflow file
openclaw run osop-review path/to/your/workflow.osop
# Run the reviewer against an execution log
openclaw run osop-review path/to/your/execution.osoplog.yaml
OSOP Workflow Reviewer Data Schema & Taxonomy
The OSOP Workflow Reviewer organizes its findings into a structured report based on the following metadata taxonomy:
| Component | Logic | Description |
|---|---|---|
| Risk Weighting | 0.5 - 2.0 | Weighted by node type (CLI and Infra are highest risk). |
| Risk Multiplier | 1x - 8x | Scaled by severity level (low to critical). |
| Mitigation Credit | -10% to -50% | Reductions for approval_gate, retry_policy, and fallback edges. |
| Finding Penalties | +2 to +20 | Fixed score increases based on detected security findings. |
| Safety Verdict | Enum | Final classification: safe, caution, warning, or danger. |
OSOP Workflow Reviewer Advanced Features
- Dynamic risk scoring that adjusts based on the presence of human-in-the-loop approval gates.
- Detailed AI reasoning audit for log files to ensure autonomous decisions were sound and logical.
- Comprehensive secret detection covering GitHub tokens, Slack IDs, and common API key patterns.
- Permission gap analysis to identify nodes requesting more access than the task requires.
- Cost exposure estimation for agent nodes to prevent unbounded execution expenses in Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
OSOP Report Generator
A specialized utility to transform complex workflow definitions and execution logs into beautiful, interactive HTML reports.
OSOP Workflow Optimizer
A specialized tool that analyzes execution history to automatically improve the performance and reliability of OSOP workflows.
Wan 2.7 Video Generation & Editing
A powerful video generation and editing suite powered by Alibaba's Wan 2.7 models for high-fidelity 720P and 1080P cinematic content.
Debugging Assistant
A comprehensive debugging companion that automates log analysis, suggests strategic breakpoints, and maps execution flows to identify root causes.
OSOP Session Logger
A specialized logging utility that generates structured OSOP workflow definitions and execution records for AI agent sessions.
OSOP: Open Standard Operating Procedures
OSOP provides a universal protocol for defining, validating, and self-optimizing structured workflows for AI agents.
Featured*
