A robust supply-chain governance tool designed to scan, assess, and quarantine risky Openclaw Skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skillgate-gov
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skillgate-gov using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is SkillGate Governance?
SkillGate Governance is a dedicated security layer for developers using Openclaw Skills. It addresses the growing need for supply-chain safety by providing automated scanning and assessment of third-party skills. By identifying dangerous patterns like shell injections or unauthorized external downloads, it ensures that your agent environment remains secure and deterministic.
This skill provides a transparent way to verify package metadata and maintain a high standard of operational security across your workspace. It prioritizes a non-invasive approach, defaulting to read-only scans while offering powerful commands for quarantining threats and restoring trusted components to your library of Openclaw Skills.
SkillGate Governance Use Cases
- Scan a local workspace for malicious Openclaw Skills before deployment.
- Automatically quarantine skills flagged with CRITICAL or HIGH risk levels to prevent shell injections.
- Verify the provenance and integrity of skill packages via npm metadata to ensure authenticity.
- Explain specific security findings to help developers understand why a skill was flagged.
- Maintain a governance status dashboard for all active agent capabilities within your environment.
How SkillGate Governance Works
- The user initiates a scan using the gov_scan command to analyze the targeted directory containing Openclaw Skills.
- SkillGate evaluates the code against predefined risk levels, ranging from informational logs to critical supply-chain security threats.
- Detailed evidence files are generated and stored in a local .skillgate directory to provide an audit trail for all findings.
- Based on the risk assessment, the user can utilize slash commands to quarantine risky files or restore them after manual verification.
- The tool provides human-readable explanations for every flagged issue to help developers remediate vulnerabilities and maintain a safe workspace.
SkillGate Governance Setup
To get started with SkillGate, it is recommended to use npx for a secure, deterministic installation of these Openclaw Skills components:
# Scan current workspace (read-only by default)
npx --yes @skillgate/[email protected] gov_scan .
# Explain a specific security finding
npx --yes @skillgate/[email protected] gov_explain <EVIDENCE_JSON_PATH>
To use as a plugin, ensure you have node and npm installed, then load the skill to access the /gov slash commands.
SkillGate Governance Data Schema & Taxonomy
| Category | Description |
|---|---|
| Evidence | JSON files containing detailed security findings stored in the .skillgate/ folder. |
| Risk Levels | CRITICAL (Quarantine), HIGH (Disable), MEDIUM (Warn), LOW/INFO (Log). |
| Metadata | NPM package provenance including dist.integrity and repository details for Openclaw Skills. |
| Filesystem Scope | Defaults to read-only; writes evidence to local folders and moves files only during quarantine/restore. |
SkillGate Governance Advanced Features
- Pinned versioning via npx to ensure deterministic behavior and reduce supply-chain risk.
- Comprehensive slash command integration for real-time governance directly within the agent interface.
- Package metadata verification to compare local Openclaw Skills against official registry versions.
- Granular risk assessment that separates critical shell injection threats from minor informational warnings.
- Automated quarantine and restoration workflows to instantly isolate dangerous Openclaw Skills without manual file moving.
SKILL.md
Loading
Related Openclaw Skills
Restaurant Review Cross-Check
A powerful validation tool that cross-references Xiaohongshu and Dianping data to provide high-confidence restaurant recommendations.
Orthogonal Agent Framework
A modular AI Agent design system that decouples agent capabilities into four independent dimensions for maximum flexibility and reliability.
AI Trends Reporter
An automated report generator that synthesizes the latest AI news with personalized recommendations for high-value Openclaw Skills.
Tomorrow Weather & Almanac Push
An automated weather assistant that delivers daily Beijing forecasts, temperature fluctuation warnings, and traditional almanac insights via Feishu.
LovTrip Travel Content Browser
A zero-config CLI and API utility to search and retrieve travel guides, destinations, and itineraries from the LovTrip platform.
LovTrip Meetup Planner
An AI-powered coordination tool that calculates the geographic midpoint and suggests optimal venues for group meetups.