A verification tool that ensures AI skill signing events are recorded in immutable, independently auditable transparency logs.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install transparency-log-auditor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install transparency-log-auditor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Transparency Log Auditor?
The Transparency Log Auditor is a specialized tool designed to close the trust gap in AI agent ecosystems. While signed skills provide a level of security, they are often only as trustworthy as the registry hosting them. This skill audits whether signing events—such as version releases and key rotations—are recorded in a way that prevents the registry operator from silently rewriting history. By utilizing Openclaw Skills, users can verify that a skill's audit trail is append-only and cryptographically sound.
At its core, the skill empowers developers to distinguish between a registry's internal claims and externally verifiable facts. It functions similarly to Certificate Transparency logs in the TLS world, making every modification detectable by third parties. This ensures that any attempt to backdate a signature or introduce a malicious version without an auditable record is surfaced immediately.
Transparency Log Auditor Use Cases
- Auditing a skill registry to determine if it maintains a public transparency log.
- Detecting unauthorized or suspicious key rotations in a skill's lifecycle.
- Verifying that two different registries provide consistent signing histories for the same skill.
- Identifying risks associated with skills that lack independent verifiability paths.
- Strengthening the security posture of an Openclaw Skills deployment by ensuring immutable provenance.
How Transparency Log Auditor Works
- The auditor receives a skill identifier, registry URL, or multiple registry records as input.
- It attempts to connect to the registry's transparency log endpoint and verifies its public accessibility.
- The skill checks the log's cryptographic properties to confirm it is append-only and prevents history modification.
- It compares the internal signing records of the skill against the entries in the transparency log.
- If multiple registries are provided, it performs a cross-check to identify any divergent histories.
- Finally, it produces a detailed audit report with a coverage verdict and recommended security actions.
Transparency Log Auditor Setup
To use the Transparency Log Auditor, ensure your environment meets the following requirements:
# Install required system binaries
sudo apt-get update && sudo apt-get install curl python3
Within the Openclaw Skills framework, no additional environment variables are needed for basic auditing functionality. Simply provide the skill or registry target to start the audit process.
Transparency Log Auditor Data Schema & Taxonomy
The skill generates a structured audit report based on the following dimensions:
| Attribute | Description |
|---|---|
| Log Infrastructure | Status of the transparency log endpoint (Exists, Partial, or Absent) |
| Append-Only Verifiability | Assessment of the log's cryptographic immutability |
| Signing Events | Historical record of versions, signing keys, and timestamps |
| Cross-Registry Consistency | Detection of differences between mirror registries |
| Coverage Verdict | A classification of trust: FULL, PARTIAL, REGISTRY-ONLY, or ABSENT |
| Risk Assessment | A high-level threat level based on the audit findings |
Transparency Log Auditor Advanced Features
- Multi-registry synchronization checks to ensure global consistency of skill records.
- Deep integration with other Openclaw Skills such as the attestation-chain-auditor.
- Identification of specific forks in a registry's history through independent verification paths.
- Detailed fallback analysis for registries that do not yet support full transparency logs.
SKILL.md
Loading
Related Openclaw Skills
Supply Chain Poison Detector
A security-focused scanner designed to identify malicious code and supply chain attacks hidden within AI agent marketplace skills.
Social Trust Manipulation Detector
A specialized security tool for identifying manufactured reputation and coordinated social manipulation within AI agent marketplaces.
Skill Update Delta Monitor
A security-focused monitor that detects permission expansions, network endpoint additions, and behavioral drift in AI skills after their initial audit.
Dependency Chain Auditor
A specialized security tool designed to map and audit the hidden transitive dependency chains that direct auditing often misses.
Trust Decay Monitor
The Trust Decay Monitor tracks the freshness of skill verification results to identify certifications that are no longer valid due to time or ecosystem changes.
Trust Velocity Calculator
A sophisticated tool that quantifies the decay of agent reliability by measuring the intersection of elapsed time and the velocity of technical changes.
Featured*
