A supply chain security extension for Claude Code that intercepts and validates package installations to prevent malicious code execution.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install yeeth-claw
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install yeeth-claw using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is yeeth-claw: Supply Chain Security Hook?
yeeth-claw is a specialized security hook designed to safeguard developers using Claude Code from supply chain vulnerabilities. As a key component of the Openclaw Skills ecosystem, it acts as a gatekeeper for package managers including npm, pip, yarn, pnpm, and cargo. By intercepting installation commands before execution, it provides a critical layer of defense against malicious dependencies.
The tool focuses on identifying high-risk signals such as extremely new packages, typosquatting attempts targeting popular libraries, and the presence of suspicious post-install scripts. This proactive approach ensures that AI agents do not accidentally introduce vulnerabilities into your local environment or production codebase.
yeeth-claw: Supply Chain Security Hook Use Cases
- Preventing typosquatting attacks where an AI agent might suggest a package with a name similar to a popular library.
- Blocking the installation of packages published within the last 7 days to mitigate zero-day supply chain threats.
- Automatically auditing dependencies by sending high-risk packages to external analysis APIs.
- Enforcing security guardrails in autonomous coding environments to prevent unauthorized code execution via install scripts.
How yeeth-claw: Supply Chain Security Hook Works
- The hook registers as a PreToolUse listener for Bash commands within the Claude Code environment.
- When a command like
npm installorpip installis issued, the Openclaw Skills hook intercepts the request. - The Python-based logic calculates the Levenshtein distance against a database of ~100 high-value targets per ecosystem to detect typosquatting.
- It checks the package metadata for age; packages less than 30 days old trigger a warning, while those less than 7 days old trigger a block.
- Based on the risk tier, the script returns a specific exit code (1 for warning, 2 for blocking) to Claude Code.
- If a block occurs and the Argus API is configured, the package is submitted for a comprehensive static analysis.
yeeth-claw: Supply Chain Security Hook Setup
To install the security hook, run the following commands in your terminal:
git clone https://github.com/yeeth-security/yeeth-claw.git
cd yeeth-claw/hooks/openclaw
bash install.sh
Ensure that you have Python 3.8+ installed. After the installation script completes, restart Claude Code for the security hooks to be active in your Openclaw Skills workflow.
yeeth-claw: Supply Chain Security Hook Data Schema & Taxonomy
The hook organizes its security logic and data based on the following risk classification system:
| Tier | Condition | System Action |
|---|---|---|
| WARN | Age < 30 days or typosquat score ≥ 0.65 | Exit code 1 (Non-blocking alert) |
| BLOCK | Age < 7 days or typosquat score ≥ 0.85 | Exit code 2 (Blocks execution) |
| ARGUS | BLOCK tier hit + API configured | Exit code 2 + Full static analysis upload |
Environment variables for integration:
OPENCLAW_ARGUS_URL: The endpoint for your Argus analysis service.OPENCLAW_ARGUS_KEY: Your authenticated API key for security reporting.
yeeth-claw: Supply Chain Security Hook Advanced Features
- Multi-Ecosystem Support: Comprehensive coverage for npm (JavaScript), PyPI (Python), and Crates.io (Rust).
- Argus API Integration: Automated submission of blocked packages for deep static analysis and forensics.
- Zero-Dependency Core: The script utilizes only the Python standard library, ensuring it runs in restricted environments without side effects.
- Intelligent Risk Tiering: Granular control over what constitutes a warning versus a hard block based on package age and linguistic similarity to trusted sources.
SKILL.md
Loading
Related Openclaw Skills
Excellent AI Employee Framework
A sophisticated architecture for AI agents that integrates goal-driven closed loops, dynamic planning, and multi-tool orchestration to deliver professional-grade results.
Michael Jackson Information Skill
A comprehensive data repository providing biographical details, discography, and award history for Michael Jackson.
University of Oxford Knowledge Assistant
A specialized knowledge module providing deep insights into the 900-year history, academic structure, and global influence of the University of Oxford.
Pizza Hut Knowledge Base Skill
A specialized knowledge skill providing structured corporate history, operational metrics, and strategic insights for Pizza Hut within the AI ecosystem.
NASA Space Exploration Guide
An authoritative technical resource for exploring NASA mission data, space exploration history, and astronomical research.
Amazfit Health Log
Automatically syncs Amazfit GTR3 health metrics from HCGateway into structured daily Obsidian notes.
Featured*
