Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Version 1.1.0 Summary: Adds risk-sensitive auditing, cryptographic verification, and update gating to delta disclosure checks. - Introduced risk-class binding to scale disclosure requirements with the skill's risk level. - Added chain-of-custody verification for cryptographically signed, hash-chained deltas. - Implemented update eligibility assessment—skills with incomplete, unverifiable, or high-risk disclosures may require manual review or face update suspension. - Expanded audit report outputs to include risk alignment, custody integrity, and update status. - Updated description and capabilities to reflect new audit dimensions.
What This Skill Does
Audits whether skill updates publish machine-readable records of what changed between versions. Checks five dimensions: capability declaration deltas, dependency changes, validation command modifications, behavioral scope, and delta completeness. v1.1 adds risk-class binding, cryptographic chain-of-custody verification, and update eligibility assessment.
Monitoring cost scales with what changed, not the full skill surface, so continuous security oversight becomes tractable for large registries without re-executing every version.
When to use it
- Detecting undisclosed capability changes across skill version updates
- Verifying dependency additions are declared when a skill publishes a new version
- Catching dropped test assertions omitted from changelogs
- Determining whether a skill qualifies for auto-update before enabling it
- Reconstructing what changed between two versions when no publisher delta exists
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit delta disclosure for analytics-connector v1.0 → v1.3
- 1Check the registry for structured delta infrastructure and publisher-provided changelogs
- 2Reconstruct version history by comparing each version pair
- 3Compare reconstructed diffs against published changelogs to identify omissions
- 4Assess risk-class binding and chain-of-custody integrity across the version range
- 5Issue a disclosure verdict and update eligibility recommendation
Delta disclosure report with MISLEADING verdict: changelogs claimed 'performance improvements' and 'bug fixes' while omitting an added outbound endpoint, expanded file access scope, dropped test assertions, and three undisclosed dependencies across v1.0 to v1.3