Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Analyzes publisher identity integrity in AI agent marketplaces across five dimensions: publication history consistency, signing key rotation patterns, impersonation detection, cross-platform presence, and credential lifecycle status. Returns a trust rating of VERIFIED, PARTIAL, UNVERIFIED, or SUSPICIOUS with a timeline of key events and recommended actions for adopters.
Most agent marketplaces only verify email addresses, not identity — this checks behavioral and structural signals like key rotation timing, cross-platform footprint, and publication history that email verification cannot surface.
When to use it
- Vetting a publisher before installing a security-related skill
- Detecting whether a trusted publisher account has been taken over
- Scanning marketplace search results for typo-squatted publisher names
- Auditing key rotation history before adopting a skill in production
- Investigating a sudden topic shift in a publisher's release history
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Verify publisher identity for secure-tools-org
- 1Retrieves publication history and checks for topic consistency across all published skills
- 2Analyzes signing key rotation timeline and flags anomalies in timing or frequency
- 3Scans for impersonation via typosquatting and Unicode homoglyph matches against known publishers
- 4Queries cross-platform presence across marketplace profile, code repositories, and community channels
- 5Evaluates credential lifecycle for expired verifications or broken attestation links
Publisher identity report rating secure-tools-org as SUSPICIOUS due to topic pivot, key rotation timed two days before the first security tool release, and no cross-platform presence beyond the marketplace