Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Detects divergence between an agent skill's declared behavior and what it actually does at runtime. Runs the skill across controlled environments and compares capability boundaries, data flows, and side effects against its attestation. Catches conditional activation patterns, like credential harvesting that only triggers when cloud environment variables are present, that static analysis cannot see.
Static analysis can only inspect what code declares, not what it does when specific conditions are met at runtime, making dynamic execution comparison the only reliable way to catch environment-triggered payload activation.
When to use it
- Auditing a third-party skill before deploying to a production environment
- Checking whether a skill behaves differently when AWS credentials are present
- Verifying that a skill keeps data local as its attestation claims
- Comparing skill behavior across minimal and staging environments
- Flagging undeclared file system or network access during execution
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Probe the report-generator skill against its v1.2 attestation across three environments
- 1Executes the skill in minimal, staging, and production-like environments with 50 samples each
- 2Records all file system paths accessed, network connections made, and system calls issued
- 3Compares observed capability boundaries against the declared scope in the attestation
- 4Diffs behavior across environments to detect conditional triggers
- 5Calculates an attestation drift score and issues a verdict: COMPLIANT, DRIFT, VIOLATION, or CONDITIONAL_ACTIVATION
Runtime attestation report showing undeclared AWS credential reads and external POST requests triggered only when AWS_DEFAULT_REGION is set, drift score 73/100, verdict: CONDITIONAL_ACTIVATION