Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Audits whether a skill registry maintains an independently verifiable transparency log for signing events. Checks the gap between a registry claiming a skill was signed and an external auditor being able to confirm it. Detects cross-registry inconsistencies that indicate signing history has been altered.
Unlike checking a registry's own internal signing records, this auditor can surface retroactive alterations because a properly implemented transparency log makes silent rewrites detectable by any external party holding an older log state.
When to use it
- Verifying a skill's signing history can be confirmed without trusting the registry
- Auditing a registry for transparency log infrastructure before relying on its skills
- Comparing signing records across two mirrors of the same skill for divergence
- Investigating whether a key rotation in a skill's version history is legitimate
- Assessing audit trail completeness before deploying an agent skill in production
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit transparency log coverage for the data-pipeline-connector skill at primary-marketplace.example
- 1Checks whether the registry exposes a public transparency log endpoint
- 2Attempts to verify the log's append-only property by inspecting chain linkage
- 3Enumerates signing events (version publishes, key rotations, revocations) and checks log coverage for each
- 4Queries available mirror registries and compares signing records for consistency
- 5Determines whether an external auditor can verify signing history without querying the registry itself
Coverage verdict of REGISTRY-ONLY with a risk rating of HIGH, a flagged cross-registry inconsistency at v1.2.0, and recommended actions including treating v1.2.0 as signed by an unverified key and pinning to the last consistently-signed version