Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Added a homepage link to the skill metadata, pointing to the GitHub repository. - No other changes made to functionality or documentation.
What This Skill Does
SkillGate runs supply-chain governance scans against an OpenClaw skills directory. It detects risky patterns across installed skills, generates evidence files, and can quarantine or restore individual skills based on severity. No tokens or external accounts are needed.
It uses a pinned npx invocation instead of a global install, so the governance tool itself does not introduce the supply-chain risk it is designed to catch.
When to use it
- Scanning a skills directory before deploying to a shared workspace
- Quarantining a skill flagged for shell injection patterns
- Reviewing evidence JSON to understand why a specific skill was flagged
- Restoring a previously quarantined skill after remediation
- Auditing skill risk levels in a CI step before merging new skills
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Check my skills directory for supply-chain risks and quarantine anything critical
- 1Run /gov scan to scan all skills at HIGH+ severity
- 2Review findings grouped by risk level (CRITICAL, HIGH, MEDIUM)
- 3Run /gov explain <skillKey> on a flagged skill to read the evidence
- 4Run /gov quarantine <skillKey> on any CRITICAL-rated skill
- 5Run /gov status to confirm current governance state
Evidence files written under .skillgate/; critical skill moved to quarantine; status report listing disabled and quarantined skills