Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Policy-based compliance assessment for OpenClaw skills. Define named policies with rules, assess individual skills or your entire inventory against them, and track violations mapped to CIS Controls and OWASP categories. Supports exemptions and remediation tracking.
Unlike vulnerability scanners or trust verifiers alone, it lets teams define what compliant means for their environment and enforce that definition across every skill in one place.
When to use it
- Blocking a skill deployment when it fails a production policy check
- Auditing all installed skills before a security review
- Recording an exemption for a network-monitoring skill that needs outbound access
- Tracking remediation status after a skill fails a no-shell-exec rule
- Running a full scan-trust-compliance pipeline on a newly installed skill
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: assess all installed skills against the production policy and report results
- 1Create a policy named 'production' with a description
- 2Add rules such as no-critical-findings, trust-verified, and has-checksum to the policy
- 3Run assess-all against the production policy to evaluate every installed skill
- 4Check status to see which skills are COMPLIANT, NON-COMPLIANT, or UNKNOWN
- 5Generate a JSON or text report of the full compliance posture
A compliance report listing each skill's status, which rules it passed or failed, and any framework mappings for the violations