Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
arc-trust-verifier 1.1.0 - Updated scripts/trust_verifier.py with new changes. - No updates to documentation or user-facing commands. - Core functionality and trust criteria remain unchanged.
What This Skill Does
Assesses the trustworthiness of a ClawHub skill by analyzing publisher reputation, version consistency, content integrity, and dependency chains. Produces trust scores across five levels from VERIFIED to UNTRUSTED. Generates and verifies signed attestations that can be stored or audited.
Unlike security scanners that only detect known malicious patterns, this tool evaluates publisher reputation, version consistency, and dependency chains to surface trust issues that clean scans miss.
When to use it
- Checking if a skill from an unknown publisher is safe to install
- Auditing dependency chains before deploying a skill to a shared environment
- Generating a trust attestation for a skill before distributing it to teammates
- Detecting unexpected permission changes between skill versions
- Verifying a previously issued attestation after a skill receives an update
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: assess trust for a newly downloaded skill at ~/.openclaw/skills/some-skill/
- 1Run trust assessment against the skill directory
- 2Evaluate publisher reputation, version history, SHA-256 content hashes, and dependency chain
- 3Assign a trust level from VERIFIED to UNTRUSTED based on signal results
- 4Generate a trust.json attestation capturing findings and checksums
Trust level report with a per-signal breakdown and a signed trust.json attestation file