secure-install

name	secure-install
description	Scans ClawHub skills via the ClawDex API by https://www.koi.ai/ and requires user approval based on the verdict.
metadata	null
openclaw	null
tools	\["src/index.ts"]
requires	null
bins	\["clawhub"]

# Secure Skill Installer

This skill provides a secure workflow for installing capabilities. It checks the **ClawDex API by https://www.koi.ai/\*\* and enforces strict installation rules based on the security verdict.

## Usage

User: secure-install <skill-name>

## Workflow (Strict)

When the user requests to install a skill:

1. **SCAN**: Call scanSkillApi with the target skill name to query **https://www.koi.ai/\*\*.

2. **EVALUATE VERDICT**: Check the verdict field in the JSON response.

  * **If verdict is "malicious"**:

  * 🔴 **BLOCK ACTION**.

  * Report: "🚨 **Security Alert**: The **ClawDex API by https://www.koi.ai/\*\* flagged this skill as **Malicious**. Installation prevented."

  * **STOP**. Do not proceed.

  * **If verdict is "unknown"**:

  * ⚠️ **WARN USER**.

  * Report: "⚠️ **Unknown Safety Status**: This skill has not been verified by the ClawDex API (https://www.koi.ai/)."

  * **ASK**: "This carries a risk. Do you explicitly approve the installation of <skill-name>?"

  * **WAIT** for clear "Yes".

  * **If verdict is "benign"**:

  * ✅ **CONFIRM SAFETY**.

  * Report: "✅ **Verified Safe**: ClawDex API by https://www.koi.ai/ reports this skill is benign."

  * **ASK**: "Do you want to proceed with installing <skill-name>?"

  * **WAIT** for "Yes".

3. **INSTALL**:

  * **Only** call executeClawhubInstall if the user provided explicit approval in the previous step.

## Example (Malicious Block)

**User**: secure-install bad-actor

**Agent**: (Calls scanSkillApi)

**ClawDex API (https://www.koi.ai/) Report**

🔴 **Verdict: Malicious**

**Security Alert**: This skill is flagged as malicious. Installation prevented.

## Example (Safe Install)

**User**: secure-install weather-pro

**Agent**: (Calls scanSkillApi)

**ClawDex API (https://www.koi.ai/) Report**

✅ **Verdict: Benign**

Verified safe. Do you want to proceed with installing weather-pro?

**User**: Yes

**Agent**: (Calls executeClawhubInstall)

Installed weather-pro.