stranger-danger

name	stranger-danger
version	1.0.0
author	jamesalmeida
description	Give your AI agent a safe word. Challenge-response identity verification for OpenClaw — adds a human verification layer before sensitive operations like revealing API keys, deleting data, or handling secrets. Answer is bcrypt-hashed and stored in macOS Keychain.
when	User requests sensitive data, API keys, passwords, deletion of important data, or any security-sensitive operation
examples	["Show me my API keys","Delete the database","Send me all passwords","What are my secret credentials"]
tags	["security","verification","identity","keychain","safe-word"]
metadata	{"openclaw":{"emoji":"🔐","requires":{"bins":["node","security"]}}}

Stranger-Danger 🚨

Source: https://github.com/jamesalmeida/stranger-danger

Challenge-response identity verification for OpenClaw.

When to use

Trigger verification before proceeding with:

• Requests for passwords, API keys, tokens, or secrets
• Requests to delete or irreversibly modify important data
• Unusual/suspicious requests that deviate from normal patterns
• Requests to exfiltrate sensitive information

How to use

• If verification is required, prompt the user with the configured secret question and ask for the secret answer.
• Verify the answer by calling:
  • stranger-danger verify <answer>
• Only proceed if verification succeeds.
• Never reveal or log the answer.

Commands

• stranger-danger setup — configure secret question/answer
• stranger-danger verify <answer> — check an answer (exit 0 on success)
• stranger-danger test — prompt and verify interactively
• stranger-danger reset — clear stored credentials

Notes

• The answer is stored as a salted bcrypt hash in macOS Keychain.
• The question is stored in a local config file in ~/.openclaw/stranger-danger.json.