openclaw-signet-pro

# OpenClaw Signet Pro Everything in [openclaw-signet](https://github.com/AtlasPA/openclaw-signet) (free) plus automated countermeasures. **Free version alerts. Pro version subverts, quarantines, and defends.** ## Detection Commands (also in free) ### Sign Skills Generate SHA-256 content hashes for all installed skills and store in trust manifest. ```bash python3 {baseDir}/scripts/signet.py sign --workspace /path/to/workspace ``` ### Sign Single Skill ```bash python3 {baseDir}/scripts/signet.py sign openclaw-warden --workspace /path/to/workspace ``` ### Verify Skills Compare current skill state against trusted signatures. Reports exactly which files were modified, added, or removed. ```bash python3 {baseDir}/scripts/signet.py verify --workspace /path/to/workspace ``` ### Verify Single Skill ```bash python3 {baseDir}/scripts/signet.py verify openclaw-warden --workspace /path/to/workspace ``` ### List Signed Skills Display the trust manifest with hashes, file counts, and quarantined skills. ```bash python3 {baseDir}/scripts/signet.py list --workspace /path/to/workspace ``` ### Quick Status One-line health check: verified, tampered, unsigned, quarantined counts. ```bash python3 {baseDir}/scripts/signet.py status --workspace /path/to/workspace ``` ## Pro Countermeasures ### Reject Unsigned Skills Remove unsigned skills from the workspace. Moves them to `.quarantine/signet/` with metadata recording why they were rejected. ```bash # Reject all unsigned skills python3 {baseDir}/scripts/signet.py reject --workspace /path/to/workspace # Reject a specific unsigned skill python3 {baseDir}/scripts/signet.py reject untrusted-skill --workspace /path/to/workspace ``` ### Quarantine a Tampered Skill Disable a skill by renaming its directory with a `.quarantined-` prefix so the agent will not load it. Records tampering evidence (expected vs actual hashes, changed files) in `.quarantine/signet/{skill}-evidence.json`. ```bash python3 {baseDir}/scripts/signet.py quarantine bad-skill --workspace /path/to/workspace ``` ### Unquarantine a Skill Restore a quarantined skill to its original name. Warns that it should be re-signed before trusting. ```bash python3 {baseDir}/scripts/signet.py unquarantine bad-skill --workspace /path/to/workspace ``` ### Snapshot a Verified Skill Create a trusted backup of a signed skill. Only succeeds if the skill currently passes verification (hash matches manifest). Snapshots are stored in `.signet/snapshots/{skill}/`. ```bash python3 {baseDir}/scripts/signet.py snapshot openclaw-warden --workspace /path/to/workspace ``` ### Restore from Snapshot Restore a skill from its trusted snapshot. Verifies snapshot integrity before restoring. Updates the trust manifest to match the restored state. ```bash python3 {baseDir}/scripts/signet.py restore openclaw-warden --workspace /path/to/workspace ``` ### Protect (Automated Sweep) Full automated protection sweep. Recommended for session startup. 1. Verify all skills against the trust manifest 2. Auto-quarantine tampered skills (with evidence) 3. Optionally reject unsigned skills (`--reject-unsigned` flag, off by default) 4. Create/update snapshots of all verified skills ```bash # Standard protection (quarantine tampered, snapshot clean) python3 {baseDir}/scripts/signet.py protect --workspace /path/to/workspace # Strict protection (also reject unsigned skills) python3 {baseDir}/scripts/signet.py protect --reject-unsigned --workspace /path/to/workspace ``` ## Recommended Integration ### Session Startup Hook (Claude Code) ```json { "hooks": { "SessionStart": [ { "hooks": [ { "type": "command", "command": "python3 scripts/signet.py protect", "timeout": 30 } ] } ] } } ``` ### Heartbeat (OpenClaw) Add to HEARTBEAT.md for periodic protection: ``` - Run skill signature protection (python3 {skill:openclaw-signet-pro}/scripts/signet.py protect) ``` ## Countermeasure Summary | Command | Action | |---------|--------| | `protect` | Full sweep: verify + quarantine tampered + snapshot clean | | `protect --reject-unsigned` | Full sweep + reject unsigned skills | | `reject [skill]` | Remove unsigned skills to quarantine area | | `quarantine <skill>` | Disable tampered skill with evidence | | `unquarantine <skill>` | Restore quarantined skill (re-sign recommended) | | `snapshot <skill>` | Create trusted backup of verified skill | | `restore <skill>` | Restore from trusted snapshot | ## Exit Codes - `0` -- All skills verified / action succeeded - `1` -- Unsigned skills detected / warnings - `2` -- Tampered skills detected / critical issues ## No External Dependencies Python standard library only. No pip install. No network calls. Everything runs locally. ## Cross-Platform Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.