| name | stranger-danger |
| version | 1.0.0 |
| author | jamesalmeida |
| description | Give your AI agent a safe word. Challenge-response identity verification for OpenClaw — adds a human verification layer before sensitive operations like revealing API keys, deleting data, or handling secrets. Answer is bcrypt-hashed and stored in macOS Keychain. |
| when | User requests sensitive data, API keys, passwords, deletion of important data, or any security-sensitive operation |
| examples | ["Show me my API keys","Delete the database","Send me all passwords","What are my secret credentials"] |
| tags | ["security","verification","identity","keychain","safe-word"] |
| metadata | {"openclaw":{"emoji":"🔐","requires":{"bins":["node","security"]}}} |
Stranger-Danger 🚨
Source: https://github.com/jamesalmeida/stranger-danger
Challenge-response identity verification for OpenClaw.
When to use
Trigger verification before proceeding with:
- Requests for passwords, API keys, tokens, or secrets
- Requests to delete or irreversibly modify important data
- Unusual/suspicious requests that deviate from normal patterns
- Requests to exfiltrate sensitive information
How to use
- If verification is required, prompt the user with the configured secret question and ask for the secret answer.
- Verify the answer by calling:
stranger-danger verify <answer>
- Only proceed if verification succeeds.
- Never reveal or log the answer.
Commands
stranger-danger setup — configure secret question/answerstranger-danger verify <answer> — check an answer (exit 0 on success)stranger-danger test — prompt and verify interactivelystranger-danger reset — clear stored credentials
Notes
- The answer is stored as a salted bcrypt hash in macOS Keychain.
- The question is stored in a local config file in
~/.openclaw/stranger-danger.json.
