Safe Install - Secure Skill Installer

A safer way to install OpenClaw Skills.

Why Safe Install?

The default clawhub install trusts all Skills equally. Safe Install adds a security layer:

# Instead of this:
clawhub install some-skill

# Do this:
npx safe-install some-skill

How It Works

1. Download - Fetch Skill from ClawHub
2. Scan - Run security analysis (via Skill Sentinel / ClawShield)
3. Decide - Based on risk level:
   • 🟢 Safe → Install immediately
   • 🟡 Caution → Show warning, ask confirmation
   • 🔴 Avoid → Block installation (require --force)
4. Fingerprint - Save installation record for audit

Policy Configuration

{
  "defaultAction": "prompt",
  "blockedPatterns": ["curl|sh", "eval("],
  "allowedSources": ["verified-authors"],
  "requireSignature": false
}

Installation Fingerprint

Every installation gets a unique fingerprint:

Install: some-skill@v1.2.3
Hash: a1b2c3d4...
Risk: Safe
Time: 2026-02-23T10:00:00Z
Policy: default

Rollback

# See installation history
safe-install history

# Rollback to previous version
safe-install rollback some-skill