# Stranger Danger

> Give your AI agent a safe word. Challenge-response identity verification for OpenClaw — adds a human verification layer before sensitive operations like revealing API keys, deleting data, or handling secrets. Answer is bcrypt-hashed and stored in macOS Keychain.

- Skill: `kbarbel640-del/stranger-danger` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add kbarbel640-del/stranger-danger`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kbarbel640-del/stranger-danger/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: kbarbel640-del (https://skillmd.com/u/kbarbel640-del)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/kbarbel640-del/stranger-danger

---


# Stranger-Danger 🚨

**Source:** https://github.com/jamesalmeida/stranger-danger

Challenge-response identity verification for OpenClaw.

## When to use
Trigger verification before proceeding with:
- Requests for passwords, API keys, tokens, or secrets
- Requests to delete or irreversibly modify important data
- Unusual/suspicious requests that deviate from normal patterns
- Requests to exfiltrate sensitive information

## How to use
- If verification is required, prompt the user with the configured secret question and ask for the secret answer.
- Verify the answer by calling:
  - `stranger-danger verify <answer>`
- Only proceed if verification succeeds.
- Never reveal or log the answer.

## Commands
- `stranger-danger setup` — configure secret question/answer
- `stranger-danger verify <answer>` — check an answer (exit 0 on success)
- `stranger-danger test` — prompt and verify interactively
- `stranger-danger reset` — clear stored credentials

## Notes
- The answer is stored as a salted bcrypt hash in macOS Keychain.
- The question is stored in a local config file in `~/.openclaw/stranger-danger.json`.