How do I install the Openclaw Signet skill?

Run npx skillmds@latest add modbender/openclaw-signet in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Openclaw Signet safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Openclaw Signet?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Openclaw Signet free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Openclaw Signet?

modbender (@modbender) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Openclaw Signet by modbender — Agent Skill

Name: Openclaw Signet
Rating: 4.5 (4 reviews)
Author: modbender

File contents

OpenClaw Signet

Cryptographic verification for installed skills. Sign skills at install time, verify they haven't been tampered with later.

The Problem

You install a skill and it works. Days later, a compromised process modifies files inside the skill directory — injecting code, altering behavior, adding exfiltration. All current defenses are heuristic (regex pattern matching). Nothing mathematically verifies that installed code is unchanged.

Commands

Sign Skills

Generate SHA-256 content hashes for all installed skills and store in trust manifest.

python3 {baseDir}/scripts/signet.py sign --workspace /path/to/workspace

Sign Single Skill

python3 {baseDir}/scripts/signet.py sign openclaw-warden --workspace /path/to/workspace

Verify Skills

Compare current skill state against trusted signatures.

python3 {baseDir}/scripts/signet.py verify --workspace /path/to/workspace

List Signed Skills

python3 {baseDir}/scripts/signet.py list --workspace /path/to/workspace

Quick Status

python3 {baseDir}/scripts/signet.py status --workspace /path/to/workspace

How It Works

sign computes SHA-256 hashes of every file in each skill directory
A composite hash represents the entire skill state
verify recomputes hashes and compares against the manifest
If any file is modified, added, or removed — the composite hash changes
Reports exactly which files changed within each tampered skill

Exit Codes

0 — All skills verified
1 — Unsigned skills detected
2 — Tampered skills detected

No External Dependencies

Python standard library only. No pip install. No network calls. Everything runs locally.

Cross-Platform

Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.

---name: openclaw-signetdescription: Cryptographic verification for installed skills. Sign skills at install time, verify they haven't been tampered with later.--- # OpenClaw Signet Cryptographic verification for installed skills. Sign skills at install time, verify they haven't been tampered with later. ## The Problem You install a skill and it works. Days later, a compromised process modifies files inside the skill directory — injecting code, altering behavior, adding exfiltration. All current defenses are heuristic (regex pattern matching). Nothing mathematically verifies that installed code is unchanged. ## Commands ### Sign Skills Generate SHA-256 content hashes for all installed skills and store in trust manifest. ```bash python3 {baseDir}/scripts/signet.py sign --workspace /path/to/workspace ``` ### Sign Single Skill ```bash python3 {baseDir}/scripts/signet.py sign openclaw-warden --workspace /path/to/workspace ``` ### Verify Skills Compare current skill state against trusted signatures. ```bash python3 {baseDir}/scripts/signet.py verify --workspace /path/to/workspace ``` ### List Signed Skills ```bash python3 {baseDir}/scripts/signet.py list --workspace /path/to/workspace ``` ### Quick Status ```bash python3 {baseDir}/scripts/signet.py status --workspace /path/to/workspace ``` ## How It Works 1. `sign` computes SHA-256 hashes of every file in each skill directory 2. A composite hash represents the entire skill state 3. `verify` recomputes hashes and compares against the manifest 4. If any file is modified, added, or removed — the composite hash changes 5. Reports exactly which files changed within each tampered skill ## Exit Codes - `0` — All skills verified - `1` — Unsigned skills detected - `2` — Tampered skills detected ## No External Dependencies Python standard library only. No pip install. No network calls. Everything runs locally. ## Cross-Platform Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.

Frequently asked questions

Openclaw Signet