openclaw-sentinel
// Supply chain security scanner for agent skills. Detects obfuscated code, known-bad signatures, suspicious install behaviors, dependency confusion, and metadata inconsistencies — before and after installation.
OpenClaw Sentinel
Supply chain security scanner for agent skills. Detects obfuscated code, known-bad signatures, suspicious install behaviors, dependency confusion, and metadata inconsistencies — before and after installation.
The Problem
You install skills from the community. Any skill can contain obfuscated payloads, post-install hooks that execute arbitrary code, or supply chain attacks that modify other skills in your workspace. Existing tools verify file integrity after the fact — nothing inspects skills for supply chain risks before they run.
Commands
Scan Installed Skills
Deep scan of all installed skills for supply chain risks. Checks file hashes against a local threat database, detects obfuscated code patterns, suspicious install behaviors, dependency confusion, and metadata inconsistencies. Generates a risk score (0-100) per skill.
python3 {baseDir}/scripts/sentinel.py scan --workspace /path/to/workspace
Scan a Single Skill
python3 {baseDir}/scripts/sentinel.py scan openclaw-warden --workspace /path/to/workspace
Pre-Install Inspection
Scan a skill directory BEFORE copying it to your workspace. Outputs a SAFE/REVIEW/REJECT recommendation and shows exactly what binaries, network calls, and file operations the skill will perform.
python3 {baseDir}/scripts/sentinel.py inspect /path/to/skill-directory
Manage Threat Database
View current threat database statistics.
python3 {baseDir}/scripts/sentinel.py threats --workspace /path/to/workspace
Import a community-shared threat list.
python3 {baseDir}/scripts/sentinel.py threats --update-from threats.json --workspace /path/to/workspace
Quick Status
Summary of installed skills, scan history, and risk score overview.
python3 {baseDir}/scripts/sentinel.py status --workspace /path/to/workspace
Workspace Auto-Detection
If --workspace is omitted, the script tries:
OPENCLAW_WORKSPACEenvironment variable- Current directory (if AGENTS.md exists)
~/.openclaw/workspace(default)
What It Detects
| Category | Patterns |
|---|---|
| Encoded Execution | eval(base64.b64decode(...)), exec(compile(...)), eval/exec with encoded strings |
| Dynamic Imports | __import__('os').system(...), dynamic subprocess/ctypes imports |
| Shell Injection | subprocess.Popen with shell=True + string concatenation, os.system() |
| Remote Code Exec | urllib/requests combined with exec/eval — download-and-run patterns |
| Obfuscation | Lines >1000 chars, high-entropy strings, minified code blocks |
| Install Behaviors | Post-install hooks, auto-exec in __init__.py, cross-skill file writes |
| Hidden Files | Non-standard dotfiles and hidden directories |
| Dependency Confusion | Skills shadowing popular package names, typosquatting near-matches |
| Metadata Mismatch | Undeclared binaries, undeclared env vars, invocable flag inconsistencies |
| Serialization | pickle.loads, marshal.loads — arbitrary code execution via deserialization |
| Known-Bad Hashes | File SHA-256 matches against local threat database |
Risk Scoring
Each skill receives a score from 0-100:
| Score | Label | Meaning |
|---|---|---|
| 0 | CLEAN | No issues detected |
| 1-19 | LOW | Minor findings, likely benign |
| 20-49 | MODERATE | Review recommended |
| 50-74 | HIGH | Significant risk, review required |
| 75-100 | CRITICAL | Serious supply chain risk |
Threat Database Format
Community-shared threat lists use this JSON format:
{
"hashes": {
"<sha256hex>": {"name": "...", "severity": "...", "description": "..."}
},
"patterns": [
{"name": "...", "regex": "...", "severity": "..."}
]
}
Exit Codes
0— Clean, no issues1— Review needed2— Threats detected
No External Dependencies
Python standard library only. No pip install. No network calls. Everything runs locally.
Cross-Platform
Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.