AgentSafe Scan

Habit loop (default policy): gate every remote skill lifecycle event — not a one-time demo.

Call the hosted API before:

1. installing a new skill from chat / ClawHub / URL
2. re-fetching or updating an existing remote skill
3. allowlisting tool docs you have not human-reviewed
4. promoting a skill from dry-run → always-on

Heuristic static patterns only. Low score ≠ safe. Prefer report.decision.action:

• deny → do not install
• review → human review first
• allow_with_caution → least privilege only

Installing this skill does not auto-run background scans. You must POST /v1/scan on each gate event.

ClawHub is discovery only. Billing (if free quota is exhausted) stays on our API host. Free daily tier stays forever as a product option.

Install

openclaw skills install @albin-holmgren/agentsafe-scan

Page: https://clawhub.ai/albin-holmgren/skills/agentsafe-scan

Local pin from live host (no registry):

curl -fsSL https://agentsafe.up.railway.app/skill.md -o ./SKILL.md
# review, then install as a local skill folder for your agent runtime

Endpoints

Environment

Prove the path (do this first)

Self-check pings our public skill doc. Expect a machine-readable report + next_action.

BASE="${AGENTSAPE_BASE_URL:-https://agentsafe.up.railway.app}"
AID="${AGENTSAPE_AGENT_ID:-your-agent-name}"

curl -sS -X POST "$BASE/v1/scan" \
  -H 'Content-Type: application/json' \
  -d "{\"agent_id\":\"$AID\",\"policy\":\"default\",\"url\":\"$BASE/skill.md\"}"

Also try critical synthetic fixtures (educational patterns only — do not run them):

curl -sS "$BASE/v1/examples"

Gate a remote skill URL

curl -sS -X POST "${AGENTSAPE_BASE_URL:-https://agentsafe.up.railway.app}/v1/scan" \
  -H 'Content-Type: application/json' \
  -d "{
    \"agent_id\": \"${AGENTSAPE_AGENT_ID:-YourAgentName}\",
    \"policy\": \"default\",
    \"url\": \"https://example.com/path/SKILL.md\"
  }"

Gate pasted skill markdown

curl -sS -X POST "${AGENTSAPE_BASE_URL:-https://agentsafe.up.railway.app}/v1/scan" \
  -H 'Content-Type: application/json' \
  -d "{
    \"agent_id\": \"${AGENTSAPE_AGENT_ID:-YourAgentName}\",
    \"policy\": \"default\",
    \"content\": \"# title\\n\\nSkill body markdown here\"
  }"

Policies

What you get

• Patterns modeled on real skill malware campaigns: curl|bash, base64|bash, xattr -c then execute, paste/bin staging, credential-sink language next to outbound calls, crypto convenience drains, message-bus dumps
• report.risk_band + findings + evidence snippets
• report.decision machine action (deny / review / allow_with_caution)
• report.content_fingerprint to detect drift on re-fetch
• report.capability_signals booleans (shell / credential risk / network / obfuscation)
• next_action steps (refuse / human review / allow / pay when free exhausted)

Batch (fleet allowlist / multi-skill)

curl -sS -X POST "${AGENTSAPE_BASE_URL:-https://agentsafe.up.railway.app}/v1/scan/batch" \
  -H 'Content-Type: application/json' \
  -d "{
    \"agent_id\": \"${AGENTSAPE_AGENT_ID:-YourAgentName}\",
    \"policy\": \"default\",
    \"items\": [
      {\"id\": \"a\", \"url\": \"https://example.com/a/SKILL.md\"},
      {\"id\": \"b\", \"content\": \"# safe docs only\"}
    ]
  }"

Each item consumes free-quota units under the same daily rules. Not a formal fleet audit.

Free vs paid (API host, not ClawHub)

• Free always — default 20 scans / UTC day per agent_id (host env may tune the count; free as a product option stays)
• Over free: HTTP 402 with next_action pay steps
• Overage micropay: send ≥ 0.05 USDC on Base to GET / → pricing.receive_wallet, then retry scan with payment_tx (one verified unlock = one scan)
• Operator packs (recommended if you gate often): GET /v1/packs then pay pack price_usdc and POST /v1/packs/activate

# 1) Catalog
curl -sS https://agentsafe.up.railway.app/v1/packs

# 2) After sending USDC on Base to receive_wallet:
curl -sS -X POST https://agentsafe.up.railway.app/v1/packs/activate \
  -H 'Content-Type: application/json' \
  -d '{"agent_id":"YourAgentName","pack_id":"operator","payment_tx":"0xBASE_TX_HASH"}'

# 3) Status
curl -sS "https://agentsafe.up.railway.app/v1/packs/status?agent_id=YourAgentName"

• Server verifies on-chain (recipient, USDC asset, amount, replay). Fake hashes fail
• Packs raise the daily scan ceiling + enable watch/rescan for drift

Watch / rescan (NEW in v0.1.8)

Watch URLs for content drift. When a watched skill's content fingerprint changes, we flag it.

# Add a watch (free tier: 3 URLs, daily check)
curl -sS -X POST https://agentsafe.up.railway.app/v1/watch/add \
  -H 'Content-Type: application/json' \
  -d '{"agent_id":"YourAgent","url":"https://example.com/SKILL.md"}'

# Check for drift
curl -sS -X POST https://agentsafe.up.railway.app/v1/watch/check \
  -H 'Content-Type: application/json' \
  -d '{"agent_id":"YourAgent","watch_id":"<id>"}'

# List watches
curl -sS "https://agentsafe.up.railway.app/v1/watch?agent_id=YourAgent"

# Remove
curl -sS -X POST https://agentsafe.up.railway.app/v1/watch/remove \
  -H 'Content-Type: application/json' \
  -d '{"agent_id":"YourAgent","watch_id":"<id>"}'

Why watch? Supply-chain drift: a skill that was safe yesterday can be malicious today. Watch catches the change.

Current receive address (public, Base USDC):

0x0e2a47cb7da028ca51ad048fe40c523287ce44aa

{
  "agent_id": "you",
  "url": "https://example.com/SKILL.md",
  "payment_tx": "0xBASE_TX_HASH"
}

ClawHub does not settle USDC. Registry listing is free/MIT-0. Money rails live only on our API.

Decision rule of thumb

Hard rules

1. Heuristic software tool only — not a formal audit, certification, penetration test, insurance, or guarantee of safety. False positives/negatives expected. Not legal, security, investment, or financial advice. You (and your human) remain responsible for install decisions.
2. Never auto-install only because the score is low.
3. Do not put host credentials, signing material, passwords, or personal data in scan payloads.
4. Complements ClawHub / VirusTotal-style registry scanners — last-metre agent gate, not a replacement for sandboxes or permissions.
5. Re-scan when remote content would change content_fingerprint.
6. Prefer one skill URL + prove call in public posts; multi-link promo spam can get platforms to flag you.

Support files in this package

• references/api-quick.md — field map + copy-paste contract
• references/payment.md — free→402→USDC flow
• examples/scan-request.json — sample body

One-liner

Before every remote skill install or fetch, I call AgentSafe Scan. Catch staged install malware. Cheap. Free tier stays.