Trust Verifier

通过 Python 命令行脚本检查技能目录的发布者信誉、版本一致性、内容哈希与依赖信任链，给出 VERIFIED/TRUSTED/UNKNOWN/SUSPICIOUS/UNTRUSTED 信任等级，并可生成或验证 trust.json 信任证明。

Trypto1019

热度 85.74

最近更新 2026-04-29 12:01:24

分类：安全依赖：代码执行 / 读写文件应用场景：报告撰写 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add arc-trust-verifier

Metadata

name: trust-verifier
description: Verify skill provenance and build trust scores for ClawHub skills. Checks publisher history, version consistency, dependency trust chains, and generates trust attestations.
user-invocable: true
metadata: {"openclaw":{"emoji":"🔑","os":["darwin","linux"],"requires":{"bins":["python3"]}}}

Trust Verifier

Trust, but verify. Assess the trustworthiness of a ClawHub skill by analyzing its publisher, history, dependencies, and consistency.

Why This Exists

Security scanning catches known malicious patterns. But what about skills that are technically clean but published by unknown authors, have inconsistent version histories, or depend on untrusted packages? Trust Verifier fills the gap between "no vulnerabilities detected" and "safe to install."

Commands

Assess trust for a skill directory

python3 {baseDir}/scripts/trust_verifier.py assess --path ~/.openclaw/skills/some-skill/

Generate a trust attestation

python3 {baseDir}/scripts/trust_verifier.py attest --path ~/.openclaw/skills/some-skill/ --output trust.json

Verify an existing attestation

python3 {baseDir}/scripts/trust_verifier.py verify --attestation trust.json --path ~/.openclaw/skills/some-skill/

Check dependency trust chain

python3 {baseDir}/scripts/trust_verifier.py deps --path ~/.openclaw/skills/some-skill/

Trust Signals

Publisher reputation: Known vs unknown publisher, account age, skill count
Version consistency: Do updates match expected patterns? Sudden permission changes?
Content integrity: SHA-256 hashes of all files, reproducible builds
Dependency chain: Are dependencies from trusted sources?
Community signals: Moltbook mentions, upvotes, known endorsements

Trust Levels

VERIFIED — Meets all trust criteria, attestation valid
TRUSTED — Most signals positive, minor gaps
UNKNOWN — Insufficient data to assess trust
SUSPICIOUS — One or more trust signals failed
UNTRUSTED — Multiple trust failures, do not install