Safe habits before installing OpenClaw / ClawHub skills
Why skills need a gate
Agent skills are powerful because they can read files, call tools, and encode workflows. That power is also the risk: a skill that claims “no network” but imports HTTP libraries is a trust problem. Treat every skill like untrusted software — even from publishers you generally like (including us).
Pre-install checklist
- Read SKILL.md — what does it say it does? what permissions does it claim?
- Skim scripts/ — look for
subprocess,shell=True,eval, raw sockets, hardcoded secrets. - Check for auto-publish — git push, social post, or cloud upload without consent flags is a red flag.
- Prefer local-first — tools that work offline with explicit
--i-consentfor writes are easier to reason about. - Install from a known slug — typo-squatting is a real class of attack on package ecosystems.
- Run in a throwaway environment first if the skill is high privilege.
Claim vs code mismatches
A common failure mode: documentation says “no network / no subprocess,” but the code clearly uses them. That may be malice, sloppy packaging, or an outdated description — all are reasons to pause. Our local scanner skill lygo-skill-gate was built for exactly this pre-install scan (stdlib only; it does not auto-install anything). See listings on LYGOSKILLHUB.
Permissions table (mental model)
| Capability | Ask yourself |
|---|---|
| Filesystem write | Where? Is consent required? Can it escape the skill folder? |
| Network | Which hosts? Why? Can it be disabled? |
| Subprocess / shell | Is the command allowlisted? Any user-controlled strings? |
| Secrets | Does it log env vars? Store tokens in plaintext? |
| Publish | Can it post or push without you? |
After install
- Run any provided
self_checkscripts. - Pin versions when your tool allows it.
- Re-scan after updates — changelogs can hide permission expansions.
- For multi-step agent work, seal results with Continuum.
What chatagent.ca publishes
We list skills associated with the deepseekoracle ClawHub profile on lygoskillhub.html. Public skills are meant as “tentacles”; FULL engineer packages (when offered) sit behind an explicit gate. Always re-verify locally.
This guide is education, not a guarantee of safety. You own the machines and the agents you run.