clawsec-clawhub-checker

# ClawSec ClawHub Checker

Enhances the ClawSec suite's guarded skill installer with ClawHub reputation checks. Adds a second layer of security by checking VirusTotal Code Insight scores and other reputation signals before allowing skill installation.

## What It Does

1. **Wraps `clawhub install`** - Intercepts skill installation requests
2. **Checks VirusTotal reputation** - Uses ClawHub's built-in VirusTotal Code Insight
3. **Adds double confirmation** - For suspicious skills (reputation score below threshold)
4. **Integrates with advisory feed** - Works alongside existing clawsec-suite advisories
5. **Provides detailed reports** - Shows why a skill is flagged as suspicious

## Installation

This skill must be installed **after** `clawsec-suite`:

```bash
# First install the suite
npx clawhub@latest install clawsec-suite

# Then install the checker
npx clawhub@latest install clawsec-clawhub-checker

# Run the setup script to integrate with clawsec-suite
node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/setup_reputation_hook.mjs

# Restart OpenClaw gateway for changes to take effect
openclaw gateway restart
```

After setup, the checker adds `enhanced_guarded_install.mjs` and
`guarded_skill_install_wrapper.mjs` under `clawsec-suite/scripts` and updates the advisory
guardian hook. The original `guarded_skill_install.mjs` is not replaced.

## How It Works

### Enhanced Guarded Installer

After setup, run the wrapper (drop-in path) or the enhanced script directly:
```bash
# Recommended drop-in wrapper
node scripts/guarded_skill_install_wrapper.mjs --skill some-skill --version 1.0.0

# Or call the enhanced script directly
node scripts/enhanced_guarded_install.mjs --skill some-skill --version 1.0.0
```

The enhanced flow:
1. **Advisory check** (existing) - Checks clawsec advisory feed
2. **Reputation check** (new) - Queries ClawHub for VirusTotal scores
3. **Risk assessment** - Combines advisory + reputation signals
4. **Double confirmation** - If risky, requires...

# ClawSec ClawHub Checker

A ClawSec suite skill that enhances the guarded skill installer with ClawHub reputation checks and VirusTotal Code Insight integration.

## Purpose

Adds a second layer of security to skill installation by:
1. Checking ClawHub's VirusTotal Code Insight reputation scores
2. Analyzing skill age, author reputation, and download statistics
3. Requiring double confirmation for suspicious skills
4. Integrating with existing ClawSec advisory checks

## Architecture

```
clawsec-suite (base)
└── clawsec-clawhub-checker (enhancement)
    ├── enhanced_guarded_install.mjs - Main enhanced installer
    ├── check_clawhub_reputation.mjs - Reputation checking logic
    ├── setup_reputation_hook.mjs - Integration script
    └── hooks/ - Enhanced advisory guardian hook
```

## Installation

```bash
# First install the base suite
npx clawhub install clawsec-suite

# Then install the checker
npx clawhub install clawsec-clawhub-checker

# Run setup to integrate with existing suite
node scripts/setup_reputation_hook.mjs

# Restart OpenClaw gateway
openclaw gateway restart
```

Setup installs these scripts into `clawsec-suite/scripts`:
- `enhanced_guarded_install.mjs`
- `guarded_skill_install_wrapper.mjs` (drop-in wrapper)
- `check_clawhub_reputation.mjs`

The original `guarded_skill_install.mjs` remains unchanged.

## Usage

### Enhanced Guarded Installer

```bash
# Basic usage via wrapper (includes reputation checks)
node scripts/guarded_skill_install_wrapper.mjs --skill some-skill --version 1.0.0

# Direct usage (enhanced script)
node scripts/enhanced_guarded_install.mjs --skill some-skill --version 1.0.0

# With reputation confirmation override
node scripts/guarded_skill_install_wrapper.mjs --skill suspicious-skill --version 1.0.0 --confirm-reputation

# Adjust reputation threshold (default: 70)
node scripts/guarded_skill_install_wrapper.mjs --skill some-skill --reputation-threshold 80
```

### Reputation Check Only

```bash
# Check reputation without insta...