vpn

# Purpose

Establish a secure, verified path when access is blocked by geo/IP policy, then resume the blocked workflow safely and audibly.

Primary outcomes:
1. detect and classify block behavior,
2. switch to a valid tunnel path with explicit user consent,
3. verify public IP, region, and DNS safety posture,
4. re-run blocked task with bounded retries,
5. return an auditable connection report.

This is an orchestration skill. It does not guarantee legal access to restricted services.

# Required Installed Skills

Core diagnostics/orchestration:
- `shell-scripting` (inspected latest: `1.0.0`)
- `curl-http` (inspected latest: `1.0.0`)

Tunnel path options (at least one):
- provider CLI path (NordVPN / Mullvad / ExpressVPN) via shell orchestration
- `wireguard` (inspected latest: `1.0.0`)
- `tailscale` (inspected latest: `1.0.0`)

Safety and verification extensions:
- `dns` (inspected latest: `1.0.0`)
- `ipinfo` (inspected latest: `1.0.0`)
- `moltguard` (inspected latest: `6.0.2`, optional but recommended)

Install/update:

```bash
npx -y clawhub@latest install shell-scripting
npx -y clawhub@latest install curl-http
npx -y clawhub@latest install wireguard
npx -y clawhub@latest install tailscale
npx -y clawhub@latest install dns
npx -y clawhub@latest install ipinfo
npx -y clawhub@latest install moltguard
npx -y clawhub@latest update --all
```

Verify:

```bash
npx -y clawhub@latest list
```

# Required Credentials and Access

Required access:
- valid account/session for selected tunnel path
- local executable for selected path (`nordvpn`/`mullvad`/`expressvpn` or `wg` or `tailscale`)

Optional keys:
- `MOLTGUARD_API_KEY` (if MoltGuard remote detection mode is enabled)
- `IPINFO_TOKEN` (optional, higher quota geolocation verification)

Preflight:

```bash
command -v nordvpn || command -v mullvad || command -v expressvpn || command -v wg || command -v tailscale
echo "$MOLTGUARD_API_KEY" | wc -c
echo "$IPINFO_TOKEN" | wc -c
```

Mandatory behavior:
- Never fail silently o...