ClawPolicy

Install and use ClawPolicy, an explainable autonomous execution policy engine for low-touch, auditable agent execution. Supports initialization, policy super...

Security Scan

The skill is a thin, coherent wrapper for the public 'clawpolicy' Python package: its instructions, required binaries, and verification script match the stated purpose and there are no unexplained credentials or risky install URLs.

Purpose & Capability

Name, description, and SKILL.md all describe a CLI/Python API wrapper for the ClawPolicy project; required binaries (python3, pip3) and the pip install requirement are appropriate and proportional.

Instruction Scope

Runtime instructions only install the PyPI package and call its CLI and Python module entrypoint; they create a local '.clawpolicy/' directory as documented. The SKILL.md does not ask the agent to read unrelated files, exfiltrate data, or access extra environment variables.

Install Mechanism

Install is via PyPI (python -m pip install clawpolicy), which is expected for a Python CLI/library. No downloads from personal servers, shorteners, or arbitrary URLs are present. The included verification script uses an isolated venv, which is a good practice.

Credentials

No environment variables, credentials, or config paths are requested. The package may write local files under the documented '.clawpolicy/' path, which is consistent with its purpose.

Persistence & Privilege

The skill is not forced-always, does not request system-wide configuration changes, and contains no instructions to modify other skills. Autonomous invocation is allowed (platform default) and appropriate for a policy supervision tool.

Assessment

This skill is an instruction-only wrapper that installs and uses the public 'clawpolicy' package from PyPI. That is coherent, but installing any third-party package runs code at install time and then executes that package locally. Before installing: (1) review the upstream GitHub repo and PyPI package page for recent releases and maintainership, (2) run the included verify_install.sh in an isolated environment (virtualenv or VM) as the script itself does, (3) avoid giving the agent elevated credentials or running this in a high-privilege environment until you trust the package, and (4) be aware optional extras (clawpolicy[phase3]) pull heavier dependencies—only install them if you need them. If you want stronger assurance, inspect the package contents from PyPI before running it (pip download + unpack) or run tests in a sandbox.

ClawPolicy is an explainable autonomous execution policy engine for low-touch, auditable agent execution.

What it does

• Initializes canonical local policy storage in .clawpolicy/policy/
• Tracks policy lifecycle: hint -> candidate -> confirmed -> suspended -> archived
• Exposes a supervision CLI: clawpolicy policy ...
• Provides a stable Python API for confirmation, policy storage, and Markdown conversion/export

Install

python3 -m pip install clawpolicy

Optional extras:

python3 -m pip install "clawpolicy[phase3]"

Quick start

clawpolicy init
clawpolicy analyze
clawpolicy policy status
clawpolicy policy recent
clawpolicy policy risky
clawpolicy policy suspended

Verification

The published package should pass this minimal smoke path:

python3 -m pip install clawpolicy
clawpolicy --help
clawpolicy init
clawpolicy policy status
python -m clawpolicy policy status

Python API

from clawpolicy import (
    ConfirmationAPI,
    PolicyEvent,
    PolicyStore,
    Playbook,
    Rule,
    MarkdownToPolicyConverter,
    PolicyToMarkdownExporter,
    create_api,
)

References

• Upstream repo: https://github.com/DZMing/clawpolicy
• Chinese README: references/upstream-README.zh-CN.md
• English README: references/upstream-README.md
• Changelog: references/upstream-CHANGELOG.md
• Security policy: references/upstream-SECURITY.md

Notes

• This ClawHub package is a skill wrapper for the public clawpolicy project.
• Canonical source code, releases, and issue tracking remain in the upstream GitHub repository.