ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Operator Hardening Pack

v1.0.0

A unified operating workflow for hardening agent setups and running complex tasks reliably by combining bootstrap hardening, role orchestration, and handoff...

⭐ 0· 58·0 current·0 all-time
byChristopher Wheeler@cwheeler67

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for cwheeler67/operator-hardening-pack.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Operator Hardening Pack" (cwheeler67/operator-hardening-pack) from ClawHub.
Skill page: https://clawhub.ai/cwheeler67/operator-hardening-pack
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install operator-hardening-pack

ClawHub CLI

Package manager switcher

npx clawhub@latest install operator-hardening-pack
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The name/description (agent hardening, role orchestration, handoff) align with the runbook contents: auditing memory/files, trimming redundancy, establishing role contracts. However, the skill declares no required config paths, binaries, or credentials even though the runbook explicitly tells the agent to 'Check AGENTS/SOUL/USER/HEARTBEAT/memory files' and to make durable memory updates — an omission that makes the required access unclear.
!
Instruction Scope
SKILL.md and the runbook instruct the agent to inspect and modify agent memory/config files and to 'Deliver + log' and 'Durable memory updates'. Those are broad actions that can access sensitive data. The instructions do not specify which exact files/paths are safe to read or ask for explicit user approval before local reads/writes or any external transmission, creating scope creep and unclear boundaries.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files; nothing is written to disk by an installer. That minimizes supply-chain risk. However, the lack of code also means static scanners had no code to analyze, increasing uncertainty about runtime behavior.
ℹ
Credentials
No environment variables, credentials, or config paths are declared, which superficially reduces credential risk. At the same time, the runbook expects access to 'AGENTS/SOUL/USER/HEARTBEAT/memory' which implies reading/writing internal agent state; because those paths are not declared, it's unclear what permissions the skill needs and whether it will access unrelated sensitive data.
✓
Persistence & Privilege
The skill is not marked always:true and does not request autonomous privileges beyond the platform default. It does instruct making durable memory updates, which is normal for a hardening workflow but should be constrained by explicit user approval.
What to consider before installing
This skill's goal (hardening agent workspaces) is reasonable, but the runbook tells the agent to read and modify internal memory/config files without declaring which paths or asking for explicit approvals. Before installing or running it: (1) ask the author for source code or a homepage and a clear list of exact files/paths the skill will access; (2) require explicit, per-action user approval before any reads/writes or external network calls; (3) test in an isolated/sandbox workspace first; (4) consider adding guards that prevent the skill from reading unrelated secrets or exporting data externally; and (5) refuse to install if the maintainer cannot justify the exact permissions and provide an auditable change log. These steps will reduce the risk that the skill inadvertently (or intentionally) reads or modifies sensitive agent state.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fsgbqc32fd64h687pywpn5n8508yp
58downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0
Christopher Wheeler@cwheeler67
latest
Download

Operator Hardening Pack

Use this skill as the top-level entry point when you need a reliable, safety-first agent operating system.

Includes

  • agent-bootstrap-hardening: tighten AGENTS/SOUL/USER/HEARTBEAT/memory structure
  • team-agents-orchestrator: role-separated execution (operator/researcher/builder/editor)
  • team-role-launchkit: reusable role prompts + handoff contract templates

When to use

  • New workspace setup
  • Existing workspace feels inconsistent/noisy
  • Complex multi-step tasks with quality drift
  • Need repeatable role handoffs across long tasks

Workflow (recommended)

  1. Harden foundation
    • Run bootstrap hardening on core files.
  2. Enable role mode for complex work
    • Activate orchestrator with explicit role boundaries.
  3. Enforce handoff contract
    • Use template from references/pack-runbook.md.
  4. Deliver + log
    • Final output + decisions/follow-ups in memory.

Guardrails

  • External/public actions require explicit approval policy.
  • Keep instructions concise and enforceable.
  • Promote only durable, useful memory.
  • Prefer no-change over low-value churn.

Output contract

Return:

  • hardening/operation summary
  • files/artifacts changed
  • unresolved risks
  • next best step

Comments

Loading comments...