ClawHub

Moses Governance Single

v1.0.4

MO§ES™ Governance — Single-agent constitutional control. Enforces behavioral modes, posture controls, role awareness, and SHA-256 chained audit trail in one...

⭐ 0· 274·1 current·1 all-time
byburnmydays@sunrisesillneversee
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill claims single-agent governance and audit; the included scripts implement local state management and a SHA-256 chained ledger and match that purpose. Minor provenance/metadata inconsistencies: SKILL.md declares python3 as a required bin and an optional MOSES_OPERATOR_SECRET env var, while the registry summary shows "required binaries: none" and the published skill version in metadata differs from the SKILL.md version string. No network endpoints or unrelated cloud credentials are requested.
✓
Instruction Scope
Runtime instructions direct the agent to read and write only the governance state and audit ledger under ~/.openclaw and to run the provided local Python scripts (init_state.py, audit_stub.py). There are no instructions to read other system files, call external endpoints, or exfiltrate secrets. The operator-secret is explicitly optional and only used to HMAC-attest entries.
✓
Install Mechanism
This is an instruction-only skill with two small local Python scripts included. No install spec, no downloads, and no package registry dependencies — low install risk. It does require Python 3 to execute the scripts (SKILL.md lists python3 as a bin).
✓
Credentials
Only an optional environment variable (MOSES_OPERATOR_SECRET) is declared and used strictly for HMAC attestation; its purpose is documented. No other secrets, cloud keys, or unrelated environment variables are requested. The scripts read/write only ~/.openclaw paths.
ℹ
Persistence & Privilege
The skill creates and writes persistent files under ~/.openclaw (state.json, audit_ledger.jsonl, amendments, progress.json). This persistent storage is expected for an audit/governance skill but means the skill will leave artifacts on disk; ensure directory permissions are appropriate. always:false and user-invocable:true (normal).
Assessment
This skill appears to do what it says: local governance and an append-only audit ledger. Before installing or running it, do the following: (1) inspect the two Python scripts (they are small and included) — they operate locally and do not contact the network; (2) confirm you are comfortable with files being created under ~/.openclaw and tighten directory permissions if needed (these files can reveal agent activity); (3) only set MOSES_OPERATOR_SECRET if you want cryptographic attestations, and never paste that secret into chat or into other agents; (4) note minor metadata inconsistencies (version and declared bins) and the lack of a homepage/author signature — treat the publisher as unverified and consider running the scripts in a sandbox or test environment first.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ftjw9z96rm55ha45kcjb1zn8426em

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

⚖️ Clawdis
Environment variables
MOSES_OPERATOR_SECREToptional

Comments