Safe habits before installing OpenClaw / ClawHub skills

By Justin Helmer · 8 August 2026 · Educational checklist

Why skills need a gate

Agent skills are powerful because they can read files, call tools, and encode workflows. That power is also the risk: a skill that claims “no network” but imports HTTP libraries is a trust problem. Treat every skill like untrusted software, even from publishers you generally like (including us).

Pre-install checklist

1. Read SKILL.md, what does it say it does? what permissions does it claim?
2. Skim scripts/, look for subprocess, shell=True, eval, raw sockets, hardcoded secrets.
3. Check for auto-publish, git push, social post, or cloud upload without consent flags is a red flag.
4. Prefer local-first, tools that work offline with explicit --i-consent for writes are easier to reason about.
5. Install from a known slug, typo-squatting is a real class of attack on package ecosystems.
6. Run in a throwaway environment first if the skill is high privilege.

Claim vs code mismatches

A common failure mode: documentation says “no network / no subprocess,” but the code clearly uses them. That may be malice, sloppy packaging, or an outdated description, all are reasons to pause. Our local scanner skill lygo-skill-gate was built for exactly this pre-install scan (stdlib only; it does not auto-install anything). See listings on LYGO SkillHub.

SkillHub now has two labeled channels. Public tentacles install from ClawHub. FULL engineer zips are only on the download portal: read the disclaimers, tick the boxes, hash-check the zip, then unzip into a folder you control. A PayPal tip is optional and is not a paywall. Live Star Chart writes still need explicit human consent.

Permissions table (mental model)

After install

• Run any provided self_check scripts.
• Pin versions when your tool allows it.
• Re-scan after updates, changelogs can hide permission expansions.
• For multi-step agent work, seal results with Continuum.

What chatagent.ca publishes

We list skills associated with the deepseekoracle ClawHub profile on lygoskillhub.html. Public skills are meant as “tentacles”; FULL engineer packages (when offered) sit behind an explicit gate. Always re-verify locally.

This guide is education, not a guarantee of safety. You own the machines and the agents you run.

If a skill misbehaves

1. Disconnect network if the skill may be exfiltrating.
2. Stop the agent host process.
3. Preserve the skill folder for inspection (do not blindly delete evidence).
4. Rotate any credentials that might have been exposed.
5. Report to the publisher if appropriate; warn your team.

Write a short incident note: what you installed, from where, what you observed. Future you will thank present you.