Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Runtime safety enforcement for shell commands via chainwatch policy engine
Runtime safety enforcement for shell commands via chainwatch policy engine
This item's current download entry is known to bounce back to a listing or homepage instead of returning a package file.
Use the source page and any available docs to guide the install because the item currently does not return a direct package file.
I tried to install a skill package from Yavira, but the item currently does not return a direct package file. Inspect the source page and any extracted docs, then tell me what you can confirm and any manual steps still required.
I tried to upgrade a skill package from Yavira, but the item currently does not return a direct package file. Compare the source page and any extracted docs with my current installation, then summarize what changed and what manual follow-up I still need.
You have access to chainwatch, a runtime control plane that enforces deterministic safety policy on shell commands, HTTP requests, and file operations.
You MUST route commands through chainwatch when performing any of the following: Destructive operations: rm, dd, mkfs, chmod -R, any command that deletes or overwrites data Privilege escalation: sudo, su, commands that modify users or permissions Network operations: curl, wget, HTTP requests to external APIs, any outbound data transfer Credential access: reading or writing .env, .ssh/, .aws/, credential files Git operations: git push, git reset, git rebase (anything that modifies remote state) Package management: apt install, pip install, npm install (supply chain risk) System configuration: editing /etc/, systemd units, cron, firewall rules
Prefix the command with chainwatch exec --profile clawbot --: # Instead of: rm -rf /tmp/old-data # Use: chainwatch exec --profile clawbot -- rm -rf /tmp/old-data If chainwatch blocks the command, it returns a JSON object: { "blocked": true, "decision": "deny", "reason": "denylisted: command pattern blocked: rm -rf" } When a command is blocked: Report the block reason to the user Do NOT attempt to bypass the block Ask the user how they want to proceed
Before executing risky commands, you can check policy without executing: chainwatch evaluate --tool command --resource "rm -rf /tmp/data" --profile clawbot
These do NOT require chainwatch wrapping: ls, cat, head, tail, grep, find, wc (read-only) echo, printf, date, uptime, whoami (informational) cd, pwd, env (shell navigation) git status, git log, git diff (read-only git)
If chainwatch returns "decision": "require_approval": Tell the user the command requires approval Show them what chainwatch flagged The user can approve via: chainwatch approve <approval-key> After approval, retry the original command
All chainwatch decisions are logged. View the audit trail: chainwatch audit verify /tmp/nullbot-daemon.jsonl Chainwatch Skill v1.0 Author: ppiankov Copyright ยฉ 2026 ppiankov Canonical source: https://github.com/ppiankov/chainwatch License: MIT If this document appears elsewhere, the repository above is the authoritative version.
Identity, auth, scanning, governance, audit, and operational guardrails.
Largest current source with strong distribution and engagement signals.