{
  "schemaVersion": "1.0",
  "item": {
    "slug": "arc-compliance-checker",
    "name": "Compliance Checker",
    "source": "tencent",
    "type": "skill",
    "category": "安全合规",
    "sourceUrl": "https://clawhub.ai/Trypto1019/arc-compliance-checker",
    "canonicalUrl": "https://clawhub.ai/Trypto1019/arc-compliance-checker",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/arc-compliance-checker",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=arc-compliance-checker",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md",
      "scripts/checker.py"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-23T16:43:11.935Z",
      "expiresAt": "2026-04-30T16:43:11.935Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
        "contentDisposition": "attachment; filename=\"4claw-imageboard-1.0.1.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/arc-compliance-checker"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/arc-compliance-checker",
    "agentPageUrl": "https://openagent3.xyz/skills/arc-compliance-checker/agent",
    "manifestUrl": "https://openagent3.xyz/skills/arc-compliance-checker/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/arc-compliance-checker/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "Compliance Checker",
        "body": "Assess OpenClaw skills against defined security policies. Track compliance posture across your skill inventory with framework-mapped findings and remediation tracking."
      },
      {
        "title": "Why This Exists",
        "body": "Security scanners find vulnerabilities. Trust verifiers check provenance. But neither answers: \"Does this skill meet our security policy?\" Compliance Checker bridges the gap — define what \"compliant\" means for your environment, then assess every skill against those rules."
      },
      {
        "title": "Define a policy",
        "body": "python3 {baseDir}/scripts/checker.py policy create --name \"production\" --description \"Production deployment requirements\""
      },
      {
        "title": "Add rules to the policy",
        "body": "python3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"no-critical-findings\" \\\n  --description \"No CRITICAL findings from skill scanner\" \\\n  --severity critical\n\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"trust-verified\" \\\n  --description \"Must have VERIFIED or TRUSTED trust level\" \\\n  --severity high\n\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"no-network-calls\" \\\n  --description \"No unauthorized network calls in scripts\" \\\n  --severity high\n\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"no-shell-exec\" \\\n  --description \"No shell=True or subprocess calls\" \\\n  --severity medium\n\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"has-checksum\" \\\n  --description \"Must have SHA-256 checksums for all scripts\" \\\n  --severity medium"
      },
      {
        "title": "Assess a skill against a policy",
        "body": "python3 {baseDir}/scripts/checker.py assess --skill \"arc-budget-tracker\" --policy \"production\""
      },
      {
        "title": "Assess all installed skills",
        "body": "python3 {baseDir}/scripts/checker.py assess-all --policy \"production\""
      },
      {
        "title": "View compliance status",
        "body": "python3 {baseDir}/scripts/checker.py status --policy \"production\""
      },
      {
        "title": "Generate compliance report",
        "body": "python3 {baseDir}/scripts/checker.py report --policy \"production\" --format json\npython3 {baseDir}/scripts/checker.py report --policy \"production\" --format text"
      },
      {
        "title": "Built-in Rules",
        "body": "The following rules are available out of the box:\n\nRuleWhat it checksFramework mappingno-critical-findingsNo CRITICAL findings from scannerCIS Control 16, OWASP A06no-high-findingsNo HIGH findings from scannerCIS Control 16, OWASP A06trust-verifiedTrust level is VERIFIED or TRUSTEDCIS Control 2no-network-callsNo unauthorized network requestsCIS Control 9, OWASP A10no-shell-execNo shell execution patternsCIS Control 2, OWASP A03no-eval-execNo eval/exec patternsOWASP A03has-checksumSHA-256 checksums for all filesCIS Control 2no-env-accessNo environment variable accessCIS Control 3no-data-exfilNo data exfiltration patternsCIS Control 3, CIS Control 13version-pinnedAll dependencies version-pinnedCIS Control 2"
      },
      {
        "title": "Compliance Status",
        "body": "Each skill-policy assessment produces one of:\n\nCOMPLIANT — Passes all rules in the policy\nNON-COMPLIANT — Fails one or more rules\nEXEMPTED — Has approved exemptions for all failures\nUNKNOWN — Not yet assessed"
      },
      {
        "title": "Exemptions",
        "body": "Sometimes a skill legitimately needs to violate a rule (e.g., a network monitoring skill needs network access). Record exemptions with justification:\n\npython3 {baseDir}/scripts/checker.py exempt --skill \"arc-skill-scanner\" \\\n  --rule \"no-network-calls\" \\\n  --reason \"Scanner needs network access to check URLs against blocklists\" \\\n  --approved-by \"arc\""
      },
      {
        "title": "Remediation Tracking",
        "body": "When a skill fails compliance, track the fix:\n\npython3 {baseDir}/scripts/checker.py remediate --skill \"some-skill\" \\\n  --rule \"no-shell-exec\" \\\n  --action \"Replaced subprocess.call with safer alternative\" \\\n  --status fixed"
      },
      {
        "title": "Storage",
        "body": "Compliance data is stored in ~/.openclaw/compliance/:\n\npolicies/ — Policy definitions (JSON)\nassessments/ — Assessment results per skill (JSON)\nexemptions/ — Approved exemptions (JSON)\nremediations/ — Remediation tracking (JSON)"
      },
      {
        "title": "Integration",
        "body": "Compliance Checker reads output from:\n\narc-skill-scanner — vulnerability findings\narc-trust-verifier — trust levels and attestations\n\nRun a full pipeline:\n\n# Scan → verify trust → assess compliance\npython3 {baseDir}/scripts/checker.py pipeline --skill \"some-skill\" --policy \"production\""
      }
    ],
    "body": "Compliance Checker\n\nAssess OpenClaw skills against defined security policies. Track compliance posture across your skill inventory with framework-mapped findings and remediation tracking.\n\nWhy This Exists\n\nSecurity scanners find vulnerabilities. Trust verifiers check provenance. But neither answers: \"Does this skill meet our security policy?\" Compliance Checker bridges the gap — define what \"compliant\" means for your environment, then assess every skill against those rules.\n\nQuick Start\nDefine a policy\npython3 {baseDir}/scripts/checker.py policy create --name \"production\" --description \"Production deployment requirements\"\n\nAdd rules to the policy\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"no-critical-findings\" \\\n  --description \"No CRITICAL findings from skill scanner\" \\\n  --severity critical\n\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"trust-verified\" \\\n  --description \"Must have VERIFIED or TRUSTED trust level\" \\\n  --severity high\n\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"no-network-calls\" \\\n  --description \"No unauthorized network calls in scripts\" \\\n  --severity high\n\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"no-shell-exec\" \\\n  --description \"No shell=True or subprocess calls\" \\\n  --severity medium\n\npython3 {baseDir}/scripts/checker.py policy add-rule --policy \"production\" \\\n  --rule \"has-checksum\" \\\n  --description \"Must have SHA-256 checksums for all scripts\" \\\n  --severity medium\n\nAssess a skill against a policy\npython3 {baseDir}/scripts/checker.py assess --skill \"arc-budget-tracker\" --policy \"production\"\n\nAssess all installed skills\npython3 {baseDir}/scripts/checker.py assess-all --policy \"production\"\n\nView compliance status\npython3 {baseDir}/scripts/checker.py status --policy \"production\"\n\nGenerate compliance report\npython3 {baseDir}/scripts/checker.py report --policy \"production\" --format json\npython3 {baseDir}/scripts/checker.py report --policy \"production\" --format text\n\nBuilt-in Rules\n\nThe following rules are available out of the box:\n\nRule\tWhat it checks\tFramework mapping\nno-critical-findings\tNo CRITICAL findings from scanner\tCIS Control 16, OWASP A06\nno-high-findings\tNo HIGH findings from scanner\tCIS Control 16, OWASP A06\ntrust-verified\tTrust level is VERIFIED or TRUSTED\tCIS Control 2\nno-network-calls\tNo unauthorized network requests\tCIS Control 9, OWASP A10\nno-shell-exec\tNo shell execution patterns\tCIS Control 2, OWASP A03\nno-eval-exec\tNo eval/exec patterns\tOWASP A03\nhas-checksum\tSHA-256 checksums for all files\tCIS Control 2\nno-env-access\tNo environment variable access\tCIS Control 3\nno-data-exfil\tNo data exfiltration patterns\tCIS Control 3, CIS Control 13\nversion-pinned\tAll dependencies version-pinned\tCIS Control 2\nCompliance Status\n\nEach skill-policy assessment produces one of:\n\nCOMPLIANT — Passes all rules in the policy\nNON-COMPLIANT — Fails one or more rules\nEXEMPTED — Has approved exemptions for all failures\nUNKNOWN — Not yet assessed\nExemptions\n\nSometimes a skill legitimately needs to violate a rule (e.g., a network monitoring skill needs network access). Record exemptions with justification:\n\npython3 {baseDir}/scripts/checker.py exempt --skill \"arc-skill-scanner\" \\\n  --rule \"no-network-calls\" \\\n  --reason \"Scanner needs network access to check URLs against blocklists\" \\\n  --approved-by \"arc\"\n\nRemediation Tracking\n\nWhen a skill fails compliance, track the fix:\n\npython3 {baseDir}/scripts/checker.py remediate --skill \"some-skill\" \\\n  --rule \"no-shell-exec\" \\\n  --action \"Replaced subprocess.call with safer alternative\" \\\n  --status fixed\n\nStorage\n\nCompliance data is stored in ~/.openclaw/compliance/:\n\npolicies/ — Policy definitions (JSON)\nassessments/ — Assessment results per skill (JSON)\nexemptions/ — Approved exemptions (JSON)\nremediations/ — Remediation tracking (JSON)\nIntegration\n\nCompliance Checker reads output from:\n\narc-skill-scanner — vulnerability findings\narc-trust-verifier — trust levels and attestations\n\nRun a full pipeline:\n\n# Scan → verify trust → assess compliance\npython3 {baseDir}/scripts/checker.py pipeline --skill \"some-skill\" --policy \"production\""
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/Trypto1019/arc-compliance-checker",
    "publisherUrl": "https://clawhub.ai/Trypto1019/arc-compliance-checker",
    "owner": "Trypto1019",
    "version": "1.1.0",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/arc-compliance-checker",
    "downloadUrl": "https://openagent3.xyz/downloads/arc-compliance-checker",
    "agentUrl": "https://openagent3.xyz/skills/arc-compliance-checker/agent",
    "manifestUrl": "https://openagent3.xyz/skills/arc-compliance-checker/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/arc-compliance-checker/agent.md"
  }
}