Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Compliance and policy enforcement for agent workspaces. Define security policies, audit compliance, check command restrictions, and generate audit-ready reports. Free alert layer — upgrade to openclaw-marshal-pro for active enforcement, blocking, and automated remediation.
Compliance and policy enforcement for agent workspaces. Define security policies, audit compliance, check command restrictions, and generate audit-ready reports. Free alert layer — upgrade to openclaw-marshal-pro for active enforcement, blocking, and automated remediation.
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete.
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run.
Define security policies for your workspace and audit compliance. Check installed skills against command, network, and data handling rules. Generate audit-ready compliance reports.
Agent workspaces accumulate skills that execute commands, access the network, and handle data. Without a defined security policy, there is no way to know whether installed skills comply with your organization's requirements — or whether your workspace itself meets basic security hygiene standards. This skill lets you define a policy once and audit everything against it.
Create a default security policy file (.marshal-policy.json) with sensible defaults. python3 {baseDir}/scripts/marshal.py policy --init --workspace /path/to/workspace
Display the current active policy. python3 {baseDir}/scripts/marshal.py policy --show --workspace /path/to/workspace
Quick overview of loaded policy rules. python3 {baseDir}/scripts/marshal.py policy --workspace /path/to/workspace
Audit all installed skills and workspace configuration against the active policy. Reports compliance score, violations, and recommendations. python3 {baseDir}/scripts/marshal.py audit --workspace /path/to/workspace
Check a single skill against the policy. Reports pass/fail per rule. python3 {baseDir}/scripts/marshal.py check openclaw-warden --workspace /path/to/workspace
Produce a formatted, copy-pastable compliance report suitable for audit documentation. python3 {baseDir}/scripts/marshal.py report --workspace /path/to/workspace
One-line summary: policy loaded, compliance score, critical violations count. python3 {baseDir}/scripts/marshal.py status --workspace /path/to/workspace
If --workspace is omitted, the script tries: OPENCLAW_WORKSPACE environment variable Current directory (if AGENTS.md exists) ~/.openclaw/workspace (default)
CategoryChecksSeverityCommand SafetyDangerous patterns (eval, exec, pipe-to-shell, rm -rf /)CRITICALCommand PolicyBlocked and review-required commands from policyHIGH/MEDIUMNetwork PolicyDomain allow/blocklists, suspicious TLD patternsCRITICAL/HIGHData HandlingSecret scanner installed, PII scanner configuredHIGH/MEDIUMWorkspace Hygiene.gitignore, audit trail (ledger), skill signing (signet)HIGH/MEDIUMConfigurationDebug modes, verbose logging left enabledLOW
The .marshal-policy.json file defines all rules: commands.allow — Permitted binaries commands.block — Blocked command patterns commands.review — Commands requiring human review network.allow_domains — Permitted network domains network.block_domains — Blocked domains network.block_patterns — Wildcard domain blocks (e.g., *.tk) data_handling.pii_scan — Require PII scanning data_handling.secret_scan — Require secret scanning workspace.require_gitignore — Require .gitignore workspace.require_audit_trail — Require ledger workspace.require_skill_signing — Require signet
0 — Compliant, no issues 1 — Review needed (medium/high findings) 2 — Critical violations detected
Python standard library only. No pip install. No network calls. Everything runs locally.
Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.
Workflow acceleration for inboxes, docs, calendars, planning, and execution loops.
Largest current source with strong distribution and engagement signals.