Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub · Productivity
Openclaw Triage
Incident response and forensics for agent workspaces. Investigate compromises, build timelines, assess blast radius, and collect evidence. Cross-references data from warden, ledger, signet, and sentinel for unified analysis. Free alert layer — upgrade to openclaw-triage-pro for automated containment, remediation playbooks, and evidence export.
skill openclawclawhub Free
Incident response and forensics for agent workspaces. Investigate compromises, build timelines, assess blast radius, and collect evidence. Cross-references data from warden, ledger, signet, and sentinel for unified analysis. Free alert layer — upgrade to openclaw-triage-pro for automated containment, remediation playbooks, and evidence export.
⬇ 0 downloads ★ 0 stars Unverified but indexed
Install for OpenClaw
Quick setup
- Download the package from Yavira.
- Extract the archive and review SKILL.md first.
- Import or place the package into your OpenClaw setup.
Package facts
- Download mode
- Yavira redirect
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- README.md, scripts/triage.py, SKILL.md
Validation
- Use the Yavira download entry.
- Review SKILL.md after the package is downloaded.
- Confirm the extracted package contains the expected setup assets.
Install with your agent
Agent handoff
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
New install
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete.
Upgrade existing
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 1.0.2
Provenance
- Publisher
- AtlasPA
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
OpenClaw Triage
Incident response and forensics for agent workspaces. When something goes wrong — a skill behaves unexpectedly, files change without explanation, or another security tool flags an anomaly — triage investigates what happened, assesses the damage, and guides recovery. This is the "detective" that pulls together evidence from all OpenClaw security tools into a unified incident report.
Full Investigation
Run a comprehensive incident investigation. Collects workspace state, checks for signs of compromise (recently modified critical files, new skills, unusual permissions, off-hours modifications, large files, hidden files), cross-references with warden/ledger/signet/sentinel data, builds an event timeline, and calculates an incident severity score (CRITICAL / HIGH / MEDIUM / LOW). python3 {baseDir}/scripts/triage.py investigate --workspace /path/to/workspace
Event Timeline
Build a chronological timeline of all file modifications in the workspace. Groups events by hour, highlights suspicious burst activity (many files modified in a short window), shows which directories and skills were affected, and cross-references with ledger entries if available. python3 {baseDir}/scripts/triage.py timeline --workspace /path/to/workspace Look back further than the default 24 hours: python3 {baseDir}/scripts/triage.py timeline --hours 72 --workspace /path/to/workspace
Blast Radius (Scope)
Assess the blast radius of a potential compromise. Categorizes all files by risk level (critical, memory, skill, config), checks for credential exposure patterns in recently modified files, scans for outbound exfiltration URLs, and estimates scope as CONTAINED (single area), SPREADING (multiple skills), or SYSTEMIC (workspace-level). python3 {baseDir}/scripts/triage.py scope --workspace /path/to/workspace
Evidence Collection
Collect and preserve forensic evidence before remediation. Snapshots the full workspace state (file list with SHA-256 hashes, sizes, timestamps), copies all available security tool data (.integrity/, .ledger/, .signet/, .sentinel/), and generates a summary report. Always run this before any remediation to preserve the forensic trail. python3 {baseDir}/scripts/triage.py evidence --workspace /path/to/workspace Save to a custom output directory: python3 {baseDir}/scripts/triage.py evidence --output /path/to/evidence/dir --workspace /path/to/workspace
Quick Status
One-line summary of triage state: last investigation timestamp, current threat level, and whether evidence has been collected. python3 {baseDir}/scripts/triage.py status --workspace /path/to/workspace
Workspace Auto-Detection
If --workspace is omitted, the script tries: OPENCLAW_WORKSPACE environment variable Current directory (if AGENTS.md exists) ~/.openclaw/workspace (default)
Cross-Reference Sources
Triage automatically checks for data from these OpenClaw tools: ToolData PathWhat Triage ChecksWarden.integrity/manifest.jsonBaseline deviations — files modified since last known-good stateLedger.ledger/chain.jsonlChain breaks, unparseable entries, suspicious log entriesSignet.signet/manifest.jsonTampered skill signatures — skills modified after signingSentinel.sentinel/threats.jsonKnown threats and high-severity findings
Incident Severity Levels
LevelMeaningTriggerCRITICALImmediate response requiredAny critical finding, or 3+ high findingsHIGHInvestigation warrantedHigh-severity findings from any sourceMEDIUMReview recommendedMultiple medium findings or volume thresholdLOWNo immediate actionInformational findings only
Exit Codes
0 — Clean, no actionable findings 1 — Findings detected (investigation recommended) 2 — Critical findings (immediate action needed)
No External Dependencies
Python standard library only. No pip install. No network calls. Everything runs locally.
Cross-Platform
Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.
Category context
Workflow acceleration for inboxes, docs, calendars, planning, and execution loops.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
2 Docs1 Scripts
- SKILL.md
- README.md
- scripts/triage.py