---
name: freeman-skill-guard
description: Review skill and automation-bundle sources before installation, update, or enablement, including code execution, network destinations, file access, dependencies, and preservation of existing local permissions. Use for skill trust and maintenance tasks, not every ordinary task that uses a skill.
---

# Freeman Skill Guard

Review the actual package before enabling it. This skill includes the general source/code review and Freeman-specific privacy review in one workflow; a separate `skill-vetter` installation is not required. Installing a capability does not authorize its later external actions or private-data access.

## Review the proposed change

1. Record the source URL, version or commit, archive hash, and installed paths. Verify published file hashes when available; matching hashes establish consistency with the source, not that the source is trustworthy.
2. Download into the task's work directory without executing downloaded content. Reject archive path traversal, unexpected absolute paths, unsafe symlinks, or files outside the stated bundle.
3. Read new/changed instructions, scripts, install hooks, UI metadata, and relevant dependencies. For unchanged local files, verify hashes and rely on the existing reviewed baseline. Distinguish known dependencies from missing, unreviewed ones. Do not run remote install pipelines just to review them.
4. List the concrete files read/written, network destinations, commands, credentials, browser sessions, memory surfaces, and persistence requested. Evaluate whether each is necessary for the advertised function. A keyword match is a review lead, not proof of malicious behavior.
5. Compare existing local variants. Preserve valid customizations, tests, privacy contracts, and current user authorization. Back up before replacement; prefer one canonical source with device-local discovery links. Do not overwrite unrelated same-name targets or edit managed plugin caches.
6. Validate skill metadata and references, run meaningful tests for changed executable behavior, and distinguish installed files from runtime validation on each platform. Report unavailable dependencies without pretending that installation fixed them.

## Sensitive surfaces and stopping conditions

Memory/identity files (`MEMORY.md`, `USER.md`, `SOUL.md`, `IDENTITY.md`, `memory/`, `.learnings/`), cookies and browser profiles, credentials (`~/.ssh`, `~/.aws`, `.env`, key stores), system settings, and background jobs require task-specific scope. Existing authorization remains valid; do not ask again for an already authorized reviewed installation or minimal capability. Read the active environment's rules before any actual private-data access or write.

Reject or quarantine the affected component if it conceals execution, exfiltrates private data, evades security controls, silently persists, or exceeds the user's purpose. Examples warranting close review include unexplained encoded execution, raw-IP destinations, remote download-and-execute chains, privileged installers, and self-updaters. Ordinary local loopback APIs, explicit dependencies, or a reviewed local subprocess are not inherently violations.

Do not enable payments, trading, message sending, credential export, automatic memory changes, or new background jobs merely because their skill is installed. If an additional action lacks authorization, finish the review and preparation first, then ask only for that specific action. Explain the exact blocking instruction and its source when it is the reason for stopping. Missing optional tooling is not a reason to demand approval for a safe manual review.

## Decision record

Record a short decision in the task's audit/handoff artifact:

- Skill, source/version, archive hash, reviewed files or unchanged-baseline hashes.
- Sensitive surfaces, network destinations, and required runtime dependencies.
- Verdict: install/update, install with stated runtime limits, or block the affected component.
- Comparison rationale, preserved local behavior, validation results, and rollback location.

Do not put raw chats, tokens, cookies, or financial snapshots in the record. Use `<OPENCLAW_WORKSPACE>/security/skill-vetting-log.md` only when the active task uses that configured audit location; otherwise keep the record in its own project. Do not create unrelated memory or persona writes.

## Local trust exceptions

This distribution includes no personal trust exception. Preserve a current user's independently verified exception within its actual scope; never infer trust from a copied package or from the skill's name.