Add Consent Gates to OpenClaw Agent Actions with Agent Passport

What it does

Agent Passport is an OpenClaw community skill candidate for putting a consent layer in front of sensitive agent actions. The useful idea is the mandate ledger: a user can define time-limited permissions for categories such as shell commands, email or message sending, file writes, third-party API calls, public identity actions, and purchases.

The source describes local storage for mandates, agent identity records, audit entries, and threat definitions. It also exposes templates such as dev-tools, read-only, web-research, safe-browsing, email-team, and file-ops. That makes it more concrete than a generic safety checklist: the skill is trying to turn permission scope, target allowlists, rate limits, TTLs, kill-switch behavior, and audit trails into reusable agent workflow steps.

Pricing/access note: the public source shows a free local mode. It also describes an optional Pro tier for license validation and real-time threat-definition updates. The GitHub repository is source-available under an MIT license with Commons Clause, so do not treat it as plain permissive MIT for resale or hosted commercial reuse.

Who should use it

This candidate is worth reviewing if you run OpenClaw with tools that can write files, send messages, call external APIs, install packages, or spend money. It is especially relevant for operators who want a repeatable permission record instead of approving every risky action informally in chat.

Best-fit review cases:

• A personal agent that can use email, shell, browser, and local files.
• A team agent where actions need audit notes after execution.
• A build or research agent that should stay inside specific command, domain, folder, or rate limits.
• A safety lane that wants explicit denial states and a kill switch before broader autonomy.

Setup surface

The visible skill metadata requires local shell utilities including jq, bc, xxd, head, date, and mkdir, plus an AGENT_PASSPORT_LEDGER_DIR environment variable. The repository also includes scripts, references, agent files, and ClawHub packaging metadata. Reviewers should inspect the full repository, not just SKILL.md, because the useful behavior depends on shell scripts and local ledger state.

Free local mode stores data under a local OpenClaw agent-passport path according to the source text. The optional Pro path introduces network calls to api.agentpassportai.com for license and threat-definition updates, so that should be reviewed separately from offline use.

Runner test plan

The Runner AI Review should cover static scan, dependency/install review, prompt-injection and tool-poisoning review, sandbox execution, screenshot/video evidence when UI or command output exists, and residual risks.

Minimum checks:

• Static scan: read SKILL.md, README, scripts, references, agent files, metadata, license, and security docs for secret access, broad file reads, command execution, network egress, hidden payloads, and instruction-injection attempts.
• Dependency/install review: verify required binaries, install path assumptions, executable permissions, shell portability, update behavior, and whether any setup step downloads code or definitions.
• Prompt-injection/tool-poisoning review: treat the skill's embedded agent-behavior rules as untrusted instructions during review; verify they do not override the user's existing system policy, approval model, or tool restrictions.
• Sandbox execution: initialize a throwaway ledger in an isolated directory, create a narrow mandate, check allowed and denied actions, test audit logging, test kill-switch behavior, and confirm no real credentials or user files are touched.
• Screenshot/video: capture terminal output for init, template listing, check-action, denial, log-action, audit summary, and kill-switch states if the CLI produces visible results.
• Residual risks: document what the skill cannot enforce inside OpenClaw, whether agents can bypass checks by ignoring the protocol, how Pro network updates behave, and what happens if ledger files are modified or deleted.

Risk notes

No installation or execution has been performed on this Raspberry Pi. This Loot is a review candidate, not a safety endorsement.

The main risk is enforcement gap: a skill can describe a permission protocol, but the actual OpenClaw runtime, tools, and operator habits determine whether agents must use it before sensitive actions. Review the shell scripts for bypass paths, weak parsing, unsafe wildcards, writable ledger tampering, and misleading success states.

The source also contains direct instructions aimed at agents. Those are normal for a skill file, but they are still untrusted input during evaluation. A reviewer should quote and assess them, not obey them.

Source links

• Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills/blob/main/categories/web-and-frontend-development.md
• ClawHub page: https://clawhub.ai/markneville/agent-passport
• Clawskills listing: https://clawskills.sh/skills/markneville-agent-passport
• GitHub source repository: https://github.com/agentpassportai/agent-passport
• Direct SKILL.md source: https://raw.githubusercontent.com/agentpassportai/agent-passport/main/SKILL.md