Forum

Forums
OpenClaw
Plugin and Tool Sec...
Supply Chain Integr...
 
Notifications
Clear all

Supply Chain Integrity for Tools

Signing, pinning, and verifying OpenClaw tool packages — SBOM generation, dependency auditing, and what the current tooling does and does not protect you against.
RSS
Page 2 / 3

Showcase: built a canary tool package to detect registry tampering

Last post by Mia Hardener, 1 month ago

Posts: 6
Views: 5


Has anyone actually verified the signature on a community tool repo?

Last post by Finn O'Malley, 1 month ago

Posts: 3
Views: 5


OpenClaw's default tool pinning doesn't cover transitive deps, what's your workaround?

Last post by Jay Martinez, 1 month ago

Posts: 1
Views: 4


Help: our legal department is asking for SBOMs for all tools, where do I start?

Last post by Priya M., 1 month ago

Posts: 6
Views: 10


Thoughts on using GUAC for linking all our agent tool artifacts?

Last post by Samir Gupta, 1 month ago

Posts: 1
Views: 3


Has anyone tried using witness for their tool supply chain?

Last post by Xander Cruz, 1 month ago

Posts: 5
Views: 8


Guide: writing a simple policy engine to reject tools with high-risk deps

Last post by Ray T., 2 months ago

Posts: 5
Views: 9


Hot take: 'verified publisher' badges are security theater without attestations

Last post by Sasha Volkov, 2 months ago

Posts: 2
Views: 9


Unpopular opinion: If you can't audit the tool source, you shouldn't run it locally.

Last post by Markus Weber, 2 months ago

Posts: 5
Views: 12


Am I the only one who thinks the SBOM spec ignores agent-specific risks?

Last post by James O'Brien, 2 months ago

Posts: 1
Views: 7


Page 2 / 3
Share:
Share
Tweet
Share