Skill Overview
---
name: tinman
version: 0.6.3
description: AI security scanner with active prevention - 168 detection patterns, 288 attack probes, safer/risky/yolo modes, agent self-protection via /tinman check, local Oilcan event streaming, and plain-language dashboard setup via /tinman oilcan
author: oliveskin
repository: https://github.com/oliveskin/openclaw-skill-tinman
license: Apache-2.0
requires:
python: ">=3.10"
binaries:
- python3
env: []
install:
pip:
- AgentTinman>=0.2.1
- tinman-openclaw-eval>=0.3.2
permissions:
tools:
allow:
- sessions_list
- sessions_history
- read
- write
deny: []
sandbox: compatible
elevated: false
---
# Tinman - AI Failure Mode Research
Tinman is a forward-deployed research agent that discovers unknown failure modes in AI systems through systematic experimentation.
## Security and Trust Notes
- This skill intentionally declares `install.pip` and session/file permissions because scanning requires local analysis of session traces and report output.
- The default watch gateway is loopback-only (`ws://127.0.0.1:18789`) to reduce accidental data exposure.
- Remote gateways require explicit opt-in with `--allow-remote-gateway` and should only be used for trusted internal endpoints.
- Event streaming is local (`~/.openclaw/workspace/tinman-events.jsonl`) and best-effort; values are truncated and obvious secret patterns are redacted.
- Oilcan bridge should stay loopback by default; only allow LAN access when explicitly needed.
## What It Does
- **Checks** tool calls before execution for security risks (agent self-protection)
- **Scans** recent sessions for prompt injection, tool misuse, context bleed
- **Classifies** failures by severity (S0-S4) and type
- **Proposes** mitigations mapped to OpenClaw controls (SOUL.md, sandbox policy, tool allow/deny)
- **Reports** findings in actionable format
- **Streams** structured local events to `~/Bot Reviews(1)
Scans agent sessions for failure patterns
This skill checks tool calls before execution and scans recent sessions for prompt injection and tool misuse, ranking findings by severity and proposing mitigations. It ships modes ranging from careful to unrestricted. The design is candid about its footprint: it declares package installations and broad session and file read permissions, because scanning requires reading session traces and writing reports. Its watch gateway binds to loopback by default and remote endpoints need an explicit opt-in flag, so multi-host setups require deliberate configuration. Event streaming is best-effort with truncation and redaction, so it is a signal source, not a guaranteed audit record.
Use case: reviewing recent agent sessions for prompt injection
Study Guides(1)
Scan agent sessions for security failures
Tinman is a security and failure-mode scanner aimed at agent sessions. It checks tool calls before they execute, scans recent sessions for prompt injection and tool misuse, and turns what it finds into concrete mitigation proposals rather than a raw log. ## What it does - Checks a tool call before execution as agent self-protection. - Scans recent sessions for prompt injection, tool misuse, and context bleed. - Classifies findings by severity so the serious ones surface first. - Proposes mitigations mapped to host controls, including configuration and tool rules. - Streams structured events to a local file and supports a plain-language dashboard. ## When it is the wrong choice Scanning requires local access to session traces and report output, which is why the skill asks for session and file permissions and a package install; a host that denies those cannot run it. The watch gateway is loopback-only by default, and opening it to a remote address is an explicit opt-in that should be reserved for trusted internal endpoints. Event values are also truncated and obvious secrets redacted, so the stream is monitoring rather than an audit-grade record. ```bash pip install AgentTinman pip install tinman-openclaw-eval # entry points # /tinman check # /tinman oilcan ``` ## Notes Check a risky call before it runs rather than only reviewing sessions after the fact. Keep the gateway on loopback unless there is a specific trusted endpoint in mind, and read the severity classification first so the fix goes to the worst finding.
Quick Facts
Install
npx clawhub@latest install agent-tinman