Skill Overview
---
name: Authensor Gateway
version: 0.7.0
description: >
Fail-safe policy gate for OpenClaw marketplace skills.
Intercepts tool calls before execution and checks them against
your Authensor policy. Low-risk actions run automatically.
High-risk actions require your approval. Dangerous actions are blocked.
Only action metadata is sent to the control plane — never your files,
API keys, or conversation content.
disable-model-invocation: true
requires:
env:
- CONTROL_PLANE_URL
- AUTHENSOR_API_KEY
metadata:
openclaw:
skillKey: authensor-gateway
homepage: https://github.com/AUTHENSOR/Authensor-for-OpenClaw
marketplace: https://www.clawhub.ai/AUTHENSOR/authensor-gateway
primaryEnv: AUTHENSOR_API_KEY
env:
- CONTROL_PLANE_URL
- AUTHENSOR_API_KEY
---
# Authensor Gateway
A lightweight policy gate that checks every OpenClaw tool call against your Authensor policy before it executes.
- **Low-risk actions** (read files, search, grep) — run automatically
- **High-risk actions** (write files, run commands, network requests) — require your approval
- **Dangerous actions** (delete, overwrite, access secrets) — blocked by default
Source code: https://github.com/AUTHENSOR/Authensor-for-OpenClaw
## When to Use This
Install Authensor Gateway if you:
- **Run marketplace skills you didn't write.** Third-party skills can execute Bash, write files, and make network requests. [ClawHavoc](https://snyk.io/blog/clawhavoc) found 341 malicious skills on ClawHub — Authensor gates every tool call before it runs.
- **Want approval before destructive actions.** Instead of blanket-allowing or blanket-denying, you choose which actions need your sign-off.
- **Need an audit trail.** Every action (allowed, denied, or pending) is logged with a receipt ID and timestamp.
- **Work in regulated environments.** Authensor provides evidence of human-in-the-loop oversight for compliance.
You do **not** need Authensor if you only use built-in OpenClaw tBot Reviews(1)
tiered approval gate for tool calls
authensor-gateway intercepts tool calls before execution and checks each against a policy: low risk reads run automatically, writes and network calls need approval, destructive actions are blocked outright. The design is careful about blast radius, since only action metadata leaves the machine while files, credentials, and conversation content stay local. The trade-offs are real. It requires two environment values, a control plane url and an authensor key, so it introduces a network dependency into every call and stops working if the control plane is unreachable. It is also model invocation disabled, so it acts as a gate rather than a tool the assistant invokes on a whim.
Use case: running untrusted marketplace skills safely
Study Guides(1)
Gating tool calls behind a policy check
This skill puts a checkpoint in front of tool calls. Each action is described to a remote policy service, which classifies it and decides whether it runs, waits for a person, or is refused outright, leaving a receipt behind either way. ## What it does - Classifies each action as low, high or dangerous risk. - Lets low risk reads run without interrupting anyone. - Pauses high risk writes and commands for approval. - Blocks destructive actions by default. - Sends only action metadata rather than file contents or keys. ## When it is the wrong choice It is a gate, so it adds a pause exactly where automation was wanted. A workflow that writes files or reaches the network on a schedule will stall waiting for a person, which makes this the wrong layer for a headless job. It also needs two values in the environment and a reachable service, so an offline host cannot evaluate anything. The skill's own note is the sharpest limitation: if you only use the tools that ship in the box, you may not need the gate at all, because the risk it addresses comes from third party skills. The guarantee is also about what leaves the machine rather than about what the action does, because the policy sees a description of the call and can only be as good as that description. ```json { "action": "write file", "risk": "high", "decision": "approval" } ``` ## Working notes - Only action metadata is sent to the policy service. - Destructive actions are blocked rather than queued. - The gate is aimed at third party skills rather than the built in set.
Quick Facts
Install
npx clawhub@latest install authensor-gateway