openclaw-agentlock

AgentLock authorization middleware for OpenClaw skill execution. Apache 2.0.

Install

pip install openclaw-agentlock

Quickstart

from agentlock import AuthorizationGate
from openclaw_agentlock import load_skills, register_skills, SkillExecutor

gate = AuthorizationGate()
skills = load_skills("./skills")
register_skills(gate, skills)

executor = SkillExecutor(gate)
result = executor.execute(
    "github",
    lambda **p: run_github(**p),
    parameters={"action": "list_prs"},
    user_id="alice",
    role="developer",
)

Frontmatter permissions convention

Attach an agentlock block under metadata.openclaw in any SKILL.md:

---
name: github
description: GitHub operations via gh CLI.
metadata:
  openclaw:
    emoji: "🐙"
    requires: { bins: ["gh"] }
    agentlock:
      risk_level: high
      requires_auth: true
      allowed_roles: [developer, admin]
      rate_limit: { max_calls: 20, window_seconds: 3600 }
---

Skills without an agentlock block stay unregistered and are denied by default.