Skip to content

Document a TweetClaw package smoke test #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kriptoburak wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Document a TweetClaw package smoke test #1

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
965ac92
Document TweetClaw package smoke test
kriptoburak May 12, 2026
16eca51
Address package compatibility test feedback
kriptoburak May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions docs/REAL_WORLD_VALIDATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,25 @@ This validation added parser support for:

The latest-format validation fixture now scans without undeclared metadata findings. It only reports the expected low external-network signal for the example URL.

## Third-Party Package Compatibility Test

ClawGuard can scan any public npm package that unpacks to an OpenClaw plugin or skill. Keep the package configurable so this example remains a repeatable compatibility test, not an endorsement of a specific package.

From a ClawGuard source checkout:

```bash
export CLAWGUARD_REPO="$PWD"
export PACKAGE="@xquik/tweetclaw@1.6.31"
WORKDIR="$(mktemp -d /tmp/clawguard-package-scan.XXXXXX)"
cd "$WORKDIR"
npm pack "$PACKAGE"
ARCHIVE="$(find . -maxdepth 1 -name '*.tgz' -print -quit)"
tar -xzf "$ARCHIVE"
node "$CLAWGUARD_REPO/src/cli.js" scan ./package --fail-on none
```

The example `PACKAGE` value points at TweetClaw, a public OpenClaw plugin package with an agent-facing skill, `openclaw.plugin.json`, and npm package metadata. Replace it with any package you want to check. Treat the result as scanner compatibility evidence only. It does not prove the remote package is safe, does not contact ClawHub, and does not mean ClawGuard endorses the package.

## Remaining Real-World Gaps

- Add optional digest/source verification for ClawHub plugin packages when metadata is available.
Expand Down