openexec-skill_skill

Overview

This skill provides a source-distributed deterministic execution service with pinned dependencies and strict approval requirements. It runs only actions backed by a signed approval artifact when in ClawShield mode and emits verifiable receipt hashes for every attempt. The runtime performs no outbound HTTP or governance calls and never installs runtime packages or downloads code dynamically.

How this skill works

OpenExec accepts structured execution requests and enforces deterministic handlers from a static registry. It verifies replay protection (nonce uniqueness), generates a verifiable receipt for each attempt, and — when configured for ClawShield mode — validates an Ed25519-signed approval artifact offline before allowing execution. All verification and execution occur without outbound network calls unless the operator explicitly configures an external database URL.

When to use it

• When you need deterministic, auditable execution of pre-approved actions
• When execution must require an explicit signed approval artifact in production
• When outbound network isolation is required during execution
• When you need verifiable receipts for compliance or auditing
• When you want a lightweight service that avoids runtime package installation

Best practices

• Run behind containerization, VM isolation, or hardened hosts for OS-level protection
• Use ClawShield mode with a securely stored Ed25519 public key for production approvals
• Pin and review the static handler registry before deployment; avoid dynamic handler registration
• Configure OPENEXEC_ALLOWED_ACTIONS to restrict permitted operations in sensitive environments
• Persist execution records in a controlled database and restrict DB network access

Example use cases

• Execute pre-approved infrastructure tasks where each execution must produce an auditable receipt
• Run deterministic maintenance or migration actions that must not fetch or run new code at runtime
• Enforce governance workflows that require an external signing authority to approve executions
• Provide replay-protected demo or staging operations with deterministic outcomes for testing
• Archive and verify historical executions using emitted receipt hashes for forensic review