Skills Hook

const { createMoltbotHooks } = require("sec0-sdk/integrations/openclaw");

const hooks = createMoltbotHooks({
  // ...base config...
  mode: "enforce",
  skills: {
    enabled: true,
    resolve: ({ toolName, params }) => {
      // Return the active skill backing this tool call.
      // This can come from params, your registry, or workspace metadata.
      return params?.skill || null;
    },
    onScan: async ({ skill, skillRef, revisionRef }) => {
      // Run your scanner(s) and normalize to Sec0's finding shape.
      return {
        status: "pass",
        findings: [],
        scanId: `${skillRef}:${revisionRef}`,
      };
    },
    scanOnChangeOnly: true,
    blockOnChange: true,
    blockOnSeverity: "high",
  },
});

type SkillScanResult = {
  status: "pass" | "fail" | "pending";
  findings?: Array<{
    code?: string;
    title?: string;
    severity?: "low" | "medium" | "high" | "critical";
    message?: string;
  }>;
  scanId?: string;
  raw?: unknown;
};

security:
  side_effects:
    approve_high_risk: true
enforcement:
  deny_on:
    - skill_scan_failed
  escalate_on:
    - skill_scan_failed
    - skill_code_changed