> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sec0.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Skills Hook

> Resolve active skills and run security scans on skill version or digest changes.

Use Skills hooks when tool calls are backed by versioned skills and you need policy enforcement on skill drift or scan outcomes.

## OpenClaw Hook Wiring

`sec0-sdk/integrations/openclaw` exposes Skills hooks through `createMoltbotHooks`.

```javascript theme={null}
const { createMoltbotHooks } = require("sec0-sdk/integrations/openclaw");

const hooks = createMoltbotHooks({
  // ...base config...
  mode: "enforce",
  skills: {
    enabled: true,
    resolve: ({ toolName, params }) => {
      // Return the active skill backing this tool call.
      // This can come from params, your registry, or workspace metadata.
      return params?.skill || null;
    },
    onScan: async ({ skill, skillRef, revisionRef }) => {
      // Run your scanner(s) and normalize to Sec0's finding shape.
      return {
        status: "pass",
        findings: [],
        scanId: `${skillRef}:${revisionRef}`,
      };
    },
    scanOnChangeOnly: true,
    blockOnChange: true,
    blockOnSeverity: "high",
  },
});
```

## Skills Hook Contract

### `skills.resolve`

`skills.resolve(ctx)` should return the active skill reference for the invocation (or `null` if no skill is active).

### `skills.onScan`

`skills.onScan({ skill, skillRef, revisionRef })` should return:

```typescript theme={null}
type SkillScanResult = {
  status: "pass" | "fail" | "pending";
  findings?: Array<{
    code?: string;
    title?: string;
    severity?: "low" | "medium" | "high" | "critical";
    message?: string;
  }>;
  scanId?: string;
  raw?: unknown;
};
```

## Policy Enforcement & Escalation

Use policy `enforcement.deny_on` and `enforcement.escalate_on` with the Skills reasons:

* `skill_version_changed`
* `skill_code_changed`
* `skill_scan_pending`
* `skill_scan_failed`

```yaml theme={null}
security:
  side_effects:
    approve_high_risk: true
enforcement:
  deny_on:
    - skill_scan_failed
  escalate_on:
    - skill_scan_failed
    - skill_code_changed
```

See the full schema in [Policy Schema Reference](/docs/reference/policy-schema).