Create example OpenClaw plugin using before_install

[Patrick-Erichsen]

Create an example plugin using the before_install hook on OpenClaw to demonstrate skill scanning capabilities.

Branch: feat/openclaw-plugin

Acceptance criteria:

• Example plugin demonstrates running ClawScan before skill install via OpenClaw's before_install hook.
• Documentation explains how to try the plugin locally.
• The example stays out of the README roadmap until it is ready to ship.

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed July 2, 2026, 10:57 AM ET / 14:57 UTC.

Summary
Keep open: the checked-out main/release does not contain the example plugin, the named branch has candidate work but no open PR, and the issue is collaborator-authored so it needs explicit project follow-through.

Reproducibility: not applicable. this is a feature/example request rather than a bug report. Source inspection shows the checked-out main tree lacks the plugin directory while the named branch contains candidate plugin files.

Ways to help us reproduce this

• Add a screenshot or short recording showing the behavior.
• Add expected vs actual behavior.
• Include redacted logs or terminal output.

Next step
A collaborator-authored issue points at an existing branch, so the next step is maintainer review of whether to open or land that branch as a focused PR.

Review details

Best possible solution:

Land a focused plugin-example PR from the branch when ready, with local usage docs, hook behavior proof, and no new ClawHub-specific public clawscan flags.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a feature/example request rather than a bug report. Source inspection shows the checked-out main tree lacks the plugin directory while the named branch contains candidate plugin files.

Is this the best way to solve the issue?

Yes, if it remains a separate OpenClaw plugin example with docs and proof. Adding ClawHub-specific flags or broad scanner policy directly to the public CLI would be the wrong shape for this repository.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• The example depends on OpenClaw plugin hook behavior outside this repository, so a future PR should include real local OpenClaw plugin proof.
• The issue references a branch rather than an open PR, so review and merge readiness are not yet represented in the normal PR workflow.

Codex review notes: model internal, reasoning high; reviewed against bf47e6de48ea.

Label changes

Label changes:

• add P2: This is a normal-priority security workflow improvement with a clear branch and acceptance criteria, but it is not an urgent regression.
• add impact:security: The requested before_install hook would run ClawScan before skill installation and can block security findings.
• add issue-rating: 🌊 off-meta tidepool: Current issue advisory state selects this label.
• add clawsweeper:no-new-fix-pr: Current issue advisory state selects this label.
• add clawsweeper:needs-maintainer-review: Current issue advisory state selects this label.
• add clawsweeper:needs-product-decision: Current issue advisory state selects this label.

Label justifications:

• P2: This is a normal-priority security workflow improvement with a clear branch and acceptance criteria, but it is not an urgent regression.
• impact:security: The requested before_install hook would run ClawScan before skill installation and can block security findings.

Evidence reviewed

What I checked:

• Issue scope: The issue asks for an example plugin, local try-it documentation, and keeping the README roadmap clean until the example is ready.
• Current main lacks plugin files: The checked-out main tree has no openclaw-plugin/examples/plugins path or before_install implementation files. (bf47e6de48ea)
• Current README only points to future branch work: The checked-out README says OpenClaw plugin support is being developed on feat/openclaw-plugin using before_install, which is not the requested shipped example itself. (README.md:112, bf47e6de48ea)
• Release provenance: The checked-out HEAD is tagged v0.1.1, so the latest provided release also lacks the plugin example present only off main. (bf47e6de48ea)
• Named branch has candidate plugin work: GitHub branch inspection shows openclaw-plugin files including README, plugin manifest, source, and tests on feat/openclaw-plugin. (openclaw-plugin/src/index.ts, 5cec0b347af8)
• Branch provenance: The named branch history includes Patrick Erichsen commits adding and hardening the OpenClaw ClawScan plugin and install hook. (openclaw-plugin/src/index.ts, e42ce2d2e3c3)

Likely related people:

• Patrick-Erichsen: GitHub branch history for feat/openclaw-plugin shows Patrick Erichsen authored the plugin and before_install hook commits referenced by this issue. (role: feature branch author; confidence: high; commits: dba09a90d1f6, e42ce2d2e3c3, 78f75778116c; files: openclaw-plugin/README.md, openclaw-plugin/openclaw.plugin.json, openclaw-plugin/src/index.ts)
• Vincent Koc: Blame on the checked-out README, VISION.md, and ClawHub prompt points to Vincent Koc for the current roadmap and product-boundary text around this area. (role: current docs and vision contributor; confidence: medium; commits: bf47e6de48ea; files: README.md, VISION.md, internal/profiles/clawhub/prompt.md)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.