openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #182] [CLOSED] feat(security): add Trust Tier system for skill security visualization #285

New Issue
Closed
opened 2026-02-15 17:16:40 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:40 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/182
Author: @silence1ai
Created: 2/8/2026
Status: ❌ Closed

Base: main ← Head: feat/security-trust-tiers

📝 Commits (4)

  • b496e55 feat(security): add Trust Tier system for skill security visualization
  • f1942e4 Update src/styles.css
  • 9502b6e Update src/styles.css
  • 975d6b7 Update src/lib/trustTier.ts

📊 Changes

4 files changed (+612 additions, -0 deletions)

View changed files

➕ src/components/TrustBadge.tsx (+106 -0)
➕ src/lib/trustTier.test.ts (+168 -0)
➕ src/lib/trustTier.ts (+183 -0)
📝 src/styles.css (+155 -0)

📄 Description

Summary

This PR introduces a Trust Tier system to help users make informed decisions about skill safety before installing. It addresses the need for tiered security labels mentioned in #181.

Changes

New: Trust Tier Utility (src/lib/trustTier.ts)

  • Computes trust level based on VT scan status + publisher GitHub account age
  • Six tiers with clear semantics:
    • 🛡️ Verified - Clean VT scan + publisher account 30+ days old
    • ✅ Clean - Clean VT scan but publisher is new/unverified
    • ⏳ Pending - Awaiting security scan
    • ⚠️ Suspicious - VT flagged as suspicious
    • 🚫 Malicious - VT flagged as malicious
    • ❓ Unknown - Could not determine status
  • Helper functions: isSafeTier(), isWarningTier(), isEstablishedPublisher()

New: TrustBadge Component (src/components/TrustBadge.tsx)

  • Visual badge showing trust tier with icon + label
  • Compact mode for skill cards (icon only with tooltip)
  • Detailed mode for skill pages (with description + metadata)
  • Fully accessible with ARIA labels

New: Trust Tier Styles (src/styles.css)

  • Color-coded badges matching severity levels
  • Full dark mode support
  • Hover effects and responsive design

New: Tests (src/lib/trustTier.test.ts)

  • Comprehensive test coverage for all tier computation logic
  • Edge case coverage (missing data, moderation flags, etc.)

Related Issues

Usage Example

import { getTrustTier } from '../lib/trustTier'
import { TrustBadge } from '../components/TrustBadge'

const tier = getTrustTier(skill, owner, latestVersion)
<TrustBadge tier={tier} compact />

Next Steps (follow-up PRs)

  • Integrate TrustBadge into SkillCard.tsx and SkillDetailPage.tsx
  • Add trust tier filter to skill search/browse

Testing

  • Added unit tests for all trust tier logic
  • Manual testing: N/A (component not yet integrated into pages)

Greptile Overview

Greptile Summary

This PR adds a Trust Tier system for skills: a new src/lib/trustTier.ts utility to compute tiers from moderation + VirusTotal scan status + publisher GitHub account age, a TrustBadge/TrustBadgeWithDetails UI component to render the tier, corresponding badge styles in src/styles.css, and Vitest unit tests covering the tiering logic.

The changes are currently self-contained (not yet integrated into pages), but they introduce new CSS and a new public-facing tier computation API intended to be consumed by skill cards/detail pages.

Confidence Score: 3/5

  • This PR is close to mergeable but has a couple of concrete issues that should be fixed first.
  • Two definite problems were found in the current diff: an invalid CSS gradient token in the suspicious tier styling and unused imports in the new trustTier utility (likely failing lint/typecheck). There is also a logic mapping question around treating vtStatus === 'not_found' as pending that should be confirmed against backend semantics to avoid mislabeling tiers.
  • src/styles.css, src/lib/trustTier.ts

Context used:

  • Context from dashboard - AGENTS.md (source)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/182 **Author:** [@silence1ai](https://github.com/silence1ai) **Created:** 2/8/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `feat/security-trust-tiers` --- ### 📝 Commits (4) - [`b496e55`](https://github.com/openclaw/clawhub/commit/b496e55b8c93f5c68efed935dc8d3599049d836c) feat(security): add Trust Tier system for skill security visualization - [`f1942e4`](https://github.com/openclaw/clawhub/commit/f1942e4aa6bda05c4418a66359edf703436550d1) Update src/styles.css - [`9502b6e`](https://github.com/openclaw/clawhub/commit/9502b6ea551d8a1453f09dcd6863ed9da7c5f975) Update src/styles.css - [`975d6b7`](https://github.com/openclaw/clawhub/commit/975d6b7597709cfb6f20a697cd5ae516c33807a6) Update src/lib/trustTier.ts ### 📊 Changes **4 files changed** (+612 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `src/components/TrustBadge.tsx` (+106 -0) ➕ `src/lib/trustTier.test.ts` (+168 -0) ➕ `src/lib/trustTier.ts` (+183 -0) 📝 `src/styles.css` (+155 -0) </details> ### 📄 Description ## Summary This PR introduces a **Trust Tier system** to help users make informed decisions about skill safety before installing. It addresses the need for tiered security labels mentioned in #181. ## Changes ### New: Trust Tier Utility (`src/lib/trustTier.ts`) - Computes trust level based on VT scan status + publisher GitHub account age - Six tiers with clear semantics: - 🛡️ **Verified** - Clean VT scan + publisher account 30+ days old - ✅ **Clean** - Clean VT scan but publisher is new/unverified - ⏳ **Pending** - Awaiting security scan - ⚠️ **Suspicious** - VT flagged as suspicious - 🚫 **Malicious** - VT flagged as malicious - ❓ **Unknown** - Could not determine status - Helper functions: `isSafeTier()`, `isWarningTier()`, `isEstablishedPublisher()` ### New: TrustBadge Component (`src/components/TrustBadge.tsx`) - Visual badge showing trust tier with icon + label - **Compact mode** for skill cards (icon only with tooltip) - **Detailed mode** for skill pages (with description + metadata) - Fully accessible with ARIA labels ### New: Trust Tier Styles (`src/styles.css`) - Color-coded badges matching severity levels - Full dark mode support - Hover effects and responsive design ### New: Tests (`src/lib/trustTier.test.ts`) - Comprehensive test coverage for all tier computation logic - Edge case coverage (missing data, moderation flags, etc.) ## Related Issues - Addresses #181 (tiered security labels) - Helps address security concerns raised in #159, #154, #152 ## Usage Example ```tsx import { getTrustTier } from '../lib/trustTier' import { TrustBadge } from '../components/TrustBadge' const tier = getTrustTier(skill, owner, latestVersion) <TrustBadge tier={tier} compact /> ``` ## Next Steps (follow-up PRs) - Integrate `TrustBadge` into `SkillCard.tsx` and `SkillDetailPage.tsx` - Add trust tier filter to skill search/browse ## Testing - Added unit tests for all trust tier logic - Manual testing: N/A (component not yet integrated into pages) <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR adds a Trust Tier system for skills: a new `src/lib/trustTier.ts` utility to compute tiers from moderation + VirusTotal scan status + publisher GitHub account age, a `TrustBadge`/`TrustBadgeWithDetails` UI component to render the tier, corresponding badge styles in `src/styles.css`, and Vitest unit tests covering the tiering logic. The changes are currently self-contained (not yet integrated into pages), but they introduce new CSS and a new public-facing tier computation API intended to be consumed by skill cards/detail pages. <h3>Confidence Score: 3/5</h3> - This PR is close to mergeable but has a couple of concrete issues that should be fixed first. - Two definite problems were found in the current diff: an invalid CSS gradient token in the suspicious tier styling and unused imports in the new trustTier utility (likely failing lint/typecheck). There is also a logic mapping question around treating `vtStatus === 'not_found'` as `pending` that should be confirmed against backend semantics to avoid mislabeling tiers. - src/styles.css, src/lib/trustTier.ts <!-- greptile_other_comments_section --> **Context used:** - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=a1d58d20-b4dd-4cbb-973a-9fd7824e1921)) <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:40 -05:00
yindo closed this issue 2026-02-15 17:16:40 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#285
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?