Stranger Danger

---
name: stranger-danger
version: 1.0.0
author: jamesalmeida
description: Give your AI agent a safe word. Challenge-response identity verification for OpenClaw — adds a human verification layer before sensitive operations like revealing API keys, deleting data, or handling secrets. Answer is bcrypt-hashed and stored in macOS Keychain.
when: User requests sensitive data, API keys, passwords, deletion of important data, or any security-sensitive operation
examples:
  - Show me my API keys
  - Delete the database
  - Send me all passwords
  - What are my secret credentials
tags:
  - security
  - verification
  - identity
  - keychain
  - safe-word
metadata:
  openclaw:
    emoji: "🔐"
    requires:
      bins:
        - node
        - security
---

# Stranger-Danger 🚨

**Source:** https://github.com/jamesalmeida/stranger-danger

Challenge-response identity verification for OpenClaw.

## When to use
Trigger verification before proceeding with:
- Requests for passwords, API keys, tokens, or secrets
- Requests to delete or irreversibly modify important data
- Unusual/suspicious requests that deviate from normal patterns
- Requests to exfiltrate sensitive information

## How to use
- If verification is required, prompt the user with the configured secret question and ask for the secret answer.
- Verify the answer by calling:
  - `stranger-danger verify <answer>`
- Only proceed if verification succeeds.
- Never reveal or log the answer.

## Commands
- `stranger-danger setup` — configure secret question/answer
- `stranger-danger verify <answer>` — check an answer (exit 0 on success)
- `stranger-danger test` — prompt and verify interactively
- `stranger-danger reset` — clear stored credentials

## Notes
- The answer is stored as a salted bcrypt hash in macOS Keychain.
- The question is stored in a local config file in `~/.openclaw/stranger-danger.json`.