Website · Skill catalog · Security feed · Documentation · Releases

ClawSec is an AGPL collection of security skills and signed advisory intelligence for AI agent runtimes. It helps operators verify skill artifacts, detect configuration drift, audit agent environments, and approval-gate risky installs across OpenClaw, NanoClaw, Hermes, and Picoclaw.

---

Install the OpenClaw suite

The OpenClaw entry point is clawsec-suite. Adding the package and activating its persistent hook are separate, reviewable steps.

1. Add the suite

npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y

This installs the suite with its signed advisory trust set, heartbeat workflow, guarded installer, and setup scripts. Optional protections remain separate packages that the suite discovers from the published catalog.

2. Review and enable the advisory hook

SUITE_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-suite"
node "$SUITE_DIR/scripts/setup_advisory_hook.mjs"

The setup script prints its preflight before it changes persistent OpenClaw configuration. After it succeeds, restart the OpenClaw gateway and run /new once to trigger the first advisory scan.

To see the current optional protections:

node "$SUITE_DIR/scripts/discover_skill_catalog.mjs"

Installing for someone else? Ask their agent to install clawsec-suite with the command above, show the hook preflight, and wait for approval before enabling the hook or optional cron job.

Shell and path notes

For bash and zsh, keep home variables expandable:

export INSTALL_ROOT="$HOME/.openclaw/skills"

Do not single-quote paths that contain $HOME. In PowerShell, build the path explicitly:

$env:INSTALL_ROOT = Join-Path $HOME ".openclaw\skills"
node "$env:INSTALL_ROOT\clawsec-suite\scripts\setup_advisory_hook.mjs"

POSIX .sh workflows require WSL or Git Bash on Windows.

---

See it work

Detect and respond to agent-file drift

The soul-guardian demo changes a protected agent file, detects the mismatch, and walks through the response.

Watch the MP4 with audio →

Watch the suite installation walkthrough

Open the MP4 with audio →

---

How ClawSec protects an agent

Protection layer	What it does
Signed intelligence	Verifies the advisory feed and checksum manifest before matching published risk against installed skills.
Guarded installs	Stops on advisory matches and requires a second, explicit confirmation before a risky install can continue.
Integrity and drift	Gives platform-specific skills baselines for critical files, configuration, attestations, and release artifacts.
Audits and reporting	Provides focused audit, posture, self-test, and community-reporting packages where the platform contract supports them.

ClawSec recommends and gates actions; destructive removal and install overrides remain approval-controlled.

Platform entry points

• OpenClaw — start with clawsec-suite for signed advisory monitoring and guarded installs, then discover separate drift and audit protections.
• NanoClaw — use clawsec-nanoclaw for NanoClaw-specific advisory, integrity, verification, and security-tool workflows.
• Hermes — use hermes-attestation-guardian for signed advisory checks, guarded verification, deterministic attestations, and baseline drift detection.
• Picoclaw — use picoclaw-security-guardian for posture, advisory, drift, and release-artifact checks. Self-pen testing is a separate opt-in package.

The *-traffic-guardian directories are specification baselines for platform builders. They are not shipped runtime proxies today.

Browse every package in the live skill catalog or the repository’s skills/ directory.

Skill feature matrix

The full package comparison is preserved in the wiki, including shipped, limited, and specification-only coverage.

Compare every skill in the feature matrix →

---

Query the signed advisory channel

The consolidated feed can contain relevant NVD CVEs, approved community reports, and provisional GitHub advisories that do not yet have CVE identifiers.

curl -fsSL https://clawsec.prompt.security/advisories/feed.json \
  | jq '.advisories[] | select(.severity == "critical" or .severity == "high")'

Trust material lives beside the feed:

• Advisory feed
• Detached feed signature
• Pinned Ed25519 public key
• Signing and verification runbook

The legacy /releases/latest/download/feed.json endpoint remains a compatibility mirror. New consumers should use the canonical /advisories/feed.json endpoint.

---

Build, test, and contribute

Run the web catalog locally:

npm install
npm run dev

Run the repository’s local quality gate before pushing:

./scripts/prepare-to-push.sh

Validate a skill package directly:

python utils/validate_skill.py skills/clawsec-feed

Start with these references:

• Architecture
• Platform verification
• Testing
• Release automation
• Contributing guide
• Security policy

The source of truth for project documentation is wiki/. GitHub Wiki pages and LLM-ready exports are generated from those files.

---

Translations

English · Deutsch · Español · Français · 日本語 · 한국어

Localized wiki indexes: DE · ES · FR · JA · KO · EN

---

License

ClawSec source code is licensed under GNU AGPL-3.0-or-later. See LICENSE. Files under font/ have separate license terms and are not used by the README artwork.

ClawSec · Prompt Security, from SentinelOne
Verify before your agent trusts.