Clawsec

What This Skill Does

ClawSec Monitor is a sophisticated, transparent HTTP/HTTPS proxy designed specifically for AI agent environments. By functioning as a "man-in-the-middle" (MITM) inspector, it sits between your AI agents and the internet, providing real-time visibility into all outgoing requests and incoming responses. It is designed to mitigate the risks associated with autonomous agents by enforcing security policies and identifying potential threats, such as data exfiltration or malicious injection attempts.

Technically, ClawSec intercepts encrypted traffic by generating and signing per-host certificates using a local Certificate Authority (CA). This allows the proxy to decrypt, scan, and re-encrypt traffic, ensuring that the AI agent's communications remain secure while providing the operator with a full audit trail of activity. It scans for sensitive patterns like leaked API keys (e.g., Anthropic, OpenAI, AWS), private keys, SSH credentials, and sensitive Unix file paths. Additionally, it identifies malicious patterns associated with command injection, such as attempts to pipe web traffic into a shell, reverse shell execution, or destructive system commands like 'rm -rf'.

Installation

To install the ClawSec skill, execute the following command in your terminal: clawhub install openclaw/skills/skills/chrisochrisochriso-cmyk/clawsec. Once installed, ensure you perform the one-time HTTPS MITM setup to allow the proxy to inspect encrypted traffic. This involves installing the generated CA certificate from /tmp/clawsec/ca.crt into your machine's trust store. For macOS, use the security add-trusted-cert command; for Ubuntu/Debian, use update-ca-certificates. Alternatively, you can configure per-process trust by setting environment variables like REQUESTS_CA_BUNDLE or NODE_EXTRA_CA_CERTS to point to the ca.crt file.

Use Cases

ClawSec is primarily used in high-security environments where AI agents are granted access to sensitive data or cloud infrastructure. Security engineers use it to audit agent behavior and detect if an agent has been compromised or tricked into leaking secrets. It is also an essential tool for developers testing autonomous code-generation agents, as it acts as a sandbox firewall that prevents malicious code execution or unintended data exposure during the development lifecycle.

Example Prompts

1. "/clawsec start --no-mitm"
2. "/clawsec status"
3. "/clawsec threats --limit 20"

Tips & Limitations

Always ensure the local CA certificate is properly installed in your system trust store to avoid SSL/TLS handshake errors. If an application does not respect system-wide certificate stores, you must explicitly set the relevant environment variables. Note that while ClawSec provides powerful inspection capabilities, it does not prevent agents from bypassing the proxy if they are configured to ignore system proxy settings or if the proxy process itself is killed. Always monitor the agent's environment integrity alongside these logs.