clawsec-suite

What This Skill Does

The clawsec-suite is a comprehensive security management framework for the OpenClaw agent ecosystem. It serves as an integrated command center for maintaining agent integrity by monitoring, validating, and managing security advisories. The suite is designed to function as an early warning system, tracking the ClawSec advisory feed and cross-referencing it against your locally installed skills. If a installed component is flagged in the advisory database, the suite alerts the user and provides a guided, approval-gated mechanism to prune malicious or compromised skills, ensuring the agent remains in a trusted state.

Beyond defensive monitoring, clawsec-suite acts as an entrypoint for the secure installation of additional OpenClaw modules. It includes a guarded installer that validates cryptographic signatures of incoming packages to prevent supply-chain attacks. By leveraging the dynamic catalog discovery found at https://clawsec.prompt.security/skills/index.json, the suite ensures that you are always interacting with the latest, verified list of add-on protections, falling back to local metadata when offline or unreachable.

Installation

Installation is streamlined through the clawhub ecosystem, which manages dependency resolution and environment setup. For most users, the recommended approach is executing 'npx clawhub@latest install clawsec-suite'. For advanced users requiring high-assurance verification, manual installation is supported via GitHub releases. This method involves downloading the package and performing a manual PGP/SHA-256 validation of the provided release-signing public key (SHA-256: 711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8). Always ensure that your environment variables, specifically INSTALL_ROOT, are correctly exported and that path variables are shell-agnostic (using non-quoted home variables in bash/zsh or Join-Path in PowerShell).

Use Cases

Use the clawsec-suite to conduct periodic security audits of your current OpenClaw configuration. It is ideal for security-conscious developers who integrate third-party skills and require a verifiable layer of trust. It is also a critical tool for production environments where automated drift detection regarding installed skills is necessary to mitigate vulnerability exposure.

Example Prompts

1. "Clawsec-suite, please run a security audit of my currently installed skills and check for any new advisory alerts."
2. "Update my local skill catalog using the official ClawSec index and list all available security modules."
3. "Clawsec, are any of my installed extensions marked as malicious in the current advisory feed?"

Tips & Limitations

Always verify the fingerprint of the public key during initial setup to ensure a chain of trust. The suite requires periodic connectivity to the ClawSec advisory feed to be truly effective against zero-day threats. While the suite can identify risks, it is not a replacement for traditional system-level antivirus software; it operates strictly within the OpenClaw agent environment. Ensure your cron jobs for the included hooks are correctly scheduled to guarantee the heartbeat monitoring stays active.