Repolode
Submit
prompt-security

prompt-security/clawsec

A security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw AI agents, covering file drift detection, advisory checks and guarded installs.

View on GitHubWebsite
Stars
1,125
Forks
112
Open issues
32
Last commit
6 hours ago

What is it?

ClawSec is a collection of security skills for AI agent runtimes such as OpenClaw, NanoClaw, Hermes and Picoclaw. It helps operators verify skill artifacts, detect changes to protected agent files like SOUL.md, audit the agent environment, and require explicit confirmation before a risky skill install proceeds.

The suite is built around signed advisory intelligence. A feed of CVEs, community reports and provisional GitHub advisories is verified against a pinned Ed25519 key before it is matched against installed skills. Each platform has its own entry point, such as clawsec-suite for OpenClaw or hermes-attestation-guardian for Hermes, and optional protections are installed as separate packages.

ClawSec recommends and gates actions, while destructive removal and install overrides stay under operator approval. Some traffic-guardian directories are specification baselines for platform builders and are not runtime proxies yet.

Key features

  • 01Verifies signed advisory feeds and checksum manifests before matching risks to installed skills.
  • 02Detects drift in protected agent files such as SOUL.md against recorded baselines.
  • 03Stops risky installs on advisory matches until the user explicitly confirms.
  • 04Provides separate audit, posture and self-test packages for supported platforms.
  • 05Offers a guided setup for enabling the OpenClaw advisory hook.

Use cases

  • Operators running OpenClaw agents who want to catch unexpected changes to agent instruction files.
  • Teams that install community skills and need advisory checks before installation.
  • Hermes or Picoclaw users who want attestation or posture checks on their agent environment.
  • Platform builders reviewing specification baselines for agent traffic protection.

Quick start

  1. 1

    Add the OpenClaw clawsec-suite skill

    npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y
  2. 2

    Review the preflight and enable the advisory hook

    SUITE_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-suite" && node "$SUITE_DIR/scripts/setup_advisory_hook.mjs"
  3. 3

    Restart the OpenClaw gateway and run /new once to trigger the first advisory scan

Things to know

  • Licensed under AGPL-3.0-or-later, a strong copyleft license that applies to modified network-deployed versions.
  • Built for specific agent runtimes (OpenClaw, NanoClaw, Hermes, Picoclaw), so it is useless outside them.
  • The traffic-guardian directories are specification baselines only and are not shipped runtime proxies.

Topics

#ai-agent#security#openclaw#hermes#supply-chain-security#vulnerability-advisory#drift-detection#llm-security#clawdbot#clawdbot-skill

FAQ

What is clawsec?
A security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw AI agents, covering file drift detection, advisory checks and guarded installs. ClawSec is a collection of security skills for AI agent runtimes such as OpenClaw, NanoClaw, Hermes and Picoclaw. It helps operators verify skill artifacts, detect changes to protected agent files like SOUL.md, audit the agent environment, and require explicit confirmation before a risky skill install proceeds.
Is clawsec free to use? What license does it have?
clawsec is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
Is clawsec still maintained?
Actively maintained. The last commit to clawsec was on Oct 22, 2026.
What can I use clawsec for?
Operators running OpenClaw agents who want to catch unexpected changes to agent instruction files. Teams that install community skills and need advisory checks before installation. Hermes or Picoclaw users who want attestation or posture checks on their agent environment. Platform builders reviewing specification baselines for agent traffic protection.
How do I install clawsec?
Add the OpenClaw clawsec-suite skill: npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y Review the preflight and enable the advisory hook: SUITE_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-suite" && node "$SUITE_DIR/scripts/setup_advisory_hook.mjs" Restart the OpenClaw gateway and run /new once to trigger the first advisory scan
Where can I get clawsec?
The source code and installation instructions are on GitHub: https://github.com/prompt-security/clawsec

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects