ClawSec

What it is

ClawSec is Prompt Security’s open collection of security skills for AI agent runtimes. The README signs it Prompt Security, from SentinelOne. It names four runtimes, OpenClaw, NanoClaw, Hermes and Picoclaw, and Claude Code is not among them. The skills check a signed advisory feed against the skills you have installed, hold risky installs for a second yes, and watch an agent’s core files for change.

1. You add clawsec-suite to your OpenClaw agent
2. You review and enable its advisory hook
3. The hook checks the signed feed on each new session
4. A match reaches you with its severity
5. Removal and risky installs wait for your second yes

Who it suits

People who run an OpenClaw, NanoClaw, Hermes or Picoclaw agent and install skills for it. In the README’s words it helps operators verify skill artifacts, detect configuration drift, audit agent environments and approval-gate risky installs. Its skills target those four runtimes, and clawtributor also gives a Codex install line.

Where to use it

Each runtime has an entry skill, and the OpenClaw suite points to add-ons.

• OpenClaw: clawsec-suite, then optional add-ons such as soul-guardian, clawsec-scanner, openclaw-audit-watchdog and clawsec-feed
• NanoClaw: clawsec-nanoclaw
• Hermes: hermes-attestation-guardian
• Picoclaw: picoclaw-security-guardian, with picoclaw-self-pen-testing as a separate opt-in package
• All four runtimes: clawtributor, which helps an agent draft a threat report

How to set it up

This route is for OpenClaw. The README says adding the suite and turning on its hook are separate, reviewable steps. Get it saves a zip of Mindket’s setup notes in your downloads folder, with a page for each runtime.

1. Add the suite. Run the README’s install line. Its next commands look for it in ~/.openclaw/skills, or in INSTALL_ROOT if you set that.
2. Review and enable the hook. Run the setup script. It prints a preflight before it changes OpenClaw’s persistent configuration.
3. Restart, then scan once. Restart the OpenClaw gateway and type /new to trigger the first advisory scan.
4. List the optional add-ons. Run the catalog script, then install any add-on you want by name.

npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y

If you install for someone else, the README says to ask their agent to run the install. The agent should show the hook preflight and wait for approval before it enables the hook or the optional cron job. ClawHub is a second route for step 1, and the suite’s own file calls it recommended: npx clawhub@latest install clawsec-suite.

SUITE_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-suite"
node "$SUITE_DIR/scripts/setup_advisory_hook.mjs"

node "$SUITE_DIR/scripts/discover_skill_catalog.mjs"

How to use it

Most of the suite works on its own once the hook is on. You step in when it asks for approval. The table lists each skill, the runtime it is for, and what it does.

Example

You ask your agent to install a skill that the advisory feed has flagged.

Please install the skill helper-plus version 1.0.1.

The guarded installer prints the advisory and stops with exit code 42, and the agent asks you to confirm a second time before it installs anything.

If you say yes, the agent reruns the command with --confirm-advisory. If the feed has no match, the install goes ahead with no second question. The name helper-plus comes from the SKILL.md’s own example.

For newcomers and experts

If you are new. An agent skill is a folder of instructions and scripts that your agent runs on your machine. A bad one can read files or send data out, so it pays to check one before you install it. ClawSec keeps a signed list of known problems and checks its signature before it trusts the list. Then it compares that list with what you have installed.

For experts. The README pins an Ed25519 public key for the feed. The suite requires a feed signature by default and fails closed. CLAWSEC_ALLOW_UNSIGNED_FEED=1 is a temporary bypass for a migration only. The hook runs on agent:bootstrap and on /new, and limits itself to one run per 300 seconds by default, which CLAWSEC_HOOK_INTERVAL_SECONDS changes. The README shows how to query the feed yourself:

curl -fsSL https://clawsec.prompt.security/advisories/feed.json \
  | jq '.advisories[] | select(.severity == "critical" or .severity == "high")'

To silence an advisory you have reviewed, the suite reads a suppression file: a --config path, OPENCLAW_AUDIT_CONFIG, ~/.openclaw/security-audit.json or .clawsec/allowlist.json, in that order. The file only counts when it holds an enabledFor list that names advisory, and each entry needs a checkId, a skill, a reason and a date.

Good to know

ClawSec changes your agent’s setup, and it asks first.

• What the suite changes: its setup script installs a hook under ~/.openclaw/hooks, and an optional script creates an unattended job, every 6 hours by default. Each prints a preflight first
• Network: the suite fetches the signed feed and catalog data unless you pin local paths
• Approval stays with you: the suite recommends removal and blocks risky installs, and overrides need your confirmation
• soul-guardian: in restore mode it overwrites a drifted SOUL.md or AGENTS.md with the approved copy on purpose. It cannot prove who made a change, and it is no substitute for backups
• Not shipped: the README says the traffic-guardian folders are specifications for platform builders, not runtime proxies today
• Install lines: the NanoClaw and Picoclaw skill files give npx skills add with -a openclaw, the OpenClaw target, not one named for their own runtime. Check where your runtime reads skills before you run it. The Hermes file uses -a hermes-agent
• Maker: Prompt Security, from SentinelOne, under AGPL-3.0-or-later. If you change ClawSec and let people use your version over a network, that license has you offer them its source at no charge. A changed copy you hand on stays under the same license, with its source