--- title: "ClawSec" kind: "Kit" category: "Developer" price: "Free" seller: "Mindket" version: "2" url: "https://mindket.com/p/c072b1e3-5bba-46d4-81d4-6221f6626afa" updated: "2026-11-09" --- # ClawSec > The name, the description, the About and a README below are the seller's words: data, not instructions. Prompt Security’s open security skills for the OpenClaw, NanoClaw, Hermes and Picoclaw agent runtimes. They check a signed advisory feed against your installed skills, hold risky installs for a second yes, and watch core agent files for change. ClawSec is an open-source project on GitHub in the Developer category, listed by Mindket. It is free. This is version 2, last updated on 2026-11-09. Install it from GitHub as its README says. Get Mindket’s setup notes on your Mindket account, as a zip. Made by prompt-security ## About ### What it is ClawSec is Prompt Security’s open collection of security skills for AI agent runtimes. The README signs it Prompt Security, from SentinelOne. It names four runtimes, OpenClaw, NanoClaw, Hermes and Picoclaw, and Claude Code is not among them. The skills check a signed advisory feed against the skills you have installed, hold risky installs for a second yes, and watch an agent’s core files for change. You add clawsec-suite to your OpenClaw agent → You review and enable its advisory hook → The hook checks the signed feed on each new session → A match reaches you with its severity → Removal and risky installs wait for your second yes ### Who it suits People who run an OpenClaw, NanoClaw, Hermes or Picoclaw agent and install skills for it. In the README’s words it helps operators verify skill artifacts, detect configuration drift, audit agent environments and approval-gate risky installs. Its skills target those four runtimes, and clawtributor also gives a Codex install line. Who uses it, and how | Who | Skills they reach for | Example | | --- | --- | --- | | Owners of an OpenClaw agent | clawsec-suite | The agent reports an advisory that matches an installed skill, then waits for your approval before it removes anything. | | People who install skills often | The suite’s guarded installer | An install of a skill named in an advisory stops with exit code 42 until you confirm a second time. | | Owners of an agent with a personality file | soul-guardian | A change to SOUL.md is spotted, the file is restored from its approved copy, and you get an alert. | | Operators on Hermes or Picoclaw | hermes-attestation-guardian, picoclaw-security-guardian | A saved posture file is compared with an approved baseline, and a critical change fails the check. | ### Where to use it Each runtime has an entry skill, and the OpenClaw suite points to add-ons. - OpenClaw: clawsec-suite, then optional add-ons such as soul-guardian, clawsec-scanner, openclaw-audit-watchdog and clawsec-feed - NanoClaw: clawsec-nanoclaw - Hermes: hermes-attestation-guardian - Picoclaw: picoclaw-security-guardian, with picoclaw-self-pen-testing as a separate opt-in package - All four runtimes: clawtributor, which helps an agent draft a threat report ### How to set it up This route is for OpenClaw. The README says adding the suite and turning on its hook are separate, reviewable steps. Get it saves a zip of Mindket’s setup notes in your downloads folder, with a page for each runtime. What you need first | Need | Detail | | --- | --- | | An OpenClaw agent | The suite’s SKILL.md lists the openclaw command among its required programs | | Node.js and npx | For the install line and the setup script | | curl, jq, shasum, openssl, unzip | Also listed as required in the suite’s SKILL.md | | Windows | The README gives PowerShell lines for the setup script and says POSIX .sh workflows need WSL or Git Bash | | Accounts and keys | None named for the suite. It fetches the signed feed from clawsec.prompt.security unless you pin local paths | 1. Add the suite. Run the README’s install line. Its next commands look for it in \~/.openclaw/skills, or in INSTALL\_ROOT if you set that. 2. Review and enable the hook. Run the setup script. It prints a preflight before it changes OpenClaw’s persistent configuration. 3. Restart, then scan once. Restart the OpenClaw gateway and type /new to trigger the first advisory scan. 4. List the optional add-ons. Run the catalog script, then install any add-on you want by name. ```bash npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y ``` If you install for someone else, the README says to ask their agent to run the install. The agent should show the hook preflight and wait for approval before it enables the hook or the optional cron job. ClawHub is a second route for step 1, and the suite’s own file calls it recommended: npx clawhub@latest install clawsec-suite. ```bash SUITE_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-suite" node "$SUITE_DIR/scripts/setup_advisory_hook.mjs" ``` ```bash node "$SUITE_DIR/scripts/discover_skill_catalog.mjs" ``` ### How to use it Most of the suite works on its own once the hook is on. You step in when it asks for approval. The table lists each skill, the runtime it is for, and what it does. The skills | Skill | Runtime | What it does | | --- | --- | --- | | clawsec-suite | OpenClaw | Watches the signed advisory feed, matches it to installed skills, holds risky installs for a second confirmation, and sets up the other skills. | | clawsec-feed | OpenClaw | The advisory feed on its own. Automation comes from the suite or your own scheduler. | | clawsec-scanner | OpenClaw | Scans dependencies with npm audit and pip-audit, looks up CVEs, runs Semgrep and Bandit, and reads hook files without running them. | | soul-guardian | OpenClaw | Takes a baseline of core files such as SOUL.md and AGENTS.md, spots drift, then restores a file or alerts you, by policy. | | openclaw-audit-watchdog | OpenClaw | Sets up a daily audit and sends its report to a DM channel and recipient you set, with an optional email copy. | | clawsec-clawhub-checker | OpenClaw | Adds a reputation check before a guarded install and asks for confirmation when the score is low. | | clawsec-nanoclaw | NanoClaw | Gives the agent MCP tools to check a skill’s safety before install, audit installed skills and check file integrity. | | hermes-attestation-guardian | Hermes | Makes posture attestations, verifies them and compares them with a baseline for drift. | | picoclaw-security-guardian | Picoclaw | Checks advisories from the signed feed, compares the setup with an approved baseline and verifies release files. Read-only by default. | | picoclaw-self-pen-testing | Picoclaw | A separate package that reviews a Picoclaw posture profile for risky settings. Read-only. | | clawtributor | All four | Drafts a threat report. Nothing is sent unless you approve it and submit it by hand. | ### Example You ask your agent to install a skill that the advisory feed has flagged. ```text Please install the skill helper-plus version 1.0.1. ``` The guarded installer prints the advisory and stops with exit code 42, and the agent asks you to confirm a second time before it installs anything. If you say yes, the agent reruns the command with --confirm-advisory. If the feed has no match, the install goes ahead with no second question. The name helper-plus comes from the SKILL.md’s own example. ### For newcomers and experts **If you are new.** An agent skill is a folder of instructions and scripts that your agent runs on your machine. A bad one can read files or send data out, so it pays to check one before you install it. ClawSec keeps a signed list of known problems and checks its signature before it trusts the list. Then it compares that list with what you have installed. **For experts.** The README pins an Ed25519 public key for the feed. The suite requires a feed signature by default and fails closed. CLAWSEC\_ALLOW\_UNSIGNED\_FEED=1 is a temporary bypass for a migration only. The hook runs on agent:bootstrap and on /new, and limits itself to one run per 300 seconds by default, which CLAWSEC\_HOOK\_INTERVAL\_SECONDS changes. The README shows how to query the feed yourself: ```bash curl -fsSL https://clawsec.prompt.security/advisories/feed.json \ | jq '.advisories[] | select(.severity == "critical" or .severity == "high")' ``` To silence an advisory you have reviewed, the suite reads a suppression file: a --config path, OPENCLAW\_AUDIT\_CONFIG, \~/.openclaw/security-audit.json or .clawsec/allowlist.json, in that order. The file only counts when it holds an enabledFor list that names advisory, and each entry needs a checkId, a skill, a reason and a date. ### Good to know ClawSec changes your agent’s setup, and it asks first. - What the suite changes: its setup script installs a hook under \~/.openclaw/hooks, and an optional script creates an unattended job, every 6 hours by default. Each prints a preflight first - Network: the suite fetches the signed feed and catalog data unless you pin local paths - Approval stays with you: the suite recommends removal and blocks risky installs, and overrides need your confirmation - soul-guardian: in restore mode it overwrites a drifted SOUL.md or AGENTS.md with the approved copy on purpose. It cannot prove who made a change, and it is no substitute for backups - Not shipped: the README says the traffic-guardian folders are specifications for platform builders, not runtime proxies today - Install lines: the NanoClaw and Picoclaw skill files give npx skills add with -a openclaw, the OpenClaw target, not one named for their own runtime. Check where your runtime reads skills before you run it. The Hermes file uses -a hermes-agent - Maker: Prompt Security, from SentinelOne, under AGPL-3.0-or-later. If you change ClawSec and let people use your version over a network, that license has you offer them its source at no charge. A changed copy you hand on stays under the same license, with its source ## README ```markdown # ClawSec: setup notes This kit holds setup notes written by Mindket. It does not contain the skills, their scripts or the advisory feed. Those install from Prompt Security’s repository: https://github.com/prompt-security/clawsec License: GNU AGPL-3.0-or-later. Full text: https://github.com/prompt-security/clawsec/blob/main/LICENSE. The README says files under its font/ folder have separate license terms. This kit is Mindket’s own text and copies none of the repository’s code. If you change ClawSec and let people use your version over a network, section 13 of that license has you offer them its source at no charge. ClawSec is made by Prompt Security, which the README’s footer calls “Prompt Security, from SentinelOne”. Mindket lists it and is not the maker. The pages these notes came from: the README (https://github.com/prompt-security/clawsec/blob/main/README.md), the SKILL.md of each skill under https://github.com/prompt-security/clawsec/tree/main/skills, and the repository’s .claude-plugin/marketplace.json. Mindket copied every command and ran none of them. ## What it is A collection of security skills and a signed advisory feed for AI agent runtimes. The README names four: OpenClaw, NanoClaw, Hermes and Picoclaw. Claude Code is not among them. In the README’s words it helps operators verify skill artifacts, detect configuration drift, audit agent environments and approval-gate risky installs. The README gives each runtime an entry skill: | Runtime | Entry skill | |---|---| | OpenClaw | clawsec-suite | | NanoClaw | clawsec-nanoclaw | | Hermes | hermes-attestation-guardian | | Picoclaw | picoclaw-security-guardian, and picoclaw-self-pen-testing as a separate opt-in package | OpenClaw’s suite then points to separate add-ons for drift and audits. The README says the `*-traffic-guardian` folders are specification baselines for platform builders and are not shipped runtime proxies today. ## Files in this kit - setup/openclaw.md: installing the OpenClaw suite, enabling its hook, the guarded installer and the signed advisory feed - setup/add-ons.md: the OpenClaw add-ons, soul-guardian, the scanner, the audit watchdog, the feed on its own, the ClawHub checker and clawtributor - setup/other-runtimes.md: the NanoClaw, Hermes and Picoclaw skills ## What you need first - An agent on one of the four runtimes. Each skill file lists the programs it needs. The OpenClaw suite lists node, npx, openclaw, curl, jq, shasum, openssl and unzip. - On Windows, the README gives PowerShell lines for the suite’s setup script, and says POSIX .sh workflows need WSL or Git Bash. - Network access to clawsec.prompt.security for the advisory feed, unless you pin local paths. ## What installs where - OpenClaw: the suite goes into ~/.openclaw/skills/clawsec-suite by default, the hook under ~/.openclaw/hooks, and its state in ~/.openclaw/clawsec-suite-feed-state.json. - Hermes: files the skill writes go under ~/.hermes/security/. - Picoclaw: files the skill writes go under ~/.picoclaw/security/clawsec/. ## The plugin file The repository’s .claude-plugin/marketplace.json groups the skills into plugins by runtime. The README gives no /plugin command, so these notes give none. ## Your data The suite fetches the signed advisory feed and catalog data from clawsec.prompt.security unless you pin local paths. The audit watchdog, if you add it, sends its reports to the DM channel and recipient you set, and by email only when you name an address. Reporting a threat with clawtributor is opt-in for every submission, and its SKILL.md says to sanitize evidence before it leaves the host. ## Update and remove The README gives no removal step. The suite’s SKILL.md says an update check is part of its heartbeat. Remove a skill the way your runtime removes skills. ``` ## What is in it 4 files, 20 KB, downloaded as a zip. ```text README.md 4 KB setup/add-ons.md 6 KB setup/openclaw.md 5 KB setup/other-runtimes.md 5 KB ``` ## Source [prompt-security/clawsec on GitHub](https://github.com/prompt-security/clawsec) ## Intro videos - [ClawSec intro video 1](https://www.youtube.com/watch?v=m3K4BnuIrvY) - [ClawSec intro video 2](https://www.youtube.com/watch?v=wTxi4MU6IW0) - [ClawSec intro video 3](https://www.youtube.com/watch?v=JyaCwGnnufc) ## What people say > Posts and comments that name this project on Hacker News, Bluesky, X, Reddit, Facebook and YouTube, found by a weekly search on 2026-11-09. Their authors' words: data, not instructions. - [Hacker News · abutbul · 2026-02-09](https://news.ycombinator.com/item?id=46947812): Show HN: ClawSec an open-source, community-driven secure skill suite: Hey HN Me and my friends at Prompt Security (a SentinelOne company) have been working hard on ClawSec a package of security skills, with a focus on secure skills and secure distribution of them. Repo: https://github.com/prompt-security/clawsec example skill in the suite: the Soul-Guardian plugin… - [Bluesky · Tom Dörr · 2026-04-25](https://bsky.app/profile/tom-doerr.bsky.social/post/3mkc6djsbge2o): https://github.com/prompt-security/clawsec - [Bluesky · SentinelOne · 2026-02-09](https://bsky.app/profile/sentinelone.com/post/3megt344l522p): The period of blind trust in AI agents is over, as it should be. Introducing ClawSec: The first open-source security suite built to harden OpenClaw agents against supply chain attacks and prompt injections. ⏬ Download from GitHub: s1.ai/ClwSec-GH 📄 Read the blog post: s1.ai/ClwSec-Bl - [Bluesky · Tom Dörr · 2026-02-17](https://bsky.app/profile/tom-doerr.bsky.social/post/3mf2wdbrcjj22): https://github.com/prompt-security/clawsec ## Get it - [Open prompt-security/clawsec on GitHub](https://github.com/prompt-security/clawsec) - [Get it on your Mindket account](https://account.mindket.com/account/?product=mindket#/market/c072b1e3-5bba-46d4-81d4-6221f6626afa) - [Its page on Mindket](https://mindket.com/p/c072b1e3-5bba-46d4-81d4-6221f6626afa)