What does this skill do, and when should you use it?
clawsec-suite is the OpenClaw management entrypoint for the ClawSec security suite, version 0.1.16. It polls signed security advisories, tracks newly seen entries, and cross-references affected skills with local installations. When a skill is malicious or removal is recommended, it provides guidance and requires explicit user approval. It also supports signature and checksum verification, an advisory guardian hook, optional scheduled checks, and dynamic discovery of additional ClawSec skills.
Fetches remote or local advisory feeds, signatures, and checksum manifests; verifies signatures and hashes with OpenSSL, shasum, and jq; matches affected advisory entries against installed skills; reports new matches through an OpenClaw hook on agent bootstrap or new sessions; stores state in ~/.openclaw/clawsec-suite-feed-state.json; uses guarded_skill_install.mjs to stop an advisory-matched install with exit code 42 until a second confirmation is supplied; and discovers the current installable-skill catalog with discover_skill_catalog.mjs.
- An OpenClaw user who wants ongoing visibility into platform CVEs, community advisories, and malicious-skill reports.
- A team or operator that requires an advisory preflight and a second explicit confirmation before risky skill installation.
- A security engineer who needs release-signature, checksum, and advisory-feed verification.
- An administrator who wants affected local skills checked automatically at OpenClaw startup or in a new session.
- A user who wants to discover optional security skills from an authoritative catalog instead of maintaining a hard-coded list.
How do you install this skill?
- The manual installation flow deletes the existing same-named destination; confirm the path and create a recoverable backup first.
- The HEARTBEAT.md examples do not show signature or checksum verification, so their output alone should not be treated as trusted advisory data.
- The default workflow depends on remote feeds, catalog metadata, GitHub, and dynamic npx content; pin versions, verify sources, and assess mainland-China network reachability.
- CLAWSEC_ALLOW_UNSIGNED_FEED=1 and CLAWSEC_VERIFY_CHECKSUM_MANIFEST=0 weaken verification and should be restricted to short, controlled migration windows.
- Shell / CLI
- Network access
- Local filesystem
Node.jsnpxOpenClawcurljqshasumOpenSSLunzip
Recommended: npx clawhub@latest install clawsec-suite. You can also use the Vercel Skills CLI: npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw -y. The SKILL.md also documents a manual download flow with release-signature and checksum verification.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/prompt-security/clawsec.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/clawsec-suite" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
After installation, run: SUITE_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-suite"; node "$SUITE_DIR/scripts/setup_advisory_hook.mjs". For an optional scheduled check, using the documented default of every 6 hours, run node "$SUITE_DIR/scripts/setup_advisory_cron.mjs". Restart the OpenClaw gateway and run /new once for an immediate scan. Before installing a skill, run node "$SUITE_DIR/scripts/guarded_skill_install.mjs" --skill helper-plus --version 1.0.1; if an advisory match appears, review it and rerun with --confirm-advisory only after explicit approval.
What are this skill's strengths and limitations?
- Includes signed advisory artifacts and signature/checksum verification.
- Tracks new advisories and matches them against locally installed skills.
- Uses explicit double confirmation for malicious-skill removal and risky installs.
- Supports an OpenClaw hook, optional cron scheduling, and dynamic catalog discovery.
- Provides local-feed fallback and fail-closed advisory signature verification.
- The documented runtime integration is specifically for OpenClaw; other platforms would require adaptation.
- Requires Node.js, OpenClaw, curl, jq, OpenSSL, shasum, and unzip.
- Normally requires network access for remote advisories and catalog metadata.
- Enabling the hook or cron writes to the user's OpenClaw configuration area and may create persistent or unattended jobs.
- The supplied material gives no independent test results or performance measurements for this skill alone.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| ClawSec Suite Manager this page | 47 · Use with care | ★ 1.1k | 14d ago | AGPL-3.0 |
| Picoclaw Security Guardian | 55 · Use with care | ★ 1.1k | 14d ago | AGPL-3.0 |
| ClawHub Reputation Gate | 55 · Use with care | ★ 1.1k | 14d ago | AGPL-3.0 |
| NanoClaw Security Sentinel | 44 · Not recommended | ★ 1.1k | 14d ago | AGPL-3.0 |
| Soul Guardian File Integrity Guard | 55 · Use with care | ★ 1.1k | 14d ago | AGPL-3.0 |
How did FollowSkills review this skill?
The evidence shows default signature verification, remote-domain allowlisting, and explicit second confirmation for removal or risky installation. However, the manual installer directly runs rm -rf on the existing destination without rollback or backup, while npx/clawhub@latest, the remote catalog, and the advisory feed introduce dynamic supply-chain and data-flow risks. Sensitive-data handling is not addressed, so points are deducted.
The code and documentation cover event filtering, state persistence, path fallback, signature checks, and network-error handling, making the happy path plausible. However, the HEARTBEAT.md examples fetch and parse the feed without performing the documented signature/checksum verification; POSIX tools, the OpenClaw runtime, and unpinned npx dependencies are also required. Static review cannot confirm reproducibility of key paths, so points are deducted.
The target scenario, installation method, dependencies, and OpenClaw event triggers are fairly clear, with a local-feed fallback. However, the selected skill directly targets OpenClaw while the broader description implies multi-platform coverage; non-fit boundaries and semantic trigger limits are incomplete, and there is no Chinese-language or mainland-China reachability guidance, so points are deducted.
SKILL.md is well organized and includes installation, configuration, boundaries, examples, approval policy, versioning, a changelog, and AGPL-3.0 licensing. Maintenance ownership, stable release channels, dependency pinning, and troubleshooting are incomplete, and the dynamic catalog can change installable content without clearly documented governance, so points are deducted.
The skill plausibly delivers advisory polling, installed-skill matching, alerts, and approval gating, giving it clear core security value. However, operation depends on external feeds, OpenClaw hooks or cron, and several local tools; the heartbeat and runtime verification behavior are not fully consistent, and no representative execution evidence is included in the assessed material. Manual review remains necessary, so points are deducted.
The files provide signatures, a public-key fingerprint, checksums, state-file details, and implementation logic that support limited auditing. Nevertheless, this is a static-only review with no verifiable committed test suite, CI execution evidence, or independent reproduction; changelog test claims alone do not establish key-path verification, so points are deducted.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →