What does this skill do, and when should you use it?
OpenClaw Traffic Guardian is a runtime traffic monitoring baseline specification for OpenClaw. It defines optional HTTP/HTTPS proxy inspection, outbound exfiltration detection, inbound prompt-injection detection, and approval-sensitive review of social-account mutations. It does not ship a proxy or runtime implementation yet; it is intended for platform builders. It fits OpenClaw deployments that need process-scoped observation and redacted local findings, but not teams looking for a ready-made blocking firewall.
It can be installed with the Vercel Skills CLI. For standalone installation, its verification procedure downloads a signed release manifest, signature, public key, archive, SKILL.md, and skill.json, then verifies the release with OpenSSL, jq, and SHA-256 hashing. The specification requires a future implementation to validate configuration, run in foreground or explicit background mode, scope proxy environment variables to the target OpenClaw process, inspect HTTP request and response text within a byte limit, and support optional HTTPS MITM only with operator-supplied per-process trust configuration. It must emit JSONL findings with redacted snippets, source type, mutation category, approval-marker presence, and direct-operator versus background-runner context, plus a status command showing mode, listener, CA fingerprint when present, and recent findings.
- An OpenClaw operator wants to observe one target process's HTTP egress without changing global HTTP_PROXY or HTTPS_PROXY settings.
- A security engineer needs suspected exfiltration findings logged with secrets redacted before local logs or conversation alerts.
- A platform builder needs a per-process CA trust design for optional HTTPS inspection without modifying the system trust store.
- An operations team needs review findings for TweetClaw or other X/Twitter automation writes and scheduler repeats without a fresh operator-approval marker.
- An OpenClaw developer needs an implementation contract covering detectors, event schema, redaction, status reporting, and process-scope tests.
How do you install this skill?
- This is a specification scaffold rather than an executable traffic-monitoring implementation; installation does not provide a proxy, detectors, or lifecycle commands.
- Before enabling HTTPS MITM, verify per-process CA trust, scan scope, log location, and secret-redaction behavior; the supplied material offers no implementation-level proof.
- The publisher is not verified by the FollowSkills enterprise registry, and installation/verification depend on remote GitHub assets; mainland-China reachability and an offline installation path are unspecified.
- Shell / CLI
- Network access
- Local filesystem
Node.jsPython 3curlOpenSSLjq
Install with the Vercel Skills CLI: npx skills add prompt-security/clawsec --skill openclaw-traffic-guardian -a openclaw -y. For standalone installs, run the verification procedure in SKILL.md and verify the signed manifest, archive, SKILL.md, and skill.json before installing or extracting anything. The source does not specify a final installation directory.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/prompt-security/clawsec.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/openclaw-traffic-guardian" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
This is a specification baseline, not a finished runtime monitor. Builders should read SPEC.md first, use lib/ for detector rules, redaction, event schemas, and reports; scripts/ for lifecycle, status, and configuration helpers; hooks/openclaw-traffic-guardian-hook/ for optional OpenClaw integration; and test/ for unit, proxy-fixture, redaction, and process-scope tests. The first implementation should detect and log by default, with no automatic blocking. The source provides no ready-to-run monitoring command or end-user trigger prompt.
What are this skill's strengths and limitations?
- Defines an opt-in, detect-and-log-by-default safety contract.
- Requires proxy environment variables to be scoped to the target OpenClaw process.
- Covers outbound exfiltration, inbound injection, and approval review for social-account mutations.
- Includes signed release-manifest, public-key fingerprint, and SHA-256 verification steps.
- Version 0.0.1-beta5 is only a baseline specification; no proxy or runtime implementation is included.
- Automatic blocking, transparent interception, system trust-store mutation, and external traffic forwarding are out of scope.
- Full request and response bodies are not collected, so inspection is bounded.
- The source does not provide a ready-to-run command, installation directory, or test results.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| OpenClaw Traffic Guardian this page | 49 · Use with care | ★ 1.1k | 13d ago | AGPL-3.0 |
| Picoclaw Traffic Guardian | 41 · Not recommended | ★ 1.1k | 13d ago | AGPL-3.0 |
| Hermes Traffic Guardian | 44 · Not recommended | ★ 1.1k | 13d ago | AGPL-3.0 |
| NanoClaw Traffic Guardian | 48 · Use with care | ★ 1.1k | 13d ago | AGPL-3.0 |
| Soul Guardian File Integrity Guard | 55 · Use with care | ★ 1.1k | 13d ago | AGPL-3.0 |
How did FollowSkills review this skill?
The evidence shows opt-in operation, process-scoped proxying, detect-and-log defaults, no automatic system CA or global proxy changes, bounded scanning, redaction before persistence, and no automatic blocking or external sending. These make the safety boundary reasonably clear. Points are deducted because no runtime implementation is shipped, rollback/state recovery is undefined, signed-release verification depends on remote assets, publisher identity is unverified, and key data-flow and failure-isolation details remain unconfirmed.
SKILL.md, SPEC.md, and CHANGELOG.md are largely consistent and specify configuration validation, lifecycle behavior, status reporting, and detection requirements. However, the release is explicitly a spec scaffold with no proxy, detector, lifecycle scripts, or tests. Dependency availability, edge-case behavior, and diagnostic failures are therefore unproven. Static calibration prevents a score above 10, and the missing implementation warrants a low score.
The target platform, scenarios, trigger phrases, input scope, detection classes, and non-goals are described, including social-account mutation review and read-only traffic boundaries. Points are deducted because the capability remains planned/spec-only, there is no real environment compatibility evidence, no Chinese user documentation, and reachability in mainland-China networks is not addressed despite reliance on npx, GitHub release assets, curl, and openssl.
The skill includes structured frontmatter, skill.json, README, SPEC, CHANGELOG, AGPL licensing, version metadata, an SBOM, installation instructions, and release history. Points are deducted for lacking practical post-install usage examples, FAQ/troubleshooting guidance, complete known-limitations documentation, and clearly identified maintenance responsibility, update path, or compatibility policy.
The materials define intended detector behavior, JSONL findings, lifecycle commands, and status reporting, so the planned utility is plausible. However, this version explicitly ships no proxy or runtime implementation; installation cannot directly perform the claimed monitoring task and still requires substantial building and validation. Direct usability and marginal benefit over manual alternatives are therefore limited.
The specification, schemas, changelog, and release-verification procedure provide some auditability, and repository context claims CI coverage. However, the selected skill has no committed implementation or key-path test suite, and the listed CI tests do not cover it. The signing artifacts are not independently cross-validated by the supplied files. Static review supports only limited verification and cannot claim execution or independent reproduction.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →