Picoclaw Security Guardian
A read-first security layer for Picoclaw advisory checks, configuration drift detection, and signed release verification.
Evidence shows read-only defaults, confined output paths, recommended signature verification, and fail-closed advisory checks; user confirmation, complete data-flow disclosure, rollback, and verified publisher identity are not established, so points are deducted.
Evidence includes deterministic profiles, drift comparison, explicit errors, argument validation, and CI references to relevant tests; however, nothing was executed and key test implementations were not supplied, so edge-case and installation-path reliability remain unproven.
The target platform, core scenarios, commands, and some capability boundaries are clear; trigger semantics, non-fit ranges, and Chinese support are not specified, while standalone verification depends on external services such as GitHub, so points are deducted.
The skill provides version metadata, AGPL licensing, a changelog, installation and quickstart instructions, test commands, and a vulnerability-reporting path; maintenance ownership, stable update guidance, complete dependency notes, FAQs, and limitations are incomplete, with version wording inconsistencies between README and SKILL.md.
Profile generation, drift detection, advisory filtering, and supply-chain verification address the stated core tasks and produce usable JSON; however, advisory checks depend on an externally established verification state, configuration detection is largely text-pattern based, and no representative output was reproduced here, so the static score is conservative.
Source code, commands, hash-verification procedures, and CI test references provide limited auditable evidence; there are no execution results, independent review, or corroborating third-party evidence, so the score remains within the static-review ceiling.
- Tests and install regression were not executed; CI job names are not proof of validation in this review.
- Configuration signals rely heavily on simple text matching and may produce false positives or false negatives; manually review critical findings.
- The publisher is not verified by the FollowSkills enterprise registry; independently validate the signing-key provenance before installation.
- Standalone installation and release verification examples depend on services such as GitHub; prepare reachable mirrors or offline artifacts where necessary.
- Profiles contain paths, file fingerprints, and secret-marker counts; restrict access to generated reports.
What does this skill do, and when should you use it?
Picoclaw Security Guardian is the Picoclaw-specific skill in the ClawSec suite, released here as version 0.0.6. It checks a locally supplied and verified advisory feed, creates a deterministic security profile, and compares it with an approved baseline. It also verifies Picoclaw release artifacts using checksums, a detached signature, and a public key. The documented posture is read-only by default, with no scheduler creation and fail-closed advisory verification.
Runs Node.js scripts that read a local advisory feed, feed-verification state, Picoclaw configuration, and approved baseline profiles; filters advisories for Picoclaw, AI gateways, all-platform entries, or affected packages containing Picoclaw; writes current-profile.json; detects critical drift involving public Web UI exposure, disabled Web UI authentication, disabled workspace restrictions, insecure or unsigned verification mode, verified-feed regression, and watched-file or release-artifact fingerprint changes; verifies release artifacts against a checksum manifest and detached signature; and writes reports or profiles under $PICOCLAW_HOME/security/clawsec/ unless temporary test paths are supplied.
- A Picoclaw operator running a Web UI, tool execution, or MCP servers needs recurring checks against an approved security baseline.
- A team maintaining a Picoclaw gateway needs to filter relevant CVEs, community advisories, or GHSA records from a local verified feed.
- An operator deploying Picoclaw on a router or embedded device needs release-artifact integrity and provenance checks before installation.
- A security responder handling a documented offline emergency needs a temporary, explicitly allowed unsigned-checksum or unsigned-feed diagnostic window.
What are this skill's strengths and limitations?
- Targets three concrete Picoclaw security workflows: advisory awareness, configuration drift, and release-artifact verification.
- Uses a read-only-by-default posture and fail-closed handling when advisory verification is not confirmed.
- Generates deterministic profiles and identifies defined classes of critical drift.
- Documents signed-manifest, public-key-fingerprint, and file-checksum verification steps.
- The skill requires Node.js; the complete verification examples also use shell, curl, OpenSSL, jq, and a SHA-256 utility.
- The supplied material does not provide the detailed architecture document or runtime performance and version-compatibility evidence.
- The default mode does not make outbound network requests, so advisory checks require a prepared local feed and verification state.
- Self-penetration testing is a separate `picoclaw-self-pen-testing` package and is not part of this skill.
How do you install this skill?
Install through the Vercel Skills CLI: npx skills add prompt-security/clawsec --skill picoclaw-security-guardian -a openclaw -y. For a standalone release, first verify the signed checksums.json, public-key fingerprint, archive, SKILL.md, and skill.json using the supplied procedure; install or extract the archive only after verification succeeds. No other client-specific installation procedure is documented.
How do you use this skill?
Check advisories with node scripts/check_advisories.mjs --feed ~/.picoclaw/security/clawsec/feed.json --state ~/.picoclaw/security/clawsec/feed-verification-state.json. Generate a profile with node scripts/generate_profile.mjs --output ~/.picoclaw/security/clawsec/current-profile.json. Check drift with node scripts/check_drift.mjs --baseline ~/.picoclaw/security/clawsec/baseline-profile.json --current ~/.picoclaw/security/clawsec/current-profile.json --fail-on critical. Verify an artifact with node scripts/verify_supply_chain.mjs --artifact ./picoclaw --checksums ./checksums.json --signature ./checksums.json.sig --public-key ./feed-signing-public.pem. Advisory verification is fail-closed by default; use --allow-unsigned or --allow-unsigned-checksums only for a documented emergency or offline window.