clawsec-suite

SKILL.md

Security suite manager with embedded advisory feed monitoring, cryptographic verification, and approval-gated malicious-skill response.

Monitors ClawSec advisory feed for new security advisories, cross-references them against installed skills, and requires explicit user approval before removing flagged skills

Includes cryptographic signature verification for release archives and advisory feeds using pinned public keys with out-of-band fingerprint validation

Provides guarded skill installation with double-confirmation flow: first confirmation to install, second after reviewing advisory details if matches are found

Embeds advisory guardian hook for OpenClaw with optional cron scheduling, plus dynamic skill catalog discovery and state tracking across sessions

Supports advisory suppression via allowlist configuration for reviewed or non-applicable advisories, with exploitability scoring to prioritize real-world threats

ClawSec Suite

Operational Notes

Required runtime: node, npx, openclaw, curl, jq, shasum, openssl, unzip

Side effects: setup scripts install an advisory hook under ~/.openclaw/hooks, optionally create an unattended openclaw cron job, and use npx clawhub@latest install for guarded installs

Network behavior: fetches signed advisory feed artifacts and remote catalog metadata unless you pin local paths

Trust model: the suite can recommend removal or block risky installs, but removal/install overrides stay approval-gated

This means clawsec-suite can:

monitor the ClawSec advisory feed,

track which advisories are new since last check,

cross-reference advisories against locally installed skills,

recommend removal for malicious-skill advisories and require explicit user approval first,

and still act as the setup/management entrypoint for other ClawSec protections.

Included vs Optional Protections