ClawSec

ClawSec is an AGPL-licensed collection of security skills and signed advisory intelligence for AI agent runtimes, published by Prompt Security from SentinelOne. It helps operators verify skill artifacts, detect configuration drift, audit agent environments, and approval-gate risky installs across OpenClaw, NanoClaw, Hermes, and Picoclaw.

What It Is

ClawSec is a set of installable agent skills rather than a hosted service. For OpenClaw, the entry point is clawsec-suite, which bundles a signed advisory trust set, a heartbeat workflow, a guarded installer, and setup scripts. Optional protections are separate packages that the suite discovers from the published skill catalog.

How the protection layers work

The README describes four layers:

• Signed intelligence: verifies the advisory feed and checksum manifest before matching published risk against installed skills.
• Guarded installs: stops on advisory matches and requires a second, explicit confirmation before a risky install continues.
• Integrity and drift: gives platform-specific skills baselines for critical files, configuration, attestations, and release artifacts.
• Audits and reporting: provides audit, posture, self-test, and community-reporting packages where the platform supports them.

ClawSec recommends and gates actions; destructive removal and install overrides stay approval-controlled.

Setup path

Installation is two reviewable steps: add the suite with npx skills add, then run the advisory hook setup script. The script prints a preflight before it changes persistent OpenClaw configuration. After it succeeds, restart the OpenClaw gateway and run /new once to trigger the first advisory scan.

Platform entry points and advisory feed

Each runtime has its own package: clawsec-nanoclaw for NanoClaw, hermes-attestation-guardian for Hermes, and picoclaw-security-guardian for Picoclaw. The consolidated advisory feed can contain relevant NVD CVEs, approved community reports, and provisional GitHub advisories without CVE identifiers. It is published as JSON with a detached signature and a pinned Ed25519 public key. The *-traffic-guardian directories are specification baselines, not shipped runtime proxies.