# clawsec-suite

This skill monitors ClawSec advisories, verifies signatures, and checks installed skills for affected entries. Use it when security checks need approval gates.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 868 installs · ★ 1125
- Author: prompt-security
- License: AGPL-3.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/prompt-security/clawsec/tree/HEAD/skills/clawsec-suite/SKILL.md
- Updated: 2026-10-25
- HTML: https://affpapa.org/en/nevibecode/skills/clawsec-suite

## What it does

clawsec-suite monitors a signed advisory feed, tracks which entries are new, and compares affected skills with the skills installed locally. It can recommend removing a malicious skill, while install and removal overrides still require explicit user approval.

The package includes trusted advisory data, hook setup scripts, a guarded installer, and runtime discovery for additional skills. Its OpenClaw hook scans on `agent:bootstrap` and `/new`; a separate script can create an `openclaw cron` job with a `6h` interval. The runtime requires `node`, `npx`, `openclaw`, `curl`, `jq`, `shasum`, `openssl`, and `unzip`. It fetches signed advisory artifacts and catalog metadata over the network, so check network access and trust settings before enabling automation.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add prompt-security/clawsec --skill clawsec-suite -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/clawsec-suite/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/clawsec-suite/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add prompt-security/clawsec --skill clawsec-suite -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/clawsec-suite/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add prompt-security/clawsec --skill clawsec-suite -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/clawsec-suite/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install prompt-security/clawsec clawsec-suite
```

2. **Manually: put the files in place**
- File: `.github/skills/clawsec-suite/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add prompt-security/clawsec --skill clawsec-suite -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/prompt-security/clawsec --path skills/clawsec-suite
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/clawsec-suite/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add prompt-security/clawsec --skill clawsec-suite -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/prompt-security/clawsec/tree/HEAD/skills/clawsec-suite/SKILL.md

## When to use it
- monitor new ClawSec advisories
- match affected skills against local installations
- ask for approval before removing a risky skill
- install add-on skills through a guarded script
- enable advisory checks with an OpenClaw hook

## Example prompts
- Check new ClawSec advisories and compare them with the installed skills.
- Show which local skills are affected and ask for approval before removing any of them.
- Set up the OpenClaw advisory hook and prepare a periodic check with `openclaw cron`.

## Similar
- [sandbox-guard](https://affpapa.org/en/nevibecode/skills/sandbox-guard.md) — skill · 483 installs
- [healthcheck](https://affpapa.org/en/nevibecode/skills/healthcheck.md) — skill · 5500 installs
- [skill-guard](https://affpapa.org/en/nevibecode/skills/skill-guard.md) — skill · 573 installs
- [webhook-integration](https://affpapa.org/en/nevibecode/skills/webhook-integration.md) — skill · 1100 installs
- [stripe-webhooks](https://affpapa.org/en/nevibecode/skills/stripe-webhooks.md) — skill · 595 installs
- [github-webhooks](https://affpapa.org/en/nevibecode/skills/github-webhooks.md) — skill · 487 installs

From the same set: [prompt-security/clawsec](https://affpapa.org/en/nevibecode/by/prompt-security/clawsec.md) — 2 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md