clawsec-suite

• You run an OpenClaw-based AI agent environment and want ongoing protection against newly discovered malicious or compromised skills.
• You need cryptographic assurance that advisory feeds and release archives haven't been tampered with before trusting them.
• You want a double-confirmation guardrail so that no skill removal or risky install can happen without explicit human approval.
• You are managing multiple ClawSec security skills and need a single setup/orchestration entrypoint with a dynamic skill catalog.

• You are not running an OpenClaw agent environment — this suite is purpose-built for the OpenClaw skill ecosystem and has no general-purpose use outside it.
• You need real-time, sub-second threat response; the suite is intentionally rate-limited (minimum 5-minute polling intervals) and approval-gated by design.

Polls the ClawSec advisory feed at https://clawsec.prompt.security/advisories/feed.json, tracks which advisories are new since the last check, and cross-references them against locally installed skills. Persistent state is stored in ~/.openclaw/clawsec-suite-feed-state.json to avoid duplicate notifications.

All advisory feeds and release archives are verified using detached signatures and a pinned public key before any content is trusted. The suite fails closed by default — unsigned feeds are rejected unless CLAWSEC_ALLOW_UNSIGNED_FEED=1 is explicitly set as a temporary migration bypass.

When an advisory flags an installed skill as malicious or removal-recommended, the suite notifies the user with full advisory context and requires a second explicit confirmation before any deletion or disable action proceeds. The hook and heartbeat are intentionally non-destructive by default.

A guarded_skill_install.mjs script checks advisory matches before any skill installation. If a match is found, it prints advisory context and exits with code 42, requiring a second --confirm-advisory flag before the install can continue — enforcing double confirmation at install time.

Advisories include exploitability_score (high, medium, low, or unknown) and exploitability_rationale fields. The suite encourages prioritizing by exploitability in addition to severity — a HIGH severity + HIGH exploitability advisory is treated as more urgent than a CRITICAL severity + LOW exploitability one.

Security teams can opt-in to suppressing reviewed advisories via a shared config file (.clawsec/allowlist.json or ~/.openclaw/security-audit.json). Suppression requires an enabledFor: ["advisory"] sentinel and per-entry fields including a mandatory reason and suppressedAt date for audit trail purposes.

Install ClawSec Suite as the baseline security layer for your OpenClaw agent. Enable the advisory guardian hook and optional cron schedule so every new session bootstraps with a feed scan, alerting you to newly discovered threats against your installed skills without manual intervention.

Before installing any new skill, run the guarded installer to automatically check it against the advisory feed. If a match is found, the install is blocked and advisory details are surfaced — a second explicit confirmation is required to proceed, preventing accidental installation of flagged skills.

For organizations managing first-party or vetted third-party skills, configure an advisory suppression allowlist to silence advisories your security team has already reviewed and accepted. The shared config supports both advisory and audit pipelines with a single file and full audit trail.

When deploying ClawSec Suite in air-gapped or high-assurance environments via manual download, use the provided shell script to verify the release archive checksum against a cryptographically signed manifest, with the release public key fingerprint pinned for out-of-band verification.