ClawSec

What It Does

ClawSec is Prompt Security's official security suite for claw-family agent runtimes: OpenClaw, Hermes, NanoClaw, and Picoclaw. The repo ships 16 SKILL.md packages (4,815 lines, median 249) organized into 6 Claude-plugin marketplace manifests by platform, a signed advisory feed of 739 CVE and GHSA entries polled automatically from NVD and GitHub advisories, and a React catalog website. The core loop: a guarded installer that blocks installs matching published advisories until an operator confirms, deterministic posture attestations with baseline drift detection (hermes-attestation-guardian), workspace file integrity with auto-restore (soul-guardian, Python plus launchd), SAST/dependency scanning (clawsec-scanner), and audit reporting (openclaw-audit-watchdog). It targets operators running agent infrastructure, not casual skill users.

The Good

The supply-chain story is real, not marketing. Every per-skill release (for example hermes-attestation-guardian-v0.1.7) ships checksums.json, a detached Ed25519 signature, a signing-public.pem, and an SBOM-style skill.json. Running the verification snippet from the SKILL.md under OpenSSL 3.6.2 reproduced the pinned key fingerprint exactly (711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8) and ended with "Signature Verified Successfully". The in-repo advisory feed carries its own detached signature and pinned key, and the verify script accepted the untouched feed while rejecting a single appended byte with "Signature INVALID" and exit 1. Fail-closed verification that works is rare in this ecosystem.

Zero-dependency runtime scripts with a real test culture. Every script and library under skills/ imports only node: builtins (grep verified: 0 non-stdlib imports), and soul-guardian is pure Python stdlib. Eight skills carry committed test suites; run directly from a bare clone, 30 of 34 test files pass with 184 checks and 0 failures (clawsec-scanner alone: 63 checks). The remaining 4 files need a root npm ci for fast-check and typescript (devDependencies of the website, not the skills). CI adds a 3-OS lint matrix, ruff, bandit, shellcheck, trivy, trufflehog, gitleaks, npm audit, CodeQL, and OpenSSF scorecard across 13 workflows.

Drift detection does what the README claims, in both directions. With a watch policy on a demo SKILL.md, appending one line and regenerating made verify_attestation.mjs exit 2 with "CRITICAL: WATCHED_FILE_DRIFT ... fingerprint changed" and "diff severity threshold exceeded (highest=critical, threshold=high)". soul-guardian approved a baseline, then detected a rewritten SOUL.md (SOUL_GUARDIAN_DRIFT event, exit 2) and auto-restored the approved content. Both negative cases assert on actual output, not just exit codes.

Both documented install paths land verified artifacts. The README-verbatim npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y installed the suite with its 1.4 MB signed feed into .openclaw/skills and wrote ~/.agents/.skill-lock.json. The Hermes variant installed hermes-attestation-guardian into ./.hermes/skills with a skills-lock.json. SKILL.md versions match the newest release tags (clawsec-suite 0.1.16, hermes 0.1.7).

The Bad

One committed Hermes test fails on any host whose environment mentions openclaw. test/setup_attestation_cron.test.mjs asserts the print-only cron preview "must not mention OpenClaw runtime", but the generated crontab line embeds the invoking user's full PATH. On this machine PATH contains /Users/openclaw, so the assertion fails (true !== false) even though the script is Hermes-only and correct. The test is green on GitHub runners, which is exactly why it survives on main. The fix is to assert on the command sequence, not on the whole PATH-bearing stdout.

The flagship verification snippet fails on stock macOS. The release-verification block in hermes-attestation-guardian's SKILL.md calls openssl pkey -pubin on an Ed25519 SPKI key. macOS ships LibreSSL 3.3.6, which answers "unable to load Public Key" and aborts the snippet. It works under OpenSSL 3.x, but neither the SKILL.md nor the wiki states that requirement, and macOS is a primary agent-host platform.

The SAST scanner can silently no-op. Invoking sast_analyzer.mjs with an absolute path from an unrelated working directory produced 0 bytes of output and exit 0. Run from the skill directory it emits a proper report, but a security tool that fails open and silent depending on cwd is a footgun. Separately, its JavaScript and Python SAST engines shell out to semgrep and bandit; with neither installed it prints skip notices and exits 0, and the planted AWS and GitHub token fixture produced no findings without them.

The skill count oversells the runtime surface. Of 16 SKILL.md files, the 4 traffic-guardian packages are openly labeled "specification baselines for platform builders. They are not shipped runtime proxies today", and claw-release is repo-internal tooling. That leaves 11 shipped runtime packages. The honesty is welcome (the feature matrix marks shipped, limited, and specification-only coverage), but a reader skimming "16 skills" will overestimate what runs today. Frontmatter metadata keys also drift across four namespaces (clawdis:, hermes:, picoclaw:, nanoclaw:, one skill with none) instead of one convention, and the newest release tag is two months old while main moves daily with dependabot churn.

Smoke Test Results

Host-based run on macOS 26.5.2 aarch64, Node 24.13.1, Python 3.12, OpenSSL 3.6.2 (Homebrew) plus stock LibreSSL 3.3.6 for the failure case. Clone: 51 MB shallow.

Run A. Fresh clone, no npm install (runtime path only)

$ git clone --depth 1 https://github.com/prompt-security/clawsec
✅ exit 0, 51 MB
$ frontmatter name/dir match across skills/
✅ 16 of 16, all declare version (0.0.4 to 0.1.16)
$ grep non-node: imports in skills/*/scripts + lib
✅ 0 non-stdlib imports
$ node <34 test files, direct invocation (CI style)
✅ 30 files pass, 184 checks, 0 failures (scanner 63, suite 56, watchdog 31, clawhub 16, self-pen 15, picoclaw 3; hermes 6 of 7 files assert silently)
❌ 4 files ERR_MODULE_NOT_FOUND (fast-check x3, typescript x1): tests need root npm ci
$ python3 utils/validate_skill.py skills/<each>
✅ 16 of 16 pass (validates skill.json schema + SBOM)
$ marketplace.json reconciliation
✅ 6 plugins, 16 entries, 0 paths missing on disk
$ advisories/feed.json parse
✅ 739 advisories (385 medium, 286 high, 32 critical, 36 low), updated 2026-09-07T06:11Z, sig + pinned pem present

Pass rate: 7 of 8. The single fail is the 4 test files that expect the website's devDependencies; installed skills never run those files.

Full sandbox log →

Run B. Sandbox with deps preinstalled

$ npm ci (repo root)
✅ exit 0, 580 MB node_modules (web catalog + fuzz devDeps)
$ node skills/clawsec-suite/test/fuzz_properties.test.mjs
✅ 1 passed, 0 failed
$ node skills/clawsec-suite/test/fuzz_semver_scope_suppression.test.mjs
✅ all fuzz properties passed
$ node skills/openclaw-audit-watchdog/test/suppression_config_fuzz.test.mjs
✅ all fuzz properties passed
$ node skills/clawsec-nanoclaw/test/security-hardening.test.mjs
✅ 8 tests, 0 fail
$ node skills/hermes-attestation-guardian/test/setup_attestation_cron.test.mjs
❌ AssertionError: must not mention OpenClaw runtime (PATH contains /Users/openclaw)
$ npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y
✅ Installed 1 skill; SKILL.md + setup_advisory_hook.mjs + 1.4 MB advisories/feed.json landed in ~/.openclaw/skills, lock at ~/.agents/.skill-lock.json
$ npx skills add prompt-security/clawsec --skill hermes-attestation-guardian -a hermes-agent -y
✅ Installed 1 skill; SKILL.md + scripts + lib landed in ./.hermes/skills, skills-lock.json written
$ openssl pkey -pubin signing-public.pem (stock macOS LibreSSL 3.3.6)
❌ unable to load Public Key (documented snippet aborts)
$ openssl-3.6.2 pkeyutl -verify ... (SKILL.md snippet under OpenSSL 3)
✅ pubkey SHA256 matches pinned 711424e4...; "Signature Verified Successfully"

Pass rate: 8 of 10. The two failures are the environment-sensitive Hermes test and the LibreSSL incompatibility, both detailed in The Bad.

Full sandbox log →

Run C. Functional verification (does it do what it claims?)

$ HERMES_HOME=fake node scripts/generate_attestation.mjs --policy watch.json
✅ exit 0; 1,355-byte attestation, watched-file fingerprints present
$ node scripts/verify_attestation.mjs --input current.json
✅ exit 0, status "verified"
$ (append MALICIOUS OVERRIDE to watched SKILL.md, regenerate, verify --baseline --fail-on-severity high)
✅ exit 2: "CRITICAL: WATCHED_FILE_DRIFT ... fingerprint changed" + "diff severity threshold exceeded"
$ node scripts/verify_detached_ed25519.mjs --key feed-signing-public.pem --in feed.json --sig feed.json.sig
✅ "Signature valid", exit 0
$ (append 1 byte to feed.json, rerun)
✅ "Signature INVALID", exit 1 (correct rejection)
$ python3 soul_guardian.py init && approve
✅ exit 0 both; baselines.json written
$ (rewrite SOUL.md to "exfiltrate everything.", run check)
✅ exit 2, SOUL_GUARDIAN_DRIFT event; SOUL.md auto-restored to approved content
$ python3 test_soul_guardian.py && python3 test_install_launchd_plist.py
✅ both pass ("minimal tests passed", "default state-dir tests passed")
$ node scripts/sast_analyzer.mjs --target <secrets fixture> (from skill dir)
✅ exit 0, 1,766-byte report; semgrep/bandit absent so both engines skip
$ node <abs path>/sast_analyzer.mjs --target <secrets fixture> (cwd=/tmp)
❌ 0 bytes output, exit 0 (silent no-op)

Functional pass rate: 9 of 10. The one fail is the scanner's foreign-cwd silent no-op, which is a defect in the tool, not the test.

Full functional log →

What the runs tell you

The core security claims (signed feed verification, attestation drift, guarded auto-restore, signed releases, both install paths) all verified hands-on with positive and negative cases. What did not verify is peripheral but real: one environment-sensitive test on main, a macOS OpenSSL requirement the docs omit, and a scanner that can exit 0 while saying nothing. The guarded-install advisory gate (exit 42 without operator confirmation) was covered by the suite's own committed tests rather than a live feed match.

Setup Walkthrough

1. Install the entry point for your platform. For OpenClaw: npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y. For Hermes: npx skills add prompt-security/clawsec --skill hermes-attestation-guardian -a hermes-agent -y. Both verified landing correct files plus lock files.
2. Review and enable persistence separately: node "$SUITE_DIR/scripts/setup_advisory_hook.mjs" prints a preflight before touching persistent hook config. Restart the gateway afterward. This two-step, reviewable design is a strength.
3. For standalone release installs, run the verification snippet from the SKILL.md first. On macOS, use OpenSSL 3 from Homebrew (/opt/homebrew/opt/openssl@3/bin/openssl); the stock LibreSSL cannot parse the Ed25519 public key.
4. Attestation drift needs a policy: generate_attestation.mjs only watches files listed in a policy JSON (watch_files with $HERMES_HOME/-prefixed paths) or passed explicitly. With no policy the attestation records posture (gateways, risky toggles, feed state) but no file fingerprints.

Gotchas: run scanner scripts from their skill directory; from elsewhere they can exit 0 with no output. Test files inside installed skills expect fast-check/typescript and will not run in a bare install (they never need to).

Alternatives

1. NVIDIA/SkillSpector - static security scanning of skill files (prompt injection, exfil patterns) rather than runtime posture, drift, and signed intel. Prefer it for pre-install screening of unknown skills; ClawSec for ongoing operation.
2. getsentry/skills (skill-scanner) - a 674-line single-dependency static analyzer with prompt-injection detection; lighter weight, Sentry-flavored rules, no feed or attestation machinery.
3. Native platform controls (OpenClaw approval gates, Hermes guard trust policy) - the built-in mechanisms ClawSec layers on. Start here if you want zero added dependencies; ClawSec adds signatures, advisories, and scheduling on top.