prompt-security/clawsec

What it solves

ClawSec provides a security layer for AI agent runtimes, preventing the installation of risky skills and detecting unauthorized changes to agent configurations. It addresses the risk of "drift" (unauthorized file or configuration changes) and the deployment of untrusted or vulnerable software artifacts in agent environments.

How it works

ClawSec operates as a collection of security "skills" that integrate with agent platforms like OpenClaw, NanoClaw, Hermes, and Picoclaw. It uses a signed advisory feed to verify the integrity of skill artifacts and match installed skills against known risks. It implements a "guarded install" process that requires explicit confirmation before allowing a risky installation to proceed. Additionally, it provides platform-specific baselines to monitor for configuration drift and perform security audits.

Who it’s for

Operators of AI agent runtimes who need to verify skill artifacts, audit agent environments, and ensure that their agents remain secure and configured as intended.

Highlights

• Signed Intelligence: Uses a signed advisory feed and checksum manifests to verify risk against installed skills.
• Guarded Installs: Blocks risky installations based on advisory matches, requiring a second confirmation step.
• Integrity and Drift Detection: Monitors critical files and configurations for changes against established baselines.
• Multi-platform Support: Provides dedicated security packages for OpenClaw, NanoClaw, Hermes, and Picoclaw.