clawsec-feed
installsforks
How to install clawsec-feed?
prompt-security/clawsec/clawsec-feed
$npx -y skills add prompt-security/clawsec --skill clawsec-feedSecurity advisory feed package for OpenClaw-related threats and vulnerabilities. The upstream feed is updated daily; local automation is handled by clawsec-suite or the operator.
SKILL.md
| 1 | # ClawSec Feed 📡 |
| 2 | |
| 3 | Security advisory feed monitoring for AI agents. Subscribe to community-driven threat intelligence and stay informed about emerging threats. |
| 4 | |
| 5 | The default `feed.json` is the consolidated agent feed. It includes NVD CVEs, approved community advisories, and provisional GitHub Security Advisories that do not have CVE IDs yet. |
| 6 | |
| 7 | ## Vercel Skills Installation |
| 8 | |
| 9 | Install with the Vercel Skills CLI for this harness: |
| 10 | |
| 11 | ```bash |
| 12 | npx skills add prompt-security/clawsec --skill clawsec-feed -a openclaw -y |
| 13 | ``` |
| 14 | |
| 15 | ## Operational Notes |
| 16 | |
| 17 | - Required runtime for standalone installation: `bash`, `curl`, `jq`, `shasum`, `unzip` |
| 18 | - Side effects: standalone install only writes local skill files |
| 19 | - Network behavior: downloads release metadata/artifacts and, if you choose to poll manually, fetches the advisory feed |
| 20 | - Trust model: this package does not itself create cron jobs or submit data externally; automation is delegated to `clawsec-suite` or your own scheduler |
| 21 | |
| 22 | **An open source project by [Prompt Security](https://prompt.security)** |
| 23 | |
| 24 | --- |
| 25 | |
| 26 | ## Installation Options |
| 27 | |
| 28 | You can get clawsec-feed in two ways: |
| 29 | |
| 30 | ### Option A: Bundled with ClawSec Suite (Recommended) |
| 31 | |
| 32 | **If you've installed clawsec-suite, you may already have this!** |
| 33 | |
| 34 | ClawSec-feed is bundled alongside ClawSec Suite to provide crucial CVE and threat intelligence information. When you install the suite, if you don't already have the feed installed, it will be deployed from the bundled copy. |
| 35 | |
| 36 | **Advantages:** |
| 37 | - Convenient - no separate download needed |
| 38 | - Standard location - installed to `~/.openclaw/skills/clawsec-feed/` |
| 39 | - Preserved - if you already have feed installed, it won't be overwritten |
| 40 | - Single verification - integrity checked as part of suite package |
| 41 | |
| 42 | ### Option B: Standalone Installation (This Page) |
| 43 | |
| 44 | Install clawsec-feed independently without the full suite. |
| 45 | |
| 46 | **When to use standalone:** |
| 47 | - You only need the advisory feed (not other suite components) |
| 48 | - You want to install before installing the suite |
| 49 | - You prefer explicit control over feed installation |
| 50 | |
| 51 | **Advantages:** |
| 52 | - Lighter weight installation |
| 53 | - Independent from suite |
| 54 | - Direct control over installation process |
| 55 | |
| 56 | Continue below for standalone installation instructions. |
| 57 | |
| 58 | Standalone installation is a network download workflow. Verify the release source and the provided checksums before installing it on production hosts. |
| 59 | |
| 60 | --- |
| 61 | |
| 62 | Installation Steps: |
| 63 | Agents should review scripts before execution! |
| 64 | |
| 65 | ```bash |
| 66 | # Get latest clawsec-feed release tag |
| 67 | LATEST_TAG=$(curl -sSL https://api.github.com/repos/prompt-security/ClawSec/releases | \ |
| 68 | jq -r '[.[] | select(.tag_name | startswith("clawsec-feed-v"))][0].tag_name') |
| 69 | |
| 70 | # Download SKILL.md from latest release |
| 71 | SKILL_URL="https://github.com/prompt-security/clawsec/releases/download/$LATEST_TAG/SKILL.md" |
| 72 | curl -sSL --fail --show-error "$SKILL_URL" |
| 73 | ``` |
| 74 | |
| 75 | Once you have this skill file, proceed to **[Deploy ClawSec Feed](#deploy-clawsec-feed)** below. |
| 76 | |
| 77 | --- |
| 78 | |
| 79 | ## Release Artifact Verification |
| 80 | |
| 81 | For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metadata/SBOM source, and the release pipeline signs `checksums.json` with the ClawSec release key. |
| 82 | |
| 83 | ```bash |
| 84 | set -euo pipefail |
| 85 | |
| 86 | SKILL_NAME="clawsec-feed" |
| 87 | VERSION="0.0.11" |
| 88 | REPO="prompt-security/clawsec" |
| 89 | TAG="${SKILL_NAME}-v${VERSION}" |
| 90 | BASE="https://github.com/${REPO}/releases/download/${TAG}" |
| 91 | ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip" |
| 92 | TMP_DIR="$(mktemp -d)" |
| 93 | trap 'rm -rf "$TMP_DIR"' EXIT |
| 94 | |
| 95 | RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8" |
| 96 | |
| 97 | curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json" |
| 98 | curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig" |
| 99 | curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem" |
| 100 | curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME" |
| 101 | curl -fsSL "$BASE/SKILL.md" -o "$TMP_DIR/SKILL.md" |
| 102 | curl -fsSL "$BASE/skill.json" -o "$TMP_DIR/skill.json" |
| 103 | |
| 104 | ACTUAL_PUBKEY_SHA256="$(openssl pkey -pubin -in "$TMP_DIR/signing-public.pem" -outform DER | shasum -a 256 | awk '{print $1}')" |
| 105 | if [ "$ACTUAL_PUBKEY_SHA256" != "$RELEASE_PUBKEY_SHA256" ]; then |
| 106 | echo "ERROR: signing-public.pem fingerprint mismatch" >&2 |
| 107 | exit 1 |
| 108 | fi |
| 109 | |
| 110 | openssl base64 -d -A -in "$TMP_DIR/checksums.sig" -out "$TMP_DIR/checksums.sig.bin" |
| 111 | openssl pkeyutl -verify -rawin -pubin \ |
| 112 | -inkey "$TMP_DIR/signing-public.pem" \ |
| 113 | -sigfile "$TMP_DIR/checksums.sig.bin" \ |
| 114 | -in "$TMP_DIR/checksums.json" >/dev/null |
| 115 | |
| 116 | hash_file() { |
| 117 | if command -v shasum >/dev/null 2>&1; then |
| 118 | shasum -a 256 "$1" | awk '{print $1}' |
| 119 | else |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
