openclaw-audit-watchdog

Name: openclaw-audit-watchdog
Author: prompt-security

681installs112forks

How to install openclaw-audit-watchdog?

prompt-security/clawsec/openclaw-audit-watchdog

$npx -y skills add prompt-security/clawsec --skill openclaw-audit-watchdog

Installs into the current project.

Summary

Automated daily security audits for OpenClaw agents with DM delivery and optional email reporting. Runs deep audits, creates or updates a recurring cron job, and sends formatted reports to configured recipients.

Files · 1

View on GitHub

SKILL.md

1	# Prompt Security Audit (openclaw)
2
3	## Vercel Skills Installation
4
5	Install with the Vercel Skills CLI for this harness:
6
7	```bash
8	npx skills add prompt-security/clawsec --skill openclaw-audit-watchdog -a openclaw -y
9	```
10
11	## Installation Options
12
13	You can get openclaw-audit-watchdog in two ways:
14
15	### Option A: Bundled with ClawSec Suite (Recommended)
16
17	If you've installed clawsec-suite, you may already have this!
18
19	Openclaw-audit-watchdog is bundled alongside ClawSec Suite to provide crucial automated security audit capabilities. When you install the suite, if you don't already have the audit watchdog installed, it will be deployed from the bundled copy.
20
21	Advantages:
22	- Convenient - no separate download needed
23	- Standard location - installed to `~/.openclaw/skills/openclaw-audit-watchdog/`
24	- Preserved - if you already have audit watchdog installed, it won't be overwritten
25	- Single verification - integrity checked as part of suite package
26
27	### Option B: Standalone Installation (This Page)
28
29	Install openclaw-audit-watchdog independently without the full suite.
30
31	When to use standalone:
32	- You only need the audit watchdog (not other suite components)
33	- You want to install before installing the suite
34	- You prefer explicit control over audit watchdog installation
35
36	Advantages:
37	- Lighter weight installation
38	- Independent from suite
39	- Direct control over installation process
40
41	Standalone installation usually involves a network download from the published GitHub release. Verify the release source and archive integrity before installing it on production hosts.
42
43	Continue below for standalone installation instructions.
44
45	---
46
47	## Release Artifact Verification
48
49	For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metadata/SBOM source, and the release pipeline signs `checksums.json` with the ClawSec release key.
50
51	```bash
52	set -euo pipefail
53
54	SKILL_NAME="openclaw-audit-watchdog"
55	VERSION="0.1.9"
56	REPO="prompt-security/clawsec"
57	TAG="${SKILL_NAME}-v${VERSION}"
58	BASE="https://github.com/${REPO}/releases/download/${TAG}"
59	ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip"
60	TMP_DIR="$(mktemp -d)"
61	trap 'rm -rf "$TMP_DIR"' EXIT
62
63	RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"
64
65	curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
66	curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
67	curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
68	curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"
69	curl -fsSL "$BASE/SKILL.md" -o "$TMP_DIR/SKILL.md"
70	curl -fsSL "$BASE/skill.json" -o "$TMP_DIR/skill.json"
71
72	ACTUAL_PUBKEY_SHA256="$(openssl pkey -pubin -in "$TMP_DIR/signing-public.pem" -outform DER \| shasum -a 256 \| awk '{print $1}')"
73	if [ "$ACTUAL_PUBKEY_SHA256" != "$RELEASE_PUBKEY_SHA256" ]; then
74	echo "ERROR: signing-public.pem fingerprint mismatch" >&2
75	exit 1
76	fi
77
78	openssl base64 -d -A -in "$TMP_DIR/checksums.sig" -out "$TMP_DIR/checksums.sig.bin"
79	openssl pkeyutl -verify -rawin -pubin \
80	-inkey "$TMP_DIR/signing-public.pem" \
81	-sigfile "$TMP_DIR/checksums.sig.bin" \
82	-in "$TMP_DIR/checksums.json" >/dev/null
83
84	hash_file() {
85	if command -v shasum >/dev/null 2>&1; then
86	shasum -a 256 "$1" \| awk '{print $1}'
87	else
88	sha256sum "$1" \| awk '{print $1}'
89	fi
90	}
91
92	verify_manifest_file() {
93	asset="$1"
94	path="$2"
95	expected="$(jq -r --arg asset "$asset" '.files[$asset].sha256 // empty' "$TMP_DIR/checksums.json")"
96	if [ -z "$expected" ]; then
97	echo "ERROR: checksums.json missing $asset" >&2
98	exit 1
99	fi
100	actual="$(hash_file "$path")"
101	if [ "$actual" != "$expected" ]; then
102	echo "ERROR: checksum mismatch for $asset" >&2
103	exit 1
104	fi
105	}
106
107	expected_archive="$(jq -r '.archive.sha256 // empty' "$TMP_DIR/checksums.json")"
108	if [ -z "$expected_archive" ]; then
109	echo "ERROR: checksums.json missing archive.sha256" >&2
110	exit 1
111	fi
112	actual_archive="$(hash_file "$TMP_DIR/$ZIP_NAME")"
113	if [ "$actual_archive" != "$expected_archive" ]; then
114	echo "ERROR: archive c

People who liked this also viewed

6 picks

Type

openclaw-audit-watchdog

681installs112forks

View on GitHub

How to install openclaw-audit-watchdog?

prompt-security/clawsec/openclaw-audit-watchdog

$npx -y skills add prompt-security/clawsec --skill openclaw-audit-watchdog

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Prompt Security Audit (openclaw)
2
3	## Vercel Skills Installation
4
5	Install with the Vercel Skills CLI for this harness:
6
7	```bash
8	npx skills add prompt-security/clawsec --skill openclaw-audit-watchdog -a openclaw -y
9	```
10
11	## Installation Options
12
13	You can get openclaw-audit-watchdog in two ways:
14
15	### Option A: Bundled with ClawSec Suite (Recommended)
16
17	If you've installed clawsec-suite, you may already have this!
18
19	Openclaw-audit-watchdog is bundled alongside ClawSec Suite to provide crucial automated security audit capabilities. When you install the suite, if you don't already have the audit watchdog installed, it will be deployed from the bundled copy.
20
21	Advantages:
22	- Convenient - no separate download needed
23	- Standard location - installed to `~/.openclaw/skills/openclaw-audit-watchdog/`
24	- Preserved - if you already have audit watchdog installed, it won't be overwritten
25	- Single verification - integrity checked as part of suite package
26
27	### Option B: Standalone Installation (This Page)
28
29	Install openclaw-audit-watchdog independently without the full suite.
30
31	When to use standalone:
32	- You only need the audit watchdog (not other suite components)
33	- You want to install before installing the suite
34	- You prefer explicit control over audit watchdog installation
35
36	Advantages:
37	- Lighter weight installation
38	- Independent from suite
39	- Direct control over installation process
40
41	Standalone installation usually involves a network download from the published GitHub release. Verify the release source and archive integrity before installing it on production hosts.
42
43	Continue below for standalone installation instructions.
44
45	---
46
47	## Release Artifact Verification
48
49	For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metadata/SBOM source, and the release pipeline signs `checksums.json` with the ClawSec release key.
50
51	```bash
52	set -euo pipefail
53
54	SKILL_NAME="openclaw-audit-watchdog"
55	VERSION="0.1.9"
56	REPO="prompt-security/clawsec"
57	TAG="${SKILL_NAME}-v${VERSION}"
58	BASE="https://github.com/${REPO}/releases/download/${TAG}"
59	ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip"
60	TMP_DIR="$(mktemp -d)"
61	trap 'rm -rf "$TMP_DIR"' EXIT
62
63	RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"
64
65	curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
66	curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
67	curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
68	curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"
69	curl -fsSL "$BASE/SKILL.md" -o "$TMP_DIR/SKILL.md"
70	curl -fsSL "$BASE/skill.json" -o "$TMP_DIR/skill.json"
71
72	ACTUAL_PUBKEY_SHA256="$(openssl pkey -pubin -in "$TMP_DIR/signing-public.pem" -outform DER \| shasum -a 256 \| awk '{print $1}')"
73	if [ "$ACTUAL_PUBKEY_SHA256" != "$RELEASE_PUBKEY_SHA256" ]; then
74	echo "ERROR: signing-public.pem fingerprint mismatch" >&2
75	exit 1
76	fi
77
78	openssl base64 -d -A -in "$TMP_DIR/checksums.sig" -out "$TMP_DIR/checksums.sig.bin"
79	openssl pkeyutl -verify -rawin -pubin \
80	-inkey "$TMP_DIR/signing-public.pem" \
81	-sigfile "$TMP_DIR/checksums.sig.bin" \
82	-in "$TMP_DIR/checksums.json" >/dev/null
83
84	hash_file() {
85	if command -v shasum >/dev/null 2>&1; then
86	shasum -a 256 "$1" \| awk '{print $1}'
87	else
88	sha256sum "$1" \| awk '{print $1}'
89	fi
90	}
91
92	verify_manifest_file() {
93	asset="$1"
94	path="$2"
95	expected="$(jq -r --arg asset "$asset" '.files[$asset].sha256 // empty' "$TMP_DIR/checksums.json")"
96	if [ -z "$expected" ]; then
97	echo "ERROR: checksums.json missing $asset" >&2
98	exit 1
99	fi
100	actual="$(hash_file "$path")"
101	if [ "$actual" != "$expected" ]; then
102	echo "ERROR: checksum mismatch for $asset" >&2
103	exit 1
104	fi
105	}
106
107	expected_archive="$(jq -r '.archive.sha256 // empty' "$TMP_DIR/checksums.json")"
108	if [ -z "$expected_archive" ]; then
109	echo "ERROR: checksums.json missing archive.sha256" >&2
110	exit 1
111	fi
112	actual_archive="$(hash_file "$TMP_DIR/$ZIP_NAME")"
113	if [ "$actual_archive" != "$expected_archive" ]; then
114	echo "ERROR: archive c

People who liked this also viewed

6 picks

Type