clawsec-suite
Manages ClawSec suite with monitoring, cryptographic verification, and guided setup for enhanced security skills.
Install this skill
Security score
The clawsec-suite skill was audited on May 12, 2026 and we found 19 security issues across 3 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 44 | ```bash |
Template literal with variable interpolation in command context
| 71 | ```bash |
Template literal with variable interpolation in command context
| 151 | ```bash |
Template literal with variable interpolation in command context
| 160 | ```bash |
Template literal with variable interpolation in command context
| 180 | ```bash |
Template literal with variable interpolation in command context
| 204 | - Remote feed signature URL: `${CLAWSEC_FEED_URL}.sig` (override with `CLAWSEC_FEED_SIG_URL`) |
Template literal with variable interpolation in command context
| 207 | - Local feed signature: `${CLAWSEC_LOCAL_FEED}.sig` (override with `CLAWSEC_LOCAL_FEED_SIG`) |
Template literal with variable interpolation in command context
| 217 | ```bash |
Template literal with variable interpolation in command context
| 386 | ```bash |
Access to hidden dotfiles in home directory
| 17 | - Side effects: setup scripts install an advisory hook under `~/.openclaw/hooks`, optionally create an unattended `openclaw cron` job, and use `npx clawhub@latest install` for guarded installs |
Access to hidden dotfiles in home directory
| 206 | - Local seed fallback: `~/.openclaw/skills/clawsec-suite/advisories/feed.json` |
Access to hidden dotfiles in home directory
| 208 | - Local checksums manifest: `~/.openclaw/skills/clawsec-suite/advisories/checksums.json` |
Access to hidden dotfiles in home directory
| 209 | - Pinned feed signing key: `~/.openclaw/skills/clawsec-suite/advisories/feed-signing-public.pem` (override with `CLAWSEC_FEED_PUBLIC_KEY`) |
Access to hidden dotfiles in home directory
| 210 | - State file: `~/.openclaw/clawsec-suite-feed-state.json` |
Access to hidden dotfiles in home directory
| 309 | 3. `~/.openclaw/security-audit.json` |
External URL reference
| 5 | homepage: https://clawsec.prompt.security |
External URL reference
| 42 | Discover the current catalog from the authoritative index (`https://clawsec.prompt.security/skills/index.json`) at runtime: |
External URL reference
| 203 | - Remote feed URL: `https://clawsec.prompt.security/advisories/feed.json` |
External URL reference
| 218 | FEED_URL="${CLAWSEC_FEED_URL:-https://clawsec.prompt.security/advisories/feed.json}" |