clawsec-suite
Manages ClawSec suite with monitoring, cryptographic verification, and guided setup for enhanced security skills.
Install this skill
Security score
The clawsec-suite skill was audited on Jun 11, 2026 and we found 19 security issues across 3 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 52 | ```bash |
Template literal with variable interpolation in command context
| 79 | ```bash |
Template literal with variable interpolation in command context
| 159 | ```bash |
Template literal with variable interpolation in command context
| 168 | ```bash |
Template literal with variable interpolation in command context
| 188 | ```bash |
Template literal with variable interpolation in command context
| 213 | - Remote feed signature URL: `${CLAWSEC_FEED_URL}.sig` (override with `CLAWSEC_FEED_SIG_URL`) |
Template literal with variable interpolation in command context
| 216 | - Local feed signature: `${CLAWSEC_LOCAL_FEED}.sig` (override with `CLAWSEC_LOCAL_FEED_SIG`) |
Template literal with variable interpolation in command context
| 226 | ```bash |
Template literal with variable interpolation in command context
| 395 | ```bash |
Access to hidden dotfiles in home directory
| 25 | - Side effects: setup scripts install an advisory hook under `~/.openclaw/hooks`, optionally create an unattended `openclaw cron` job, and use `npx clawhub@latest install` for guarded installs |
Access to hidden dotfiles in home directory
| 215 | - Local seed fallback: `~/.openclaw/skills/clawsec-suite/advisories/feed.json` |
Access to hidden dotfiles in home directory
| 217 | - Local checksums manifest: `~/.openclaw/skills/clawsec-suite/advisories/checksums.json` |
Access to hidden dotfiles in home directory
| 218 | - Pinned feed signing key: `~/.openclaw/skills/clawsec-suite/advisories/feed-signing-public.pem` (override with `CLAWSEC_FEED_PUBLIC_KEY`) |
Access to hidden dotfiles in home directory
| 219 | - State file: `~/.openclaw/clawsec-suite-feed-state.json` |
Access to hidden dotfiles in home directory
| 318 | 3. `~/.openclaw/security-audit.json` |
External URL reference
| 5 | homepage: https://clawsec.prompt.security |
External URL reference
| 50 | Discover the current catalog from the authoritative index (`https://clawsec.prompt.security/skills/index.json`) at runtime: |
External URL reference
| 211 | - Remote consolidated feed URL: `https://clawsec.prompt.security/advisories/feed.json` |
External URL reference
| 227 | FEED_URL="${CLAWSEC_FEED_URL:-https://clawsec.prompt.security/advisories/feed.json}" |