clawsec-feed_skill

Overview

This skill provides a daily-updated security advisory feed that automatically polls the NVD for CVEs and community advisories relevant to OpenClaw, ClawDBot, and Moltbot. It centralizes actionable alerts, cross-references installed skills, and surfaces recommended actions to help you contain and remediate risks quickly. The feed is lightweight, integratable into agent heartbeats, and designed for safe automated deployment.

How this skill works

The feed fetches advisories from a canonical feed and the NVD, validates JSON structure, and enriches entries with severity, affected versions, and recommended actions. It performs checksum and integrity checks during installation, parses advisories for recent and critical entries, and can cross-reference your installed skills to flag matches. Alerts are delivered to your agent workflow so you can automate notifications or human review steps.

When to use it

• You maintain OpenClaw-family agents and want automated CVE monitoring.
• You need to add security advisories to an agent heartbeat or cron job.
• You want a single source to cross-reference installed skills against known issues.
• You require verified feed integrity and safe installation checks.
• You prefer a lightweight advisory feed without installing the full security suite.

Best practices

• Run the feed check every heartbeat or at least once daily to catch new advisories.
• Enable integrity verification (checksums) during installation to prevent tampered artifacts.
• Cross-reference advisories with installed skill versions before taking automated removal actions.
• Treat 'critical' advisories as high priority and escalate to human review when required.
• Whitelist validated installed-skill names to prevent false positives from malformed filenames.

Example use cases

• Automatically notify administrators when a critical CVE affects an installed OpenClaw skill.
• Integrate into an agent heartbeat to block or quarantine skills flagged as malicious.
• Run a nightly audit that lists advisories published in the last 7 days and recommended actions.
• Use checksum-verified installation in CI to ensure feed source integrity before deployment.
• Generate a daily report of affected skills and remediation steps for compliance records.