clawsec-nanoclaw_skill

Overview

This skill protects NanoClaw/OpenClaw agents by monitoring installed skills and dependencies for known security vulnerabilities. It prevents installing unsafe skills, runs audits on your current environment, and provides actionable advisories with exploitability context. Use it to keep your bot's skill set and integrity files secure and verifiable.

How this skill works

The tool queries a curated advisory feed and compares entries to installed skills, packages, and file baselines. It offers a pre-install check, scheduled audits, package signature verification, integrity monitoring, and an advisory browser with severity and exploitability filters. Results include exploitability context to prioritize triage and automated alerts for critical findings.

When to use it

• Before installing any new NanoClaw/OpenClaw skill
• When a user asks “Are my skills secure?” or raises suspicious behavior
• As part of regular security audits or scheduled cron checks
• After receiving external security notifications or advisories
• Before approving file changes or restoring integrity baselines

Best practices

• Always run a pre-install safety check for user-requested skills
• Prioritize advisories by exploitability score and severity together, not severity alone
• Schedule daily or weekly audits to catch supply-chain issues early
• Enable package signature and file integrity verification for production bots
• Review and approve integrity changes through the audit workflow instead of blind restores

Example use cases

• Pre-install safety check: block or warn before adding a third-party skill
• Full environment audit: scan ~/.claude/skills (or custom installRoot) for urgent advisories
• Automated monitoring: cron job that alerts on critical or high-exploitability matches
• Investigations: use advisory matches and exploitability details when tracing suspicious behavior
• Integrity verification: detect and optionally auto-restore modified core files with approval workflow