# Clawsec Nanoclaw

Use when checking for security vulnerabilities in NanoClaw skills, before installing...

- Repository: https://github.com/prompt-security/clawsec (1129 stars)
- Category: Security
- License: AGPL-3.0
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -g -a claude-code -y`
Codex: `npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -g -a codex -y`
Cursor: `npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -g -a cursor -y`
Gemini CLI: `npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add prompt-security/clawsec`

## Description

Use when checking for security vulnerabilities in NanoClaw skills, before installing new skills, or when asked about security advisories affecting the bot

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# ClawSec for NanoClaw

Security advisory monitoring that protects your WhatsApp bot from known vulnerabilities in skills and dependencies.

## Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

```bash
npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -a openclaw -y
```

## Overview

ClawSec provides MCP tools that check installed skills against a curated feed of security advisories. It prevents installation of vulnerable skills, includes exploitability context for triage, and alerts you to issues in existing ones.

**Core principle:** Check before you install. Monitor what's running.

## When to Use

Use ClawSec tools when:
- Installing a new skill (check safety first)
- User asks "are my skills secure?"
- Investigating suspicious behavior
- Regular security audits
- After receiving security notifications

Do NOT use for:
- Code review (use other tools)
- Performance issues (different concern)
- General debugging

## MCP Tools Available

### Pre-Installation Check

```typescript
// Before installing any skill
const safety = await tools.clawsec_check_skill_safety({
  skillName: 'new-skill',
  skillVersion: '1.0.0'  // optional
});

if (!safety.safe) {
  // Show user the risks before proceeding
  console.warn(`Security issues: ${safety.advisories.map(a => a.id)}`);
}
```

### Security Audit

```typescript
// Check all installed skills (defaults to ~/.claude/skills in the container)
const result = await tools.clawsec_check_advisories({
  installRoot: '/home/node/.claude/skills'  // optional
});

if (result.matches.some((m) =>
  m.advisory.severity === 'critical' || m.advisory.exploitability_score === 'high'
)) {
  // Alert user immediately
  console.error('Urgent advisories found!');
}
```

### Browse Advisories

```typescript
// List advisories with filters
const advisories = await tools.clawsec_list_advisories({
  severity: 'high',               // optional
  exploitabilityScore: 'high'     // optional
});
```

The rest: https://github.com/prompt-security/clawsec/blob/HEAD/skills/clawsec-nanoclaw/SKILL.md