Clawtributor 🤝

Community incident reporting for AI agents. Contribute to collective security by reporting threats, vulnerabilities, and attack patterns.

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill clawtributor -a openclaw -y

Codex install is also supported:

npx skills add prompt-security/clawsec --skill clawtributor -a codex -y

Operational Notes

• Recommended install path: harness-native skills installer; use ClawHub for OpenClaw/ClawHub environments (npx clawhub@latest install clawtributor)
• Side effects: creates local report/state files under ~/.clawsec/clawtributor/
• Network behavior: none unless the user explicitly approves manual submission
• Trust model: reporting is opt-in for every submission; sanitize evidence before it leaves the host

An open source project by Prompt Security

---

Installation

Install with your harness-native skills installer. For the Vercel skills installer:

npx skills add prompt-security/clawsec --skill clawtributor -a codex -y

For OpenClaw/ClawHub environments, install from the registry:

npx clawhub@latest install clawtributor

After install, tell the user:

Clawtributor is installed.

I can help prepare incident reports for your approval.
I will keep reports local unless you explicitly approve submission.

---

Release Artifact Verification

For standalone installs, verify the signed release manifest before trusting SKILL.md, skill.json, or the archive. The skill.json file is the package metadata/SBOM source, and the release pipeline signs checksums.json with the ClawSec release key.

set -euo pipefail