clawsec-clawhub-checker

Q: How do I install clawsec-clawhub-checker?

Run npx skills add https://github.com/prompt-security/clawsec --skill clawsec-clawhub-checker in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/clawsec-clawhub-checker/ (personal) or .claude/skills/clawsec-clawhub-checker/ (project).

by prompt-securityAI & Agents

ClawHub reputation checker for clawsec-suite. Adds a standalone reputation gate before guarded skill installation.

Installs: 251
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/prompt-security/clawsec --skill clawsec-clawhub-checker

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads clawsec-clawhub-checker automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

ClawSec ClawHub Checker

Adds a reputation gate on top of the clawsec-suite guarded installer.

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill clawsec-clawhub-checker -a openclaw -y

Operational Notes

Required runtime: node, clawhub, openclaw
Depends on: installed clawsec-suite
Side effects: none on other skills; this package does not rewrite installed suite files
Advisory-hook wiring is optional and manual in this release
Network behavior: reputation checks call ClawHub inspect/search endpoints
Trust model: scores are heuristic and confirmation-gated

What It Does

Reads skill metadata from ClawHub (inspect --json)
Evaluates scanner status (including VirusTotal summary when present)
Applies additional reputation heuristics (age, updates, author history, downloads)
Requires explicit --confirm-reputation when score is below threshold

Installation

Install after clawsec-suite:

npx clawhub@latest install clawsec-suite
npx clawhub@latest install clawsec-clawhub-checker

Optional preflight check (validates local paths and prints recommended command):

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/setup_reputation_hook.mjs

Release Artifact Verification

For standalone installs, verify the signed release manifest before trusting SKILL.md, skill.json, or the archive. The skill.json file is the package metadata/SBOM source, and the release pipeline signs checksums.json with the ClawSec release key.

set -euo pipefail

SKILL_NAME="clawsec-clawhub-checker"
VERSION="0.0.8"
REPO="prompt-security/clawsec"
TAG="${SKILL_NAME}-v${VERSION}"
BASE="https://github.com/${REPO}/releases/download/${TAG}"
ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"
curl -fsSL "$BASE/SKILL.md" -o "$TMP_DIR/SKILL.md"
curl -fsSL "$BASE/skill.json" -o "$TMP_DIR/skill.json"

ACTUAL_PUBKEY_SHA256="$(openssl pkey -pubin -in "$TMP_DIR/signing-public.pem" -outform DER | shasum -a 256 | awk '{print $1}')"
if [ "$ACTUAL_PUBKEY_SHA256" != "$RELEASE_PUBKEY_SHA256" ]; then
  echo "ERROR: signing-public.pem fingerprint mismatch" >&2
  exit 1
fi

openssl base64 -d -A -in "$TMP_DIR/checksums.sig" -out "$TMP_DIR/checksums.sig.bin"
openssl pkeyutl -verify -rawin -pubin \
  -inkey "$TMP_DIR/signing-public.pem" \
  -sigfile "$TMP_DIR/checksums.sig.bin" \
  -in "$TMP_DIR/checksums.json" >/dev/null

hash_file() {
  if command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | awk '{print $1}'
  else
    sha256sum "$1" | awk '{print $1}'
  fi
}

verify_manifest_file() {
  asset="$1"
  path="$2"
  expected="$(jq -r --arg asset "$asset" '.files[$asset].sha256 // empty' "$TMP_DIR/checksums.json")"
  if [ -z "$expected" ]; then
    echo "ERROR: checksums.json missing $asset" >&2
    exit 1
  fi
  actual="$(hash_file "$path")"
  if [ "$actual" != "$expected" ]; then
    echo "ERROR: checksum mismatch for $asset" >&2
    exit 1
  fi
}

expected_archive="$(jq -r '.archive.sha256 // empty' "$TMP_DIR/checksums.json")"
if [ -z "$expected_archive" ]; then
  echo "ERROR: checksums.json missing archive.sha256" >&2
  exit 1
fi
actual_archive="$(hash_file "$TMP_DIR/$ZIP_NAME")"
if [ "$actual_archive" != "$expected_archive" ]; then
  echo "ERROR: archive checksum mismatch" >&2
  exit 1
fi

verify_manifest_file "SKILL.md" "$TMP_DIR/SKILL.md"
verify_manifest_file "skill.json" "$TMP_DIR/skill.json"

echo "Signed release manifest, archive, SKILL.md, and skill.json verified."

Only install or extract the archive after this verification succeeds.

Usage

Run the enhanced installer directly from this skill:

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/enhanced_guarded_install.mjs \
  --skill some-skill \
  --version 1.0.0

If a skill is below threshold, rerun only with explicit approval:

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/enhanced_guarded_install.mjs \
  --skill some-skill \
  --version 1.0.0 \
  --confirm-reputation

Optional Advisory-Hook Wiring (Manual)

This release does not auto-patch clawsec-suite hook files.
If you rely on advisory alerts that include reputationWarning / reputationWarnings, wire the checker module manually:

Source module: ~/.openclaw/skills/clawsec-clawhub-checker/hooks/clawsec-advisory-guardian/lib/reputation.mjs
Target hook file: ~/.openclaw/skills/clawsec-suite/hooks/clawsec-advisory-guardian/handler.ts

Treat that wiring as a deliberate local customization and review it before enabling.

Exit Codes

0 safe to install
42 advisory confirmation required (from clawsec-suite)
43 reputation confirmation required
1 error

Configuration

Environment variables:

CLAWHUB_REPUTATION_THRESHOLD - Minimum score (0-100, default: 70)

Safety Notes

This is defense-in-depth, not a replacement for advisory matching
Scanner outputs can produce false positives and false negatives
Always review skill code before overriding warnings

Development

Key files:

scripts/enhanced_guarded_install.mjs
scripts/check_clawhub_reputation.mjs
scripts/setup_reputation_hook.mjs
hooks/clawsec-advisory-guardian/lib/reputation.mjs

License

GNU AGPL v3.0 or later - Part of the ClawSec security suite

FAQ

What does the clawsec-clawhub-checker skill do?

ClawHub reputation checker for clawsec-suite. Adds a standalone reputation gate before guarded skill installation.

How do I install clawsec-clawhub-checker?

Run npx skills add https://github.com/prompt-security/clawsec --skill clawsec-clawhub-checker in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/clawsec-clawhub-checker/ (personal) or .claude/skills/clawsec-clawhub-checker/ (project).

Which AI agents can use clawsec-clawhub-checker?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is clawsec-clawhub-checker safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains clawsec-clawhub-checker?

It is published by prompt-security in prompt-security/clawsec. It has 251 recorded installs.

More from prompt-security/clawsec

View all →

clawsec-suite

prompt-security/clawsec

ClawSec suite manager with embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup for additional security skills.

Security868 installs

openclaw-audit-watchdog

prompt-security/clawsec

Automated daily security audits for OpenClaw agents with DM delivery and optional email reporting. Runs deep audits, creates or updates a recurring cron job, and sends formatted reports to configured recipients.

Security751 installs

soul-guardian

prompt-security/clawsec

Open the skill to read its SKILL.md instructions.

AI & Agents255 installs

clawsec-feed

prompt-security/clawsec

Security advisory feed package for OpenClaw-related threats and vulnerabilities. The upstream feed is updated daily; local automation is handled by clawsec-suite or the operator.

Security240 installs

clawtributor

prompt-security/clawsec

Harness-neutral community incident reporting for AI agents. Contribute to collective security by reporting threats.

AI & Agents205 installs

clawsec-scanner

prompt-security/clawsec

Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis (Semgrep, Bandit), and agent-specific static hook inspection for OpenClaw hooks.

Security191 installs

Popular ai & agents skills

View category →

google-agents-cli-publish

google/agents-cli

This skill should be used when the user wants to "publish an agent", "publish my ADK agent", "register an agent with Gemini", "publish to Gemini" (formerly Gemini Enterprise), or needs guidance on the agents-cli publish gemini command. Also use when the user wants to "manage agents in Agent Registry", "list/update/delete registered agents", or "register an MCP server". Covers ADK vs A2A registration modes, programmatic and interactive usage, flag reference, auto-detection from deployment metadata, Agent Registry fleet management, and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment (use google-agents-cli-deploy).

AI & Agents513.9K installs

google-agents-cli-eval

google/agents-cli

This skill should be used when the user wants to "run an evaluation", "evaluate my agent", "evaluate my ADK agent", "write an eval dataset", "analyze eval failures", "compare eval results", "optimize agent", or needs guidance on the Gemini platform eval methodology and the Quality Flywheel. Covers eval metrics, dataset schema, LLM-as-judge scoring, and common failure causes. Applies to any agents-cli project, whatever framework the agent is written in. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), deployment (use google-agents-cli-deploy), or project scaffolding (use google-agents-cli-scaffold).

AI & Agents513.5K installs

skill-creator

anthropics/skills

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

OfficialAI & Agents416.4K installs

codex-pet

prime-skills/runcomfy-agent-skills

Codex Pet generator on RunComfy. Build a Codex-compatible Codex Pet spritesheet.webp + pet.json from a single reference image, drop it into ${CODEXHOME:-$HOME/.codex}/pets/ / and Codex picks it up as a custom Codex Pet next to the 8 built-ins. This skill produces the exact Codex Pet atlas Codex expects (1536x1872 PNG/WebP, 8 cols x 9 rows, 192x208 cells, 9 animation states — idle, running-right, running-left, waving, jumping, failed, waiting, running, review). Calls OpenAI GPT Image 2 edit ONCE via the local RunComfy CLI as runcomfy run openai/gpt-image-2/edit to produce a canonical Codex Pet pose, then assembles all 9 animation rows programmatically with ImageMagick micro-transforms — no Codex Pro, no $imagegen, no OPENAIAPIKEY required, only RUNCOMFYTOKEN. Triggers on "codex pet", "create codex pet", "make codex pet", "hatch codex pet", "/hatch image", "desktop pet codex", "codex pets", "spritesheet.webp", or any explicit ask to build a custom pet for OpenAI Codex.

AI & Agents402.1K installs

full-output-enforcement

leonxlnx/taste-skill

Overrides default LLM truncation behavior. Enforces complete code generation, bans placeholder patterns, and handles token-limit splits cleanly. Apply to any task requiring exhaustive, unabridged output.

AI & Agents401K installs

executing-plans

obra/superpowers

Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available

AI & Agents245.7K installs

clawsec-clawhub-checker

Install

Install

Describe the task

Review the result

SKILL.md

ClawSec ClawHub Checker

Vercel Skills Installation

Operational Notes

What It Does

Installation

Release Artifact Verification

Usage

Optional Advisory-Hook Wiring (Manual)

Exit Codes

Configuration

Safety Notes

Development

License

FAQ

More from prompt-security/clawsec

Popular ai & agents skills