Claw Release

This is the internal release automation tool for the ClawSec project itself. It walks maintainers through version bumping, git tagging, and publishing GitHub releases with cryptographic verification. The script updates skill.json and SKILL.md in lockstep, creates signed checksums, and pushes tags that trigger CI to build .skill packages. It's marked internal, so it won't appear in the public catalog, but the release artifacts include a full bash verification snippet you can run against the published signatures. If you maintain a skill marketplace or CLI tool ecosystem with similar packaging needs, the verification workflow is worth stealing.

skills.sh installs: 178
GitHub stars: 1.1K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add prompt-security/clawsec --skill claw-release --agent claude-code

Installs into .claude/skills of the current project.

Files

Claw Release

Internal tool for releasing skills and managing the ClawSec catalog.

An internal tool by Prompt Security

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill claw-release -a openclaw -y

Operational Notes

Internal maintainer workflow only.
Required runtime: bash, git, jq, gh
Required credentials: authenticated GitHub CLI with permission to create releases
Side effects: creates commits, tags, pushes to remote, and publishes GitHub Releases
Trust model: run only from a trusted checkout with a clean working tree and maintainer approval

Release Artifact Verification

For standalone installs, verify the signed release manifest before trusting SKILL.md, skill.json, or the archive. The skill.json file is the package metadata/SBOM source, and the release pipeline signs checksums.json with the ClawSec release key.