Clawsec Nanoclaw

This is a security scanner for NanoClaw skills that checks them against a curated vulnerability feed before you install anything or when you want to audit what's already running. It pulls from a signed advisory feed every six hours, gives you exploitability scores alongside severity ratings, and includes integrity monitoring to catch unexpected file changes. The pre-install check pattern is the main workflow: you ask it to verify a skill, it tells you if there are known issues, then you decide whether to proceed. It won't catch zero-days or do code review, but it will stop you from installing something with a known RCE vulnerability, which is exactly the kind of mistake that's easy to make when you're moving fast in a chat interface.

skills.sh installs: 188
GitHub stars: 1.1K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add prompt-security/clawsec --skill clawsec-nanoclaw --agent claude-code

Installs into .claude/skills of the current project.

Files

ClawSec for NanoClaw

Security advisory monitoring that protects your WhatsApp bot from known vulnerabilities in skills and dependencies.

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -a openclaw -y

Overview

ClawSec provides MCP tools that check installed skills against a curated feed of security advisories. It prevents installation of vulnerable skills, includes exploitability context for triage, and alerts you to issues in existing ones.

Core principle: Check before you install. Monitor what's running.

When to Use

Use ClawSec tools when:

Installing a new skill (check safety first)
User asks "are my skills secure?"
Investigating suspicious behavior
Regular security audits
After receiving security notifications

Do NOT use for:

Code review (use other tools)
Performance issues (different concern)
General debugging

MCP Tools Available

Pre-Installation Check

// Before installing any skill
const safety = await tools.clawsec_check_skill_safety({
  skillName: 'new-skill',
  skillVersion: '1.0.0'  // optional
});

SKILL.md on GitHub