gnezim/clawsec
1
0
Fork 0
mirror of https://github.com/prompt-security/clawsec.git synced 2026-06-13 13:38:03 +03:00
Code Issues Packages Projects Releases Wiki Activity
103 Commits 19 Branches 95 Tags
fefecaa60a14f007b6f6fc7bd5cd2e15289682c8
Commit Graph

103 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
davida-ps fefecaa60a feat(wiki): add full in-app wiki browser and llms index (#80) 
* feat(wiki): add full in-app wiki browser and llms index

* feat(wiki): auto-generate per-page llms exports

* vuln package

* fix(wiki): guard malformed route decoding

* fix(wiki): preserve markdown anchor fragments across page links

* refactor(markdown): share default render components

* fix(wiki): block unsafe markdown link schemes

* fix(wiki): block unsafe markdown image schemes

* docs(wiki): migrate root docs into wiki pages

* chore(wiki): de-track generated llms exports

* chore(wiki): ignore generated public wiki artifacts

* fix(wiki): align llms urls with per-page endpoint pattern

* fix(wiki): derive llms index from wiki index page

* refactor(markdown): share frontmatter and title helpers

* refactor(wiki): share route and llms path mapping

* ci(pages): add pr verify workflow and tighten deploy triggers
 2026-02-26 10:43:36 +02:00
davida-ps 8132c23f41 Codex/wiki sync revert working (#79) 
* fix(wiki-sync): restore known-good pat auth flow

* fix(wiki-sync): restore github token write flow
 2026-02-26 00:37:50 +02:00
davida-ps 433a9596a6 fix(wiki-sync): use single x-access-token auth path (#78) 2026-02-26 00:17:21 +02:00
davida-ps c17931d38d Codex/main synced wiki readme (#77) 
* fix(readme): use github-safe demo previews and links

* fix(wiki): map wiki root to index

* refactor(wiki): generate Home from INDEX during sync
 2026-02-25 22:22:56 +02:00
davida-ps 516e8f0428 Codex/fix readme video links (#76) 
* fix(readme): use github-safe demo previews and links

* fix(readme): use only github-hosted demo links

* fix(wiki): map wiki root to index

* feat(readme): add lightweight animated gif demo previews

* refactor(wiki): generate Home from INDEX during sync

* fix(ci): remove github token write scopes in workflows

* chore(ci): use existing poll token for write automation
 2026-02-25 22:10:52 +02:00
davida-ps cbc484faf3 Add comprehensive documentation for ClawSec modules and workflows (#75) 
- Introduced glossary for key terms and definitions related to security advisories, skill packaging, and CI/CD processes.
- Documented the Automation and Release Pipelines module, detailing responsibilities, key files, public interfaces, and configuration.
- Added ClawSec Suite Core module documentation, outlining its responsibilities, key files, public interfaces, and configuration.
- Created Frontend Web App module documentation, covering responsibilities, key files, public interfaces, and configuration.
- Added Local Validation and Packaging Tools module documentation, detailing responsibilities, key files, public interfaces, and configuration.
- Documented NanoClaw Integration module, including responsibilities, key files, public interfaces, and configuration.
- Introduced an overview of ClawSec, including purpose, repo layout, entry points, key artifacts, and workflows.
- Added a Security section outlining the security model, cryptographic controls, runtime enforcement, and incident playbooks.
- Created a Testing section detailing the testing strategy, verification layers, CI workflow coverage, and local testing commands.
- Documented the Workflow section, covering the end-to-end lifecycle, primary workflow map, local operator workflow, and operational risks.
 2026-02-25 21:44:51 +02:00
github-actions[bot] 448aed3261 chore: CVE advisories - 0 new, 34 updated (#73) 
Automated update from NVD CVE feed.
Keywords: OpenClaw clawdbot Moltbot NanoClaw WhatsApp-bot baileys
Poll window: 2025-10-28T16:48:19.000Z to 2026-02-25T16:48:19.000Z

Co-authored-by: davida-ps <232346510+davida-ps@users.noreply.github.com>
 2026-02-25 18:51:57 +02:00
davida-ps 037bd125b9 fix: refine target selection logic for advisory workflows (#72) 2026-02-25 18:47:34 +02:00
davida-ps 5ef122dd91 feat: enhance platform detection and handling in advisory workflows (#70) 2026-02-25 18:07:57 +02:00
davida-ps 938eb929f3 feat: add property-based fuzz tests for advisory parsing, semver matc… (#69) 
* feat: add property-based fuzz tests for advisory parsing, semver matching, and suppression config

* fix(ci): install deps before fuzz test jobs
 2026-02-25 17:48:48 +02:00
dependabot[bot] 55fb234fc0 chore(deps): bump lucide-react from 0.564.0 to 0.575.0 (#59) 2026-02-25 16:21:21 +02:00
github-actions[bot] ea44aea49e chore: CVE advisories - 0 new, 34 updated (#68) 
Automated update from NVD CVE feed.
Keywords: OpenClaw clawdbot Moltbot NanoClaw WhatsApp-bot baileys
Poll window: 2025-10-28T12:39:05.000Z to 2026-02-25T12:39:05.000Z

Co-authored-by: davida-ps <232346510+davida-ps@users.noreply.github.com>
 2026-02-25 14:40:50 +02:00
dependabot[bot] 2e64201254 chore(deps): bump react-router-dom from 7.13.0 to 7.13.1 (#56) 
Bumps [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) from 7.13.0 to 7.13.1.
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.13.1/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: react-router-dom
  dependency-version: 7.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-25 14:25:42 +02:00
davida-ps 371d792e97 feat: enhance support for NanoClaw in CVE processing and UI components (#67) 2026-02-25 14:18:57 +02:00
dependabot[bot] 0602c0fbe5 chore(deps): bump ruff from 0.15.1 to 0.15.2 in /.github (#55) 
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.1 to 0.15.2.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/0.15.1...0.15.2)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-25 13:51:41 +02:00
dependabot[bot] 8908319dd0 chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 (#54) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.3 to 4.32.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/9e907b5e64f6b83e7804b09294d44122997950d6...89a39a4e59826350b863aa6b6252a07ad50cf83e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-25 13:46:08 +02:00
dependabot[bot] 6f2fe918a2 chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 (#53) 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.34.0 to 0.34.1.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/c1824fd6edce30d7ab345a9989de00bbd46ef284...e368e328979b113139d6f9068e03accaed98a518)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.34.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-25 13:43:22 +02:00
Aldo Delgado 7cdb4ab7e2 fix(portability): harden cross-platform path handling and install workflows (#62) 
* docs: add agent collaboration and git safety rules to AGENTS.md

* fix(portability): harden cross-platform path handling and install workflows

- add shared path resolution utility for advisory guardian components
- expand and normalize home-path tokens: ~, $HOME, ${HOME}, %USERPROFILE%, $env:USERPROFILE
- reject unresolved/escaped home tokens to prevent literal "$HOME" directory creation
- fix install/runtime path handling in:
  - openclaw-audit-watchdog setup_cron and suppression config loader
  - clawsec-suite advisory hook handler, suppression loader, and guarded installer
- remove hardcoded Homebrew binary assumptions in watchdog scripts/tests
- add LF enforcement via .gitattributes to reduce CRLF script breakage
- expand CI Node checks to linux/macos/windows matrix
- add cross-platform test coverage for path expansion and token rejection
- update README and SKILL docs with bash/zsh/PowerShell-safe path guidance
- add compatibility deliverables:
  - docs/COMPATIBILITY_REPORT.md
  - docs/REMEDIATION_PLAN.md
  - docs/PLATFORM_VERIFICATION.md

Validation:
- node skills/clawsec-suite/test/path_resolution.test.mjs
- node skills/clawsec-suite/test/guarded_install.test.mjs
- node skills/clawsec-suite/test/advisory_suppression.test.mjs
- node skills/openclaw-audit-watchdog/test/suppression_config.test.mjs
- node skills/openclaw-audit-watchdog/test/render_report_suppression.test.mjs

* fix(advisory): avoid fail-open on invalid path vars and cover watchdog tests

* docs: move signing runbooks into docs folder

* docs: remove root-level signing runbooks after move

* chore(clawsec-suite): bump version to 0.1.3

* chore(openclaw-audit-watchdog): bump version to 0.1.1

* docs(changelog): add entries for clawsec-suite 0.1.3 and watchdog 0.1.1

* docs(changelog): credit @aldodelgado for PR #62 contributions

* feat(clawsec-suite): scope advisories to openclaw application

* fix(ci): run advisory scope tests without TypeScript loader

---------

Co-authored-by: David Abutbul <David.a@prompt.security>
clawsec-suite-v0.1.3 openclaw-audit-watchdog-v0.1.1 		2026-02-25 13:24:31 +02:00
David Abutbul 73dd63f714 Nanoclaw integration (#65) 
* Add NanoClaw platform support to ClawSec

## Changes

### CI/CD Pipeline Updates
- Added NanoClaw keywords to NVD CVE monitoring
- Keywords: "NanoClaw", "WhatsApp-bot", "baileys"
- GitHub pattern now matches NanoClaw repositories

### Documentation
- Added NANOCLAW.md with integration guide
- Documented platform-specific advisory schema
- Credited 8-agent team that designed the integration

### Advisory Schema Enhancement
- Added optional `platforms` field support
- Enables platform-specific advisories (openclaw/nanoclaw)
- Maintains backward compatibility (empty = all platforms)

## Team Credits

Designed and implemented by specialized agent team:
- pioneer-repo-scout: ClawSec architecture analysis
- pioneer-nanoclaw-scout: NanoClaw architecture analysis
- architect: Integration design
- advisory-specialist: Feed integration
- integrity-specialist: File integrity design
- installer-specialist: Signature verification
- tester: Test infrastructure
- documenter: Documentation

Total contribution: 3000+ lines of design + implementation code.

## Impact

ClawSec now monitors for NanoClaw-specific security issues and can
provide platform-targeted advisories. This enables NanoClaw to consume
the advisory feed out-of-the-box for security monitoring.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Add clawsec-nanoclaw skill with full security suite

Provides complete ClawSec integration for NanoClaw deployments including:

Features:
- 4 MCP tools for agent-initiated vulnerability checking
- Advisory cache service with automatic feed fetching (6h interval)
- Ed25519 signature verification for feed integrity
- Platform-specific advisory filtering (nanoclaw/openclaw)
- IPC-based container-to-host communication

Components (1,730 lines):
- MCP Tools (350 lines): clawsec_check_advisories, clawsec_check_skill_safety,
  clawsec_list_advisories, clawsec_verify_signature
- Advisory Cache Manager (492 lines): Periodic fetching, signature verification
- Signature Verification (387 lines): Ed25519 crypto utilities
- Advisory Matching (289 lines): Skill-to-vulnerability correlation
- IPC Handlers (212 lines): Host-side request processing
- Complete documentation: SKILL.md, INSTALL.md with troubleshooting

Architecture:
- Container: MCP tools invoked by agents via Claude SDK
- IPC Layer: Filesystem-based request/response for host operations
- Host Service: Advisory cache with automatic refresh and verification
- Feed Source: https://clawsec.prompt.security/advisories/feed.json

Installation:
NanoClaw users can now add ClawSec security by:
1. Copying skills/clawsec-nanoclaw to their deployment
2. Integrating MCP tools into container (3 line change)
3. Integrating IPC handlers into host (2 line change)
4. Starting cache service in host process (1 line change)

No modifications to NanoClaw core required - ClawSec provides everything
as an installable skill package, just like it does for OpenClaw.

Updated NANOCLAW.md with complete installation instructions and
documentation references.

Team Credits:
8-agent collaborative design and implementation:
- pioneer-repo-scout: ClawSec architecture analysis
- pioneer-nanoclaw-scout: NanoClaw architecture analysis
- architect: Integration design and coordination
- advisory-specialist: Advisory feed integration
- integrity-specialist: File integrity design
- installer-specialist: Signature verification implementation
- tester: Test infrastructure and validation
- documenter: Documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Add security expansion: Skill signature verification + File integrity monitoring

Implements Phase 1 (Skill Signature Verification) and Phase 2 (File Integrity
Monitoring) for NanoClaw security enhancement.

## Phase 1: Skill Signature Verification (~490 lines)

Adds Ed25519 signature verification for skill packages to prevent supply chain attacks.

**New Files:**
- host-services/skill-signature-handler.ts (217 lines): Core verification service
- mcp-tools/signature-verification.ts (200 lines): clawsec_verify_skill_package tool
- docs/SKILL_SIGNING.md (270 lines): Complete signing/verification guide

**Features:**
- Ed25519 signature verification using Node.js crypto
- Pinned ClawSec public key with custom key override support
- Auto-detection of .sig signature files
- Package SHA-256 integrity hashing
- Fail-closed error handling with detailed diagnostics
- IPC-based container-to-host verification (5s timeout)

**MCP Tool:** clawsec_verify_skill_package
- Verifies skill packages before installation
- Returns: valid, recommendation (install/block/review), signer, algorithm
- Prevents installation of tampered/malicious packages

## Phase 2: File Integrity Monitoring (~1,765 lines)

Ports OpenClaw's soul-guardian to NanoClaw for critical file protection.

**New Files:**
- guardian/integrity-monitor.ts (711 lines): Core monitoring engine
- guardian/policy.json (55 lines): NanoClaw-specific protection policy
- mcp-tools/integrity-tools.ts (260 lines): 4 MCP tools for agents
- host-services/integrity-handler.ts (349 lines): IPC handler integration
- docs/INTEGRITY.md (470 lines): User documentation

**Features:**
- SHA-256 baseline tracking with tamper-evident audit logs
- Auto-restore for critical files (registered_groups.json, CLAUDE.md)
- Alert-only mode for non-critical files
- Intentional change approval workflow
- Hash-chained audit logging
- Symlink protection and atomic file operations
- Unified diff generation for drift analysis

**MCP Tools:**
- clawsec_check_integrity: Check files for unauthorized changes
- clawsec_approve_change: Approve legitimate modifications
- clawsec_integrity_status: View monitoring status
- clawsec_verify_audit: Verify audit log integrity

**Protected Files:**
- CRITICAL: registered_groups.json (prevents group hijacking)
- HIGH: CLAUDE.md files (prevents instruction poisoning)
- MEDIUM: Container/host code (alerts on changes)
- IGNORED: Conversations (expected to change)

## Shared Enhancements (+129 lines)

**Updated: lib/signatures.ts**
Added 5 new crypto utilities:
- verifyDetachedSignature(): File-based Ed25519 verification
- verifyDetachedSignatureWithDetails(): Diagnostic variant with error details
- loadPublicKey(): PEM validation and security enforcement
- sha256File(): File hashing (shared utility)
- verifyFileHashes(): Batch drift detection

**Updated: lib/types.ts**
Added TypeScript interfaces for:
- VerifySkillSignatureRequest/Response (Phase 1 IPC)
- IntegrityCheckRequest/Response (Phase 2 IPC)
- VerifySkillPackageParams (Phase 1 MCP tool)

**Updated: host-services/ipc-handlers.ts**
Added IPC handlers:
- verify_skill_signature (Phase 1)
- integrity_check, integrity_approve, integrity_status, integrity_verify_audit (Phase 2)

## Total Delivery

- **New Code**: ~2,958 lines
- **Files Created**: 11 new files
- **Files Modified**: 3 existing files
- **Documentation**: 740 lines across 2 comprehensive guides

## Architecture

**Phase 1:** Container agents → MCP tool → IPC → Host verifier → Ed25519 crypto
**Phase 2:** Container agents → MCP tools → IPC → Host service → File monitoring

**Storage:**
- Phase 1: Stateless (no persistent storage)
- Phase 2: /workspace/project/data/soul-guardian/ (host-only)

**Security Model:**
- Ed25519 signatures verified with pinned ClawSec public key
- SHA-256 baselines stored on host (containers cannot modify)
- Hash-chained audit logs for tamper detection
- Fail-closed error handling throughout
- IPC-only access (no direct container mounts)

## Team Credits

Designed and implemented by 5-agent Opus 4.6 team:
- signature-verification-lead: Phase 1 implementation
- integrity-monitoring-lead: Phase 2 implementation
- shared-crypto: Cryptographic utilities
- mcp-tools-architect: MCP tool schema standards
- ipc-handler-architect: IPC protocol standards

Coordination approach:
1. Design phase: Each agent analyzed and proposed solutions
2. Coordination phase: Aligned on shared components (crypto, IPC, storage)
3. Implementation phase: Parallel execution with peer support
4. Result: Zero conflicts, exceeded targets, complete documentation

## Integration

NanoClaw users can now install ClawSec security features:

**1. MCP Tools** (container):
```typescript
import { clawsecTools } from '../../../skills/clawsec-nanoclaw/mcp-tools/advisory-tools.js';
import { verifySkillPackage } from '../../../skills/clawsec-nanoclaw/mcp-tools/signature-verification.js';
import { integrityTools } from '../../../skills/clawsec-nanoclaw/mcp-tools/integrity-tools.js';
```

**2. IPC Handlers** (host):
```typescript
import { registerClawSecHandlers } from '../skills/clawsec-nanoclaw/host-services/ipc-handlers.js';
```

**3. Services** (host):
```typescript
import { SkillSignatureVerifier } from '../skills/clawsec-nanoclaw/host-services/skill-signature-handler.js';
import { IntegrityService } from '../skills/clawsec-nanoclaw/host-services/integrity-handler.js';
```

See docs/SKILL_SIGNING.md and docs/INTEGRITY.md for complete integration guides.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Fix SKILL.md format: proper YAML frontmatter, remove ASCII diagrams, focus on when-to-use

* chore: align with contributors guidelines - set version 0.0.1, add version to SKILL.md frontmatter, complete SBOM

* fix: use specific NanoClaw repo URL instead of wildcard pattern

Change github.com/*/NanoClaw to github.com/qwibitai/NanoClaw to avoid
matching unrelated projects in CVE advisory scanning.

* docs: merge NanoClaw support into main README, move NANOCLAW.md to skill README

- Add NanoClaw platform section in main README
- Update supported platforms list (OpenClaw + NanoClaw)
- Add monitored keywords for NanoClaw (WhatsApp-bot, baileys)
- Document platform-specific advisory schema
- Move NANOCLAW.md to skills/clawsec-nanoclaw/README.md

* fix: resolve ESLint and TypeScript errors in clawsec-nanoclaw skill

Fix all CI failures from prepare-to-push.sh for the nanoclaw-integration branch:

ESLint fixes:
- Add missing Node.js globals (Buffer, AbortController, clearTimeout,
  RequestInit) to eslint.config.js for TypeScript files
- Add ambient declarations for host-provided variables (server, writeIpcFile,
  TASKS_DIR, groupFolder) in MCP tool template files
- Wrap bare case statements in ipc-handlers.ts in a proper exported function
- Replace @ts-ignore with @ts-expect-error in signatures.ts
- Prefix unused variables with underscore (affectedVersion, keyDer,
  safeBasename, groupFolder)
- Add eslint-disable directives for intentional any usage in template files
- Change any to unknown in types.ts where appropriate

TypeScript fixes:
- Replace glob import with ambient namespace declaration (glob not in repo deps)
- Fix Hash.hexdigest() to Hash.digest('hex') in integrity-monitor.ts
- Fix unreachable type comparison (recommendation === 'install') in
  advisory-tools.ts

Comment syntax fixes:
- Convert block comments containing '*/30 * * * *' cron expressions to
  line comments to prevent premature comment termination in
  integrity-handler.ts and integrity-tools.ts

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix: implement missing MCP tools and align documentation with code

- Rewrote signature-verification.ts with actual server.tool() implementation (was template string)
- Fixed tool naming: clawsec_verify_signature -> clawsec_verify_skill_package
- Added missing clawsec_refresh_cache to all documentation
- Updated skill.json mcp_tools array from 4 to 9 tools (added Phase 1 & 2 tools)
- All 9 MCP tools now verified: 4 advisory + 1 signature + 4 integrity

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
clawsec-nanoclaw-v0.0.1 		2026-02-25 12:11:35 +02:00
davida-ps db0339084f chore: migrate repository licensing from MIT to AGPL (#63) 
* chore(license): migrate repository licensing to AGPL-3.0-or-later

* fix(ci): skip skill dry-run when version is unchanged
 2026-02-24 15:43:14 +02:00
github-actions[bot] af0a515166 chore: CVE advisories - 0 new, 6 updated (#61) 
Automated update from NVD CVE feed.
Keywords: OpenClaw clawdbot Moltbot
Poll window: 2026-02-22T10:57:32Z to 2026-02-24T06:19:58.000Z

Co-authored-by: davida-ps <232346510+davida-ps@users.noreply.github.com>
 2026-02-24 13:23:31 +02:00
davida-ps 3142707dbd fix(deps): patch ajv ReDoS advisory (#52) 2026-02-22 16:01:29 +02:00
davida-ps c6409d2641 fix(ci): resolve minimatch audit vulnerability (#51) 
* fix(ci): resolve minimatch audit vulnerability

* fix(ci): normalize minimatch overrides to npmjs packages
 2026-02-22 14:02:10 +02:00
github-actions[bot] e06c3952a3 chore: CVE advisories - 6 new, 9 updated (#50) 
Automated update from NVD CVE feed.
Keywords: OpenClaw clawdbot Moltbot
Poll window: 2026-02-20T06:16:59Z to 2026-02-22T10:57:13.000Z

Co-authored-by: davida-ps <232346510+davida-ps@users.noreply.github.com>
 2026-02-22 12:58:09 +02:00
github-actions[bot] c61e4e5dbc chore: CVE advisories - 23 new, 0 updated (#47) 
Automated update from NVD CVE feed.
Keywords: OpenClaw clawdbot Moltbot
Poll window: 2026-02-08T18:42:58Z to 2026-02-20T06:16:40.000Z

Co-authored-by: davida-ps <232346510+davida-ps@users.noreply.github.com>
 2026-02-22 12:55:58 +02:00
dependabot[bot] bd8931a094 chore(deps-dev): bump vite from 6.4.1 to 7.3.1 (#43) 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.1 to 7.3.1.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 7.3.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-17 11:03:55 +02:00
dependabot[bot] be5140aaae chore(deps-dev): bump @vitejs/plugin-react from 5.1.3 to 5.1.4 (#44) 
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 5.1.3 to 5.1.4.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@5.1.4/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 5.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-17 10:54:59 +02:00
dependabot[bot] 047b3ffa06 chore(deps-dev): bump @types/node from 22.19.8 to 25.2.3 (#45) 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.19.8 to 25.2.3.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.2.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-17 10:51:35 +02:00
dependabot[bot] 143dd311c6 chore(deps-dev): bump @typescript-eslint/parser from 8.55.0 to 8.56.0 (#46) 
Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 8.55.0 to 8.56.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.56.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.56.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-17 10:48:28 +02:00
David Abutbul f43f792a88 feat(skills): add clawsec-clawhub-checker reputation checking skill (#41) 
* feat(skills): add clawsec-clawhub-checker reputation checking skill

- Adds ClawHub reputation checks to guarded installer
- Integrates VirusTotal Code Insight scores
- Requires --confirm-reputation for suspicious skills
- Enhances advisory guardian hook with reputation warnings
- Defense-in-depth layer for skill installation security

* feat: add clawsec-clawhub-checker skill

- Enhanced guarded installer with reputation checks
- VirusTotal Code Insight integration
- Reputation scoring (0-100) with multiple signals
- New exit code 43 for reputation warnings
- Requires --confirm-reputation for suspicious skills
- Integration with clawsec-advisory-guardian hook
- Standalone skill compatible with dynamic catalog system

Note: Removed hardcoded catalog entry to work with new
dynamic catalog system (discover_skill_catalog.mjs).

* fix: lint errors in clawsec-clawhub-checker

- Remove unused imports (fs, os, path) from check_clawhub_reputation.mjs
- Remove unused variable in setup_reputation_hook.mjs
- Remove unused os import from update_suite_catalog.mjs
- All ESLint checks now pass
- TypeScript check passes
- Build check passes

* refactor: remove PR_NOTES.md and update documentation in README.md and SKILL.md
feat: add input validation for skill slug and version in check_clawhub_reputation.mjs
fix: enhance argument parsing in enhanced_guarded_install.mjs
test: add reputation check tests for input validation and output formatting
chore: delete unused update_suite_catalog.mjs script

* feat: enhance clawsec-clawhub-checker with setup script and reputation checks

* feat: integrate reputation checks into clawhub setup script and enhance installer

* docs: update README and SKILL documentation to reflect new installer scripts and usage instructions

* feat: enhance CLI validation for skill version and reputation threshold; update documentation

---------

Co-authored-by: davida-ps <david.a@prompt.security>
 2026-02-16 21:27:32 +02:00
dependabot[bot] bfd230a178 chore(deps): bump bandit from 1.7.9 to 1.9.3 in /.github (#32) 
Bumps [bandit](https://github.com/PyCQA/bandit) from 1.7.9 to 1.9.3.
- [Release notes](https://github.com/PyCQA/bandit/releases)
- [Commits](https://github.com/PyCQA/bandit/compare/1.7.9...1.9.3)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.9.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 19:18:53 +02:00
dependabot[bot] d5cf5c0b9c chore(deps): bump lucide-react from 0.563.0 to 0.564.0 (#37) 
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 0.563.0 to 0.564.0.
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.564.0/packages/lucide-react)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 0.564.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 19:16:10 +02:00
dependabot[bot] 74a6d23a20 chore(deps): bump github/codeql-action from 3.29.6 to 4.32.3 (#34) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.6 to 4.32.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3.29.6...9e907b5e64f6b83e7804b09294d44122997950d6)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 19:12:58 +02:00
dependabot[bot] 5e2f623ead chore(deps): bump actions/checkout from 4.2.2 to 6.0.2 (#39) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.2.2...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 19:10:08 +02:00
dependabot[bot] b05265fba1 chore(deps): bump ruff from 0.6.9 to 0.15.1 in /.github (#30) 
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.6.9 to 0.15.1.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/0.6.9...0.15.1)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 19:03:40 +02:00
dependabot[bot] 176aa1f06a chore(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 (#38) 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.1 to 2.4.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/f49aabe0b5af0936a0987cfb85d86b75731b0186...4eaacf0543bb3f2c246792bd56e8cdeffafb205a)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 19:00:31 +02:00
davida-ps 63de5ce08d Security Audit Suppression Mechanism (fulfills https://github.com/prompt-security/clawsec/issues/25) (#40) 
* auto-claude: subtask-1-1 - Create config loading utility with multi-path fallback

Created load_suppression_config.mjs with:
- Multi-path fallback: ~/.openclaw/security-audit.json -> .clawsec/allowlist.json
- Environment variable support (OPENCLAW_AUDIT_CONFIG)
- Custom path support via CLI argument
- Schema validation (checkId, skill, reason, suppressedAt required)
- Malformed JSON error handling
- Graceful fallback to empty suppressions when no config exists
- ISO 8601 date format validation with warnings

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* auto-claude: subtask-1-2 - Create example config file template

- Added security-audit-config.example.json with two suppression examples
- Included examples for clawsec-suite and openclaw-audit-watchdog
- Created comprehensive README.md explaining configuration format
- All required fields documented (checkId, skill, reason, suppressedAt)
- ISO 8601 date format demonstrated
- JSON validated successfully

* auto-claude: subtask-1-3 - Add unit tests for config loading

Added comprehensive unit tests for suppression config loading:
- Valid config with all required fields
- Malformed date warning (non-blocking)
- Missing required field validation
- Malformed JSON error handling
- File not found graceful fallback
- Custom path priority
- Environment variable override
- Missing/empty suppressions array handling

All 10 tests passing.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* auto-claude: subtask-2-1 - Add suppression filtering to render_report.mjs

Implements suppression filtering logic for security audit findings:
- Import loadSuppressionConfig for config loading
- Add --config CLI argument for custom config paths
- Create extractSkillName() to extract skill names from findings (tries multiple fields)
- Create filterFindings() to split findings into active/suppressed
- Match suppressions by BOTH checkId AND skill name (exact match required)
- Attach suppression metadata (reason, suppressedAt) to suppressed findings
- Modify render() to accept suppressedFindings parameter
- Apply filtering in main execution before rendering

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* auto-claude: subtask-2-2 - Add INFO-SUPPRESSED section to report output

- Added lineForSuppressedFinding() to format suppressed findings
- Added INFO-SUPPRESSED section showing suppressed findings with reason and date
- Suppressed findings are not counted in summary (already filtered)
- Follows existing code patterns for report sections

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* auto-claude: subtask-3-1 - Add --config flag to run_audit_and_format.sh

- Added --config flag to accept path to config file
- Added --help flag with usage documentation
- Config flag is passed to openclaw audit commands when provided
- Follows existing pattern for --label flag

* auto-claude: subtask-4-1 - Create integration tests for render_report with suppressions

Created comprehensive integration tests covering:
- Suppressed findings appear in INFO-SUPPRESSED section
- Active findings appear in CRITICAL/WARN section
- Summary counts exclude suppressed findings
- Backward compatibility (no config)
- Partial matches don't suppress (checkId or skill alone)
- Multiple suppressions work correctly
- Skill name extraction from path field
- Skill name extraction from title field
- Empty suppressions array behaves like no config

Bug fix in render_report.mjs:
- Summary counts now recalculated after filtering suppressed findings
- Previously summary showed original counts instead of filtered counts

All 10 tests passing.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* auto-claude: subtask-4-2 - Manual E2E test with real openclaw audit

- Fixed run_audit_and_format.sh to pass --config flag to render_report.mjs
- Enhanced lineForFinding() to display skill names for better clarity
- Enhanced lineForSuppressedFinding() to display skill names consistently
- Created comprehensive E2E test documentation in E2E-TEST-RESULTS.md
- All E2E verification points passed:
  * Config loading from custom paths
  * Suppression matching by checkId + skill name
  * INFO-SUPPRESSED section display
  * Suppression reason and date display
  * Summary count accuracy (excludes suppressed findings)
  * Non-suppressed findings preservation
  * Skill name display in all findings
- All integration tests still passing (10/10)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* auto-claude: subtask-5-1 - Update README.md with suppression feature

* auto-claude: subtask-5-2 - Update SKILL.md with usage examples

* - Add backslash escaping before quote escaping in oneline() function
- Prevents incomplete string escaping vulnerability
- Resolves CodeQL alert: https://github.com/prompt-security/clawsec/security/code-scanning/16

* Fix regex in extractSkillName function and simplify error handling in suppression config tests

* Enhance suppression mechanism in OpenClaw Audit Watchdog

- Updated README.md to clarify suppression configuration and activation requirements.
- Improved SKILL.md with examples for suppressing known findings.
- Refactored load_suppression_config.mjs to implement opt-in gating for suppressions.
- Modified render_report.mjs to support suppression flag in report generation.
- Enhanced run_audit_and_format.sh and runner.sh scripts to accept --enable-suppressions flag.
- Added test cases for suppression configuration, including validation for enabledFor sentinel and opt-in behavior.
- Introduced new test files for empty and invalid suppression configurations.

* Fix type assertion for checksums file entries in Checksums component

* Update ESLint configuration and dependencies to pin @eslint/js to version 9.28.0

* Update CHANGELOG.md for advisory suppression module and OpenClaw Audit Watchdog enhancements

* Refactor finding comparison logic in render_report.mjs to simplify equality checks

* chore(clawsec-suite): bump version to 0.1.2

* chore(openclaw-audit-watchdog): bump version to 0.1.0

* Remove suppressed matches tracking from state to prevent re-evaluation alerts

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-02-16 18:55:06 +02:00
dependabot[bot] d41101a20c chore(deps-dev): bump @eslint/js from 9.39.2 to 10.0.1 (#31) 
Bumps [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) from 9.39.2 to 10.0.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/HEAD/packages/js)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 10.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 17:15:50 +02:00
dependabot[bot] 654dc5fbcf chore(deps-dev): bump @typescript-eslint/eslint-plugin (#36) 
Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 8.54.0 to 8.55.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.55.0/packages/eslint-plugin)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.55.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 17:08:42 +02:00
dependabot[bot] 8b599f95dc chore(deps-dev): bump @typescript-eslint/parser from 8.54.0 to 8.55.0 (#29) 
Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 8.54.0 to 8.55.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.55.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.55.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: davida-ps <david.a@prompt.security>
 2026-02-16 17:05:17 +02:00
dependabot[bot] 8e744dfbb1 chore(deps): bump actions/upload-artifact from 4.6.1 to 6.0.0 (#33) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1...b7c566a772e6b6bfb58ed0dc250532a479d7789f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: davida-ps <david.a@prompt.security>
 2026-02-16 17:03:16 +02:00
dependabot[bot] c5c812adc8 chore(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 (#28) 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.33.1 to 0.34.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/b6643a29fecd7f34b3597bc6acb0a98b03d33ff8...c1824fd6edce30d7ab345a9989de00bbd46ef284)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-16 17:01:05 +02:00
davida-ps 65c40f67d9 Feat/codescan (#27) 
* feat: add Dependabot configuration for GitHub Actions, npm, and pip updates
feat: implement CodeQL analysis workflow for security scanning
fix: update permissions in community advisory workflow for better access control
fix: adjust permissions in poll NVD CVEs workflow for enhanced functionality
fix: update Scorecard workflow to use specific version of upload-sarif action
fix: refine permissions in skill release workflow for improved security and functionality

* feat: add guidance documentation for agents and development setup

* Update .github/workflows/codeql.yml

Co-authored-by: baz-reviewer[bot] <174234987+baz-reviewer[bot]@users.noreply.github.com>

---------

Co-authored-by: baz-reviewer[bot] <174234987+baz-reviewer[bot]@users.noreply.github.com>
 2026-02-16 16:00:43 +02:00
Zvika Ronen 398bd450ac Add Scorecard supply-chain security workflow (#17) 
This workflow analyzes the supply-chain security of the repository using Scorecard and uploads the results.

Co-authored-by: davida-ps <david.a@prompt.security>
 2026-02-16 15:11:38 +02:00
davida-ps 51532bc753 Added dynamic skill-catalog discovery in clawsec-suite (#26) 
* feat(clawsec-suite): integrate audit-watchdog and add email-gated setup

* fix(clawsec-suite): escape shell env assignments in watchdog setup

* fix(lint): remove unnecessary escapes in watchdog exec template

* clawsec-suite: add dynamic remote skill catalog discovery with fallback

* clawsec-suite: align signed feed defaults and checksum key compatibility

* fix(lint): use globalThis fetch/AbortController in catalog script

* Revert "fix(lint): remove unnecessary escapes in watchdog exec template"

This reverts commit 09e40d2a8861e2d179137467c9ba938776609a56.

* Revert "fix(clawsec-suite): escape shell env assignments in watchdog setup"

This reverts commit 54d97653a6f8ac14c125ef14c59bca7532cfee15.

* Revert "feat(clawsec-suite): integrate audit-watchdog and add email-gated setup"

This reverts commit 1ba55dd69ecb7a248a53123277158ce27474d5f7.

* fix(openclaw-audit-watchdog): escape shell env interpolation in setup_cron

* ci(signing): enforce key consistency across docs, repo, and generated assets

* docs(readme): document signing key consistency CI guardrails

* chore(clawsec-suite): bump to 0.1.0 and record release changelog

* chore(changelog): update to version 0.1.1 and enhance signing key drift control documentation

* chore(clawsec-suite): bump version to 0.1.1
 2026-02-16 14:47:32 +02:00
David Abutbul 76778b8bb6 fix: improve changelog extraction logic to handle additional separators and headings clawsec-suite-v0.0.10 2026-02-12 20:21:51 +02:00
David Abutbul 26fa73fc92 feat: enhance skill release workflow with changelog extraction for versioned releases 2026-02-12 20:18:22 +02:00
David Abutbul 8918171c6d ER FIX: enhance skill release workflow with republish functionality and due to flaky clawhub api 2026-02-12 19:55:52 +02:00
davida-ps 705d38f39f feat: add public key files for signing and enhance release script wit… (#23) 
* feat: add public key files for signing and enhance release script with changelog extraction

* Update scripts/release-skill.sh

Co-authored-by: baz-reviewer[bot] <174234987+baz-reviewer[bot]@users.noreply.github.com>

* fix: correct GitHub release command and improve messaging for feature branches

* Update scripts/release-skill.sh

Co-authored-by: baz-reviewer[bot] <174234987+baz-reviewer[bot]@users.noreply.github.com>

* feat: add GitHub release creation status tracking and update messaging

---------

Co-authored-by: baz-reviewer[bot] <174234987+baz-reviewer[bot]@users.noreply.github.com>
 2026-02-12 19:39:59 +02:00
davida-ps 5ee8587b1e Integration/signing work (#20) 
* ci: sign advisory feed and checksums in workflows

* feat(clawsec-suite): add verifier-side signature and checksum enforcement

Implements cryptographic verification for advisory feed loading:

- Ed25519 detached signature verification for feed.json
- Supports raw base64 and JSON-wrapped signature formats
- Pinned public key at advisories/feed-signing-public.pem

- SHA-256 checksum manifest (checksums.json) verification
- Signed checksums.json.sig prevents partial artifact substitution
- Verifies feed.json, feed.json.sig, and public key against manifest

- Remote feed: returns null on verification failure (triggers fallback)
- Local feed: throws on verification failure (hard fail)
- No silent bypass of verification

- CLAWSEC_ALLOW_UNSIGNED_FEED=1 temporarily bypasses verification
- Warning logged when bypass mode is enabled
- Intended for transition period only

- guarded_skill_install without --version matches any advisory for skill
- Encourages explicit version specification

- scripts/sign_detached_ed25519.mjs - signing utility
- scripts/verify_detached_ed25519.mjs - verification utility
- scripts/generate_checksums_json.mjs - checksum manifest generator
- test/feed_verification.test.mjs - 14 verification tests
- test/guarded_install.test.mjs - 6 install flow tests

- hooks/.../lib/feed.mjs - full rewrite with verification
- hooks/.../handler.ts - verification options integration
- scripts/guarded_skill_install.mjs - verification integration
- skill.json - v0.0.9, new SBOM entries, openssl requirement
- SKILL.md - signed install flow, env vars documentation
- HOOK.md - new environment variables
- ci.yml - added verification test job

Refs: fail-closed verification, Ed25519 signatures, checksum manifests

* fix: update action versions in CI workflows for improved stability

* chore(clawsec-suite): bump version to 0.0.10

* feat: enhance security measures in asset deployment and add changelog for version history

* feat: add dry-run signing for advisory artifacts and generate checksums

* fix: enhance error handling in loadRemoteFeed for security policy violations

* feat: implement Ed25519 signing and verification for advisory artifacts and checksums

* feat: implement signing and verification for advisory artifacts and checksums in workflows

* feat: update dry-run signing key generation to use Ed25519 algorithm

* feat: update Ed25519 signing and verification to use -rawin flag for compatibility

* feat: add public key copying to advisory directory and implement safe basename extraction for URLs

* feat: remove Product Hunt promotion section from README and Home page
 2026-02-12 18:49:34 +02:00