mirror of
https://github.com/prompt-security/clawsec.git
synced 2026-06-13 13:38:03 +03:00
Compare commits
3 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 github-actions[bot]
|
bcfe832030 | ||
|
github-actions[bot]
|
e3546119ee | ||
|
github-actions[bot]
|
11786d8b10 |
@@ -1,56 +0,0 @@
|
||||
{
|
||||
"plugins": [
|
||||
{
|
||||
"name": "global-skills",
|
||||
"source": "./",
|
||||
"skills": [
|
||||
"./skills/clawtributor"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "hermes-skills",
|
||||
"source": "./",
|
||||
"skills": [
|
||||
"./skills/hermes-attestation-guardian",
|
||||
"./skills/hermes-traffic-guardian"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "nano-claw-skills",
|
||||
"source": "./",
|
||||
"skills": [
|
||||
"./skills/clawsec-nanoclaw",
|
||||
"./skills/nanoclaw-traffic-guardian"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "open-claw-skills",
|
||||
"source": "./",
|
||||
"skills": [
|
||||
"./skills/clawsec-clawhub-checker",
|
||||
"./skills/clawsec-feed",
|
||||
"./skills/clawsec-scanner",
|
||||
"./skills/clawsec-suite",
|
||||
"./skills/openclaw-audit-watchdog",
|
||||
"./skills/openclaw-traffic-guardian",
|
||||
"./skills/soul-guardian"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "pico-claw-skills",
|
||||
"source": "./",
|
||||
"skills": [
|
||||
"./skills/picoclaw-security-guardian",
|
||||
"./skills/picoclaw-self-pen-testing",
|
||||
"./skills/picoclaw-traffic-guardian"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "repo-internal-skills",
|
||||
"source": "./",
|
||||
"skills": [
|
||||
"./skills/claw-release"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
* text=auto
|
||||
|
||||
# Keep executable/script sources LF across platforms.
|
||||
*.sh text eol=lf
|
||||
*.bash text eol=lf
|
||||
*.zsh text eol=lf
|
||||
*.mjs text eol=lf
|
||||
*.js text eol=lf
|
||||
*.ts text eol=lf
|
||||
*.tsx text eol=lf
|
||||
*.py text eol=lf
|
||||
|
||||
# Keep config/docs deterministic in CI and local tooling.
|
||||
*.md text eol=lf
|
||||
*.json text eol=lf
|
||||
*.yml text eol=lf
|
||||
*.yaml text eol=lf
|
||||
*.toml text eol=lf
|
||||
*.pem text eol=lf
|
||||
|
||||
# Binary assets.
|
||||
*.png binary
|
||||
*.ico binary
|
||||
*.ttf binary
|
||||
@@ -1,63 +0,0 @@
|
||||
---
|
||||
name: Bug Report
|
||||
about: Report a bug or unexpected behavior
|
||||
labels: bug, needs-triage
|
||||
---
|
||||
|
||||
## Opener Type
|
||||
|
||||
<!-- Check one: -->
|
||||
- [ ] Human
|
||||
- [ ] Agent (automated report)
|
||||
|
||||
---
|
||||
|
||||
## Bug Description
|
||||
|
||||
<!-- A clear and concise description of the bug -->
|
||||
|
||||
## Steps to Reproduce
|
||||
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
|
||||
## Expected Behavior
|
||||
|
||||
<!-- What you expected to happen -->
|
||||
|
||||
## Actual Behavior
|
||||
|
||||
<!-- What actually happened -->
|
||||
|
||||
---
|
||||
|
||||
## Environment
|
||||
|
||||
- **OS:** <!-- e.g., macOS 14.0, Ubuntu 22.04, Windows 11 -->
|
||||
- **Version:** <!-- e.g., 1.2.3 -->
|
||||
- **Platform:** <!-- e.g., OpenClaw, Claude Code -->
|
||||
|
||||
## Logs / Error Output
|
||||
|
||||
```
|
||||
<!-- Paste relevant logs or error messages here -->
|
||||
```
|
||||
|
||||
## Screenshots
|
||||
|
||||
<!-- If applicable, add screenshots to help explain the problem -->
|
||||
|
||||
---
|
||||
|
||||
## Additional Context
|
||||
|
||||
<!-- Any other context about the problem -->
|
||||
|
||||
---
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] I have searched existing issues to ensure this is not a duplicate
|
||||
- [ ] I have included steps to reproduce the bug
|
||||
- [ ] I have included relevant environment information
|
||||
@@ -1,75 +0,0 @@
|
||||
---
|
||||
name: Feature Request
|
||||
about: Suggest a new feature or enhancement
|
||||
labels: enhancement, needs-triage
|
||||
---
|
||||
|
||||
## Opener Type
|
||||
|
||||
<!-- Check one: -->
|
||||
- [ ] Human
|
||||
- [ ] Agent (automated suggestion)
|
||||
|
||||
---
|
||||
|
||||
## Feature Summary
|
||||
|
||||
<!-- A brief, one-line summary of the feature -->
|
||||
|
||||
## Problem Statement
|
||||
|
||||
<!-- What problem does this feature solve? Why is it needed? -->
|
||||
|
||||
## Proposed Solution
|
||||
|
||||
<!-- Describe your proposed solution or implementation approach -->
|
||||
|
||||
## Alternatives Considered
|
||||
|
||||
<!-- What alternative solutions or features have you considered? -->
|
||||
|
||||
---
|
||||
|
||||
## Use Cases
|
||||
|
||||
<!-- Describe specific use cases where this feature would be beneficial -->
|
||||
|
||||
1.
|
||||
2.
|
||||
|
||||
## User Impact
|
||||
|
||||
<!-- Who benefits from this feature? How does it improve their experience? -->
|
||||
|
||||
---
|
||||
|
||||
## Implementation Notes (Optional)
|
||||
|
||||
<!-- Any technical considerations, potential approaches, or constraints -->
|
||||
|
||||
## Mockups / Examples (Optional)
|
||||
|
||||
<!-- If applicable, add mockups, diagrams, or examples -->
|
||||
|
||||
---
|
||||
|
||||
## Priority Assessment
|
||||
|
||||
<!-- Check one: -->
|
||||
- [ ] Nice to have - Would improve UX but not critical
|
||||
- [ ] Important - Addresses a common pain point
|
||||
- [ ] Critical - Blocks important workflows or use cases
|
||||
|
||||
---
|
||||
|
||||
## Additional Context
|
||||
|
||||
<!-- Any other context or information about the feature request -->
|
||||
|
||||
---
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] I have searched existing issues to ensure this is not a duplicate
|
||||
- [ ] I have clearly described the problem this feature would solve
|
||||
- [ ] I have considered alternative approaches
|
||||
@@ -1,105 +0,0 @@
|
||||
---
|
||||
name: Security Incident Report
|
||||
about: Report malicious prompts, vulnerable skills, or tampering attempts
|
||||
labels: security, needs-triage
|
||||
---
|
||||
|
||||
## Opener Type
|
||||
|
||||
<!-- Check one: -->
|
||||
- [ ] Human
|
||||
- [ ] Agent (automated report)
|
||||
|
||||
---
|
||||
|
||||
## Report Type
|
||||
|
||||
<!-- Check one: -->
|
||||
- [ ] Malicious Prompt - Detected prompt injection or social engineering attempt
|
||||
- [ ] Vulnerable Skill - Found a skill with security issues
|
||||
- [ ] Tampering Attempt - Observed attempt to disable/modify ClawSec
|
||||
|
||||
## Severity
|
||||
|
||||
<!-- Check one: -->
|
||||
- [ ] Critical - Active exploitation, data exfiltration, complete bypass
|
||||
- [ ] High - Significant security risk, potential for harm
|
||||
- [ ] Medium - Security concern that should be addressed
|
||||
- [ ] Low - Minor issue, best practice violation
|
||||
|
||||
---
|
||||
|
||||
## Title
|
||||
|
||||
<!-- Brief descriptive title of the incident -->
|
||||
|
||||
## Description
|
||||
|
||||
<!-- Detailed description of what was observed -->
|
||||
|
||||
---
|
||||
|
||||
## Evidence
|
||||
|
||||
### Observed At
|
||||
<!-- ISO 8601 timestamp: YYYY-MM-DDTHH:MM:SSZ -->
|
||||
|
||||
### Context
|
||||
<!-- What was happening when this occurred -->
|
||||
|
||||
### Payload
|
||||
<!-- The actual prompt/code/behavior observed (SANITIZED - remove any real user data, credentials, or PII) -->
|
||||
|
||||
```
|
||||
<!-- Paste sanitized payload here -->
|
||||
```
|
||||
|
||||
### Indicators
|
||||
<!-- List specific indicators that flagged this as suspicious -->
|
||||
-
|
||||
-
|
||||
-
|
||||
|
||||
---
|
||||
|
||||
## Affected
|
||||
|
||||
### Skill Name
|
||||
<!-- Name of the affected skill (if applicable) -->
|
||||
|
||||
### Skill Version
|
||||
<!-- Version number (if known) -->
|
||||
|
||||
### Platforms
|
||||
<!-- Check all that apply: -->
|
||||
- [ ] OpenClaw
|
||||
- [ ] Other: <!-- specify -->
|
||||
|
||||
---
|
||||
|
||||
## Recommended Action
|
||||
|
||||
<!-- What should users do in response to this threat? -->
|
||||
|
||||
---
|
||||
|
||||
## Reporter Information (Optional)
|
||||
|
||||
**Agent/User Name:**
|
||||
**Contact:** <!-- How to reach for follow-up -->
|
||||
|
||||
---
|
||||
|
||||
## Privacy Checklist
|
||||
|
||||
<!-- Confirm before submitting: -->
|
||||
- [ ] I have removed all real user data and PII
|
||||
- [ ] I have not included any API keys, credentials, or secrets
|
||||
- [ ] Evidence is sanitized and describes issues abstractly where needed
|
||||
- [ ] No proprietary or confidential information is included
|
||||
|
||||
---
|
||||
|
||||
## Additional Notes
|
||||
|
||||
<!-- Any other relevant information -->
|
||||
@@ -1,44 +0,0 @@
|
||||
## Opener Type
|
||||
|
||||
<!-- Check one: -->
|
||||
- [ ] Human
|
||||
- [ ] Agent (automated)
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
<!-- Brief description of changes -->
|
||||
|
||||
## Changes Made
|
||||
|
||||
-
|
||||
-
|
||||
|
||||
## Related Issues
|
||||
|
||||
<!-- Link any related issues: Fixes #123, Relates to #456 -->
|
||||
|
||||
---
|
||||
|
||||
## Type of Change
|
||||
|
||||
<!-- Check all that apply: -->
|
||||
- [ ] Bug fix (non-breaking change that fixes an issue)
|
||||
- [ ] New feature (non-breaking change that adds functionality)
|
||||
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
|
||||
- [ ] Documentation update
|
||||
- [ ] Security incident (please open a Security Incident Report issue instead of a PR)
|
||||
|
||||
---
|
||||
|
||||
## Testing
|
||||
|
||||
<!-- Describe how you tested these changes -->
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] My code follows the project's style guidelines
|
||||
- [ ] I have performed a self-review of my changes
|
||||
- [ ] I have added tests that prove my fix/feature works
|
||||
- [ ] New and existing tests pass locally
|
||||
@@ -1,110 +0,0 @@
|
||||
name: Sign and Verify File
|
||||
description: Sign a file with the CI private key and verify the signature against one or more files.
|
||||
|
||||
inputs:
|
||||
private_key:
|
||||
description: PEM-encoded private key contents.
|
||||
required: true
|
||||
private_key_passphrase:
|
||||
description: Optional passphrase for encrypted private keys.
|
||||
required: false
|
||||
default: ""
|
||||
input_file:
|
||||
description: File to sign.
|
||||
required: true
|
||||
signature_file:
|
||||
description: Output path for base64 signature.
|
||||
required: true
|
||||
verify_files:
|
||||
description: Newline-separated list of files to verify with the generated signature. Defaults to input_file.
|
||||
required: false
|
||||
default: ""
|
||||
public_key_output:
|
||||
description: Optional output path for the derived public key.
|
||||
required: false
|
||||
default: ""
|
||||
|
||||
outputs:
|
||||
signature_file:
|
||||
description: Signature file path.
|
||||
value: ${{ steps.sign.outputs.signature_file }}
|
||||
public_key_file:
|
||||
description: Public key file path when public_key_output is set.
|
||||
value: ${{ steps.sign.outputs.public_key_file }}
|
||||
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- id: sign
|
||||
shell: bash
|
||||
env:
|
||||
PRIVATE_KEY: ${{ inputs.private_key }}
|
||||
PRIVATE_KEY_PASSPHRASE: ${{ inputs.private_key_passphrase }}
|
||||
INPUT_FILE: ${{ inputs.input_file }}
|
||||
SIGNATURE_FILE: ${{ inputs.signature_file }}
|
||||
VERIFY_FILES_RAW: ${{ inputs.verify_files }}
|
||||
PUBLIC_KEY_OUTPUT: ${{ inputs.public_key_output }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
if [ -z "${PRIVATE_KEY:-}" ]; then
|
||||
echo "::error::Missing required private key input."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "${INPUT_FILE}" ]; then
|
||||
echo "::error file=${INPUT_FILE}::Input file not found for signing."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
umask 077
|
||||
tmp_dir="$(mktemp -d)"
|
||||
cleanup() {
|
||||
rm -rf "${tmp_dir}"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
key_file="${tmp_dir}/private.pem"
|
||||
pub_file="${tmp_dir}/public.pem"
|
||||
sig_bin="${tmp_dir}/signature.bin"
|
||||
|
||||
printf '%s' "${PRIVATE_KEY}" > "${key_file}"
|
||||
|
||||
passin_args=()
|
||||
if [ -n "${PRIVATE_KEY_PASSPHRASE:-}" ]; then
|
||||
passin_args=(-passin "pass:${PRIVATE_KEY_PASSPHRASE}")
|
||||
fi
|
||||
|
||||
openssl pkey -in "${key_file}" "${passin_args[@]}" -pubout -out "${pub_file}"
|
||||
|
||||
mkdir -p "$(dirname "${SIGNATURE_FILE}")"
|
||||
# Sign with Ed25519 (requires -rawin flag for raw input)
|
||||
openssl pkeyutl -sign -rawin -inkey "${key_file}" "${passin_args[@]}" -in "${INPUT_FILE}" \
|
||||
| openssl base64 -A > "${SIGNATURE_FILE}"
|
||||
|
||||
openssl base64 -d -A -in "${SIGNATURE_FILE}" -out "${sig_bin}"
|
||||
|
||||
verify_files="${VERIFY_FILES_RAW}"
|
||||
if [ -z "${verify_files}" ]; then
|
||||
verify_files="${INPUT_FILE}"
|
||||
fi
|
||||
|
||||
while IFS= read -r verify_file; do
|
||||
[ -z "${verify_file}" ] && continue
|
||||
if [ ! -f "${verify_file}" ]; then
|
||||
echo "::error file=${verify_file}::Verification target does not exist."
|
||||
exit 1
|
||||
fi
|
||||
# Verify Ed25519 signature (requires -rawin flag for raw input)
|
||||
openssl pkeyutl -verify -rawin -pubin -inkey "${pub_file}" -sigfile "${sig_bin}" -in "${verify_file}" >/dev/null
|
||||
done <<< "${verify_files}"
|
||||
|
||||
if [ -n "${PUBLIC_KEY_OUTPUT}" ]; then
|
||||
mkdir -p "$(dirname "${PUBLIC_KEY_OUTPUT}")"
|
||||
cp "${pub_file}" "${PUBLIC_KEY_OUTPUT}"
|
||||
echo "public_key_file=${PUBLIC_KEY_OUTPUT}" >> "${GITHUB_OUTPUT}"
|
||||
else
|
||||
echo "public_key_file=" >> "${GITHUB_OUTPUT}"
|
||||
fi
|
||||
|
||||
echo "signature_file=${SIGNATURE_FILE}" >> "${GITHUB_OUTPUT}"
|
||||
@@ -1,4 +0,0 @@
|
||||
name: "ClawSec CodeQL Config"
|
||||
|
||||
paths-ignore:
|
||||
- dist/**
|
||||
@@ -1,19 +0,0 @@
|
||||
version: 2
|
||||
updates:
|
||||
- package-ecosystem: "github-actions"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "weekly"
|
||||
open-pull-requests-limit: 5
|
||||
|
||||
- package-ecosystem: "npm"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "weekly"
|
||||
open-pull-requests-limit: 5
|
||||
|
||||
- package-ecosystem: "pip"
|
||||
directory: "/.github"
|
||||
schedule:
|
||||
interval: "weekly"
|
||||
open-pull-requests-limit: 5
|
||||
@@ -1,2 +0,0 @@
|
||||
ruff==0.15.13
|
||||
bandit==1.9.4
|
||||
@@ -1,74 +0,0 @@
|
||||
name: Archive GitHub Traffic
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '17 3 * * *'
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
concurrency:
|
||||
group: traffic-archive
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
TRAFFIC_ARCHIVE_BRANCH: traffic-archive
|
||||
TRAFFIC_ARCHIVE_DIR: ../traffic-archive/traffic
|
||||
|
||||
jobs:
|
||||
archive:
|
||||
name: Capture traffic snapshot
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout source
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
|
||||
- name: Prepare archive branch
|
||||
env:
|
||||
ARCHIVE_PUSH_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
git config --global user.name "github-actions[bot]"
|
||||
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
||||
|
||||
server="${GITHUB_SERVER_URL#https://}"
|
||||
archive_remote="https://x-access-token:${ARCHIVE_PUSH_TOKEN}@${server}/${GITHUB_REPOSITORY}.git"
|
||||
|
||||
if git ls-remote --exit-code --heads "${archive_remote}" "${TRAFFIC_ARCHIVE_BRANCH}" >/dev/null 2>&1; then
|
||||
git clone --branch "${TRAFFIC_ARCHIVE_BRANCH}" --depth 1 "${archive_remote}" ../traffic-archive
|
||||
else
|
||||
git init -b "${TRAFFIC_ARCHIVE_BRANCH}" ../traffic-archive
|
||||
git -C ../traffic-archive remote add origin "${archive_remote}"
|
||||
fi
|
||||
|
||||
mkdir -p "${TRAFFIC_ARCHIVE_DIR}"
|
||||
|
||||
- name: Collect traffic
|
||||
env:
|
||||
GH_TRAFFIC_TOKEN: ${{ secrets.TRAFFIC_ARCHIVE_TOKEN || github.token }}
|
||||
GITHUB_REPOSITORY: ${{ github.repository }}
|
||||
run: node scripts/archive-github-traffic.mjs --archive-dir "${TRAFFIC_ARCHIVE_DIR}"
|
||||
|
||||
- name: Commit archive
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
cd ../traffic-archive
|
||||
git add traffic/archive.json traffic/summary.json
|
||||
git rm --ignore-unmatch traffic/README.md
|
||||
|
||||
if git diff --cached --quiet; then
|
||||
echo "No traffic archive changes."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
git commit -m "chore(traffic): archive repository traffic $(date -u +%F)"
|
||||
git push origin HEAD:${TRAFFIC_ARCHIVE_BRANCH}
|
||||
@@ -1,165 +0,0 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
|
||||
permissions: read-all
|
||||
|
||||
jobs:
|
||||
lint-typescript:
|
||||
name: Lint TypeScript/React (${{ matrix.os }})
|
||||
runs-on: ${{ matrix.os }}
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os:
|
||||
- ubuntu-latest
|
||||
- macos-latest
|
||||
- windows-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
- run: npm ci
|
||||
- name: ESLint
|
||||
run: npx eslint . --ext .ts,.tsx,.js,.jsx,.mjs --max-warnings 0
|
||||
- name: TypeScript Check
|
||||
run: npx tsc --noEmit
|
||||
- name: Build Check
|
||||
if: matrix.os == 'ubuntu-latest'
|
||||
run: npm run build
|
||||
|
||||
lint-python:
|
||||
name: Lint Python
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
||||
with:
|
||||
python-version: '3.12'
|
||||
- name: Ruff (lint + format check)
|
||||
run: pipx run --spec "ruff==0.6.9" ruff check utils/ --output-format=github
|
||||
- name: Bandit (security)
|
||||
run: pipx run --spec "bandit==1.7.9" bandit -r utils/ -ll
|
||||
|
||||
lint-shell:
|
||||
name: Lint Shell Scripts
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- name: ShellCheck
|
||||
uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
|
||||
with:
|
||||
scandir: './scripts'
|
||||
severity: warning
|
||||
|
||||
security-scan:
|
||||
name: Security Scan
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- name: Trivy FS Scan
|
||||
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.34.1
|
||||
with:
|
||||
scan-type: 'fs'
|
||||
scan-ref: '.'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '1'
|
||||
ignore-unfixed: true
|
||||
- name: Trivy Config Scan
|
||||
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.34.1
|
||||
with:
|
||||
scan-type: 'config'
|
||||
scan-ref: '.'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '1'
|
||||
|
||||
dependency-audit:
|
||||
name: Dependency Audit
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
- run: npm ci
|
||||
- name: npm audit
|
||||
run: npm audit --audit-level=high --registry=https://registry.npmjs.org
|
||||
- name: Check for outdated deps
|
||||
run: npm outdated || true
|
||||
|
||||
advisory-feed-tests:
|
||||
name: Advisory Feed Tests
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
- run: npm ci
|
||||
- name: GHSA Without CVE Feed Tests
|
||||
run: node scripts/test-ghsa-without-cve-feed.mjs
|
||||
- name: GHSA Poll Workflow Tests
|
||||
run: node scripts/test-ghsa-poll-workflow.mjs
|
||||
- name: NVD GHSA Consolidation Workflow Tests
|
||||
run: node scripts/test-nvd-ghsa-consolidation-workflow.mjs
|
||||
- name: NVD + GHSA Pipeline Dry Run
|
||||
run: node scripts/test-nvd-ghsa-pipeline-dry-run.mjs
|
||||
- name: Skill Release Tooling Tests
|
||||
run: |
|
||||
set -euo pipefail
|
||||
for test_file in scripts/test-skill-*.mjs; do
|
||||
node "$test_file"
|
||||
done
|
||||
- name: Deploy Pages Advisory Checksums Tests
|
||||
run: node scripts/test-deploy-pages-checksums.mjs
|
||||
- name: GitHub Traffic Archive Tests
|
||||
run: node scripts/test-github-traffic-archive.mjs
|
||||
|
||||
clawsec-suite-tests:
|
||||
name: ClawSec Suite Verification Tests
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
- run: npm ci
|
||||
- name: Feed Verification Tests
|
||||
run: node skills/clawsec-suite/test/feed_verification.test.mjs
|
||||
- name: Guarded Install Tests
|
||||
run: node skills/clawsec-suite/test/guarded_install.test.mjs
|
||||
- name: Advisory Suppression Tests
|
||||
run: node skills/clawsec-suite/test/advisory_suppression.test.mjs
|
||||
- name: Path Resolution Tests
|
||||
run: node skills/clawsec-suite/test/path_resolution.test.mjs
|
||||
- name: Fuzz Property Tests
|
||||
run: node skills/clawsec-suite/test/fuzz_properties.test.mjs
|
||||
- name: Semver/Scope/Suppression Fuzz Tests
|
||||
run: node skills/clawsec-suite/test/fuzz_semver_scope_suppression.test.mjs
|
||||
- name: Advisory Application Scope Tests
|
||||
run: node skills/clawsec-suite/test/advisory_application_scope.test.mjs
|
||||
|
||||
openclaw-audit-watchdog-tests:
|
||||
name: OpenClaw Audit Watchdog Tests
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
- run: npm ci
|
||||
- name: Suppression Config Tests
|
||||
run: node skills/openclaw-audit-watchdog/test/suppression_config.test.mjs
|
||||
- name: Suppression Config Fuzz Tests
|
||||
run: node skills/openclaw-audit-watchdog/test/suppression_config_fuzz.test.mjs
|
||||
- name: Render Report Suppression Tests
|
||||
run: node skills/openclaw-audit-watchdog/test/render_report_suppression.test.mjs
|
||||
@@ -1,41 +0,0 @@
|
||||
name: CodeQL
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
schedule:
|
||||
- cron: "17 3 * * 1"
|
||||
|
||||
permissions: read-all
|
||||
|
||||
jobs:
|
||||
analyze:
|
||||
name: Analyze (CodeQL)
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
security-events: write
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
language: ["javascript-typescript"]
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
config-file: ./.github/codeql/codeql-config.yml
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Build project
|
||||
run: npm run build
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
|
||||
@@ -1,345 +0,0 @@
|
||||
name: Process Community Advisory
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: [labeled]
|
||||
|
||||
permissions: read-all
|
||||
|
||||
concurrency:
|
||||
group: community-advisory
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
FEED_PATH: advisories/feed.json
|
||||
FEED_SIG_PATH: advisories/feed.json.sig
|
||||
SKILL_FEED_PATH: skills/clawsec-feed/advisories/feed.json
|
||||
SKILL_FEED_SIG_PATH: skills/clawsec-feed/advisories/feed.json.sig
|
||||
|
||||
jobs:
|
||||
process-advisory:
|
||||
if: github.event.label.name == 'advisory-approved'
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Parse issue and create advisory
|
||||
id: parse
|
||||
env:
|
||||
ISSUE_BODY: ${{ github.event.issue.body }}
|
||||
ISSUE_NUMBER: ${{ github.event.issue.number }}
|
||||
ISSUE_URL: ${{ github.event.issue.html_url }}
|
||||
ISSUE_TITLE: ${{ github.event.issue.title }}
|
||||
ISSUE_CREATED_AT: ${{ github.event.issue.created_at }}
|
||||
run: |
|
||||
# Generate advisory ID: CLAW-YYYY-{issue_number padded to 4 digits}
|
||||
# Use issue creation year, not current year, to ensure consistency
|
||||
YEAR=$(echo "$ISSUE_CREATED_AT" | cut -c1-4)
|
||||
PADDED_NUM=$(printf "%04d" "$ISSUE_NUMBER")
|
||||
ADVISORY_ID="CLAW-${YEAR}-${PADDED_NUM}"
|
||||
echo "advisory_id=$ADVISORY_ID" >> $GITHUB_OUTPUT
|
||||
echo "Generated advisory ID: $ADVISORY_ID"
|
||||
|
||||
# Check if advisory already exists by issue URL (dedupe by issue, not by ID)
|
||||
# This prevents duplicates when the same issue is labeled in different years
|
||||
if jq -e --arg url "$ISSUE_URL" '.advisories[] | select(.github_issue_url == $url)' "$FEED_PATH" > /dev/null 2>&1; then
|
||||
echo "Advisory for issue $ISSUE_URL already exists in feed"
|
||||
echo "already_exists=true" >> $GITHUB_OUTPUT
|
||||
exit 0
|
||||
fi
|
||||
echo "already_exists=false" >> $GITHUB_OUTPUT
|
||||
|
||||
# Parse opener type (human vs agent)
|
||||
if echo "$ISSUE_BODY" | grep -q '\[x\] Agent'; then
|
||||
OPENER_TYPE="agent"
|
||||
else
|
||||
OPENER_TYPE="human"
|
||||
fi
|
||||
echo "Opener type: $OPENER_TYPE"
|
||||
|
||||
# Parse report type
|
||||
if echo "$ISSUE_BODY" | grep -q '\[x\] Malicious Prompt'; then
|
||||
REPORT_TYPE="prompt_injection"
|
||||
elif echo "$ISSUE_BODY" | grep -q '\[x\] Vulnerable Skill'; then
|
||||
REPORT_TYPE="vulnerable_skill"
|
||||
elif echo "$ISSUE_BODY" | grep -q '\[x\] Tampering Attempt'; then
|
||||
REPORT_TYPE="tampering_attempt"
|
||||
else
|
||||
REPORT_TYPE="unknown"
|
||||
fi
|
||||
echo "Report type: $REPORT_TYPE"
|
||||
|
||||
# Parse severity
|
||||
if echo "$ISSUE_BODY" | grep -q '\[x\] Critical'; then
|
||||
SEVERITY="critical"
|
||||
elif echo "$ISSUE_BODY" | grep -q '\[x\] High'; then
|
||||
SEVERITY="high"
|
||||
elif echo "$ISSUE_BODY" | grep -q '\[x\] Medium'; then
|
||||
SEVERITY="medium"
|
||||
elif echo "$ISSUE_BODY" | grep -q '\[x\] Low'; then
|
||||
SEVERITY="low"
|
||||
else
|
||||
SEVERITY="medium"
|
||||
fi
|
||||
echo "Severity: $SEVERITY"
|
||||
|
||||
# Parse title (between ## Title and ## Description)
|
||||
TITLE=$(echo "$ISSUE_BODY" | sed -n '/^## Title/,/^## Description/p' | grep -v '^## ' | grep -v '^<!--' | grep -v '^\s*$' | head -1 | xargs)
|
||||
if [ -z "$TITLE" ]; then
|
||||
TITLE="$ISSUE_TITLE"
|
||||
fi
|
||||
echo "Title: $TITLE"
|
||||
|
||||
# Parse description (between ## Description and ---)
|
||||
DESCRIPTION=$(echo "$ISSUE_BODY" | sed -n '/^## Description/,/^---/p' | grep -v '^## Description' | grep -v '^---' | grep -v '^<!--' | sed '/^\s*$/d' | tr '\n' ' ' | xargs)
|
||||
if [ -z "$DESCRIPTION" ]; then
|
||||
DESCRIPTION="See issue for details."
|
||||
fi
|
||||
echo "Description: ${DESCRIPTION:0:100}..."
|
||||
|
||||
# Parse skill name and version
|
||||
SKILL_NAME=$(echo "$ISSUE_BODY" | sed -n '/^### Skill Name/,/^### /p' | grep -v '^### ' | grep -v '^<!--' | grep -v '^\s*$' | head -1 | xargs)
|
||||
SKILL_VERSION=$(echo "$ISSUE_BODY" | sed -n '/^### Skill Version/,/^### /p' | grep -v '^### ' | grep -v '^<!--' | grep -v '^\s*$' | head -1 | xargs)
|
||||
|
||||
# Build affected array
|
||||
AFFECTED="[]"
|
||||
if [ -n "$SKILL_NAME" ] && [ -n "$SKILL_VERSION" ]; then
|
||||
AFFECTED=$(jq -n --arg name "$SKILL_NAME" --arg ver "$SKILL_VERSION" '[$name + "@" + $ver]')
|
||||
elif [ -n "$SKILL_NAME" ]; then
|
||||
AFFECTED=$(jq -n --arg name "$SKILL_NAME" '[$name]')
|
||||
fi
|
||||
echo "Affected: $AFFECTED"
|
||||
|
||||
# Build platforms array
|
||||
OPENCLAW_SELECTED="false"
|
||||
if echo "$ISSUE_BODY" | grep -qi '^[[:space:]]*-[[:space:]]*\[[xX]\][[:space:]]*OpenClaw'; then
|
||||
OPENCLAW_SELECTED="true"
|
||||
fi
|
||||
|
||||
OTHER_PLATFORM_RAW=$(echo "$ISSUE_BODY" | sed -n 's/^[[:space:]]*-[[:space:]]*\[[xX]\][[:space:]]*Other:[[:space:]]*\(.*\)$/\1/p' | head -1 | xargs)
|
||||
OTHER_PLATFORM=""
|
||||
if [ -n "$OTHER_PLATFORM_RAW" ]; then
|
||||
OTHER_PLATFORM=$(echo "$OTHER_PLATFORM_RAW" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9._-]+/-/g; s/^-+//; s/-+$//')
|
||||
if echo "$OTHER_PLATFORM" | grep -q 'nanoclaw'; then
|
||||
OTHER_PLATFORM="nanoclaw"
|
||||
fi
|
||||
fi
|
||||
|
||||
PLATFORMS=$(jq -n --arg open "$OPENCLAW_SELECTED" --arg other "$OTHER_PLATFORM" '
|
||||
[
|
||||
(if $open == "true" then "openclaw" else empty end),
|
||||
(if ($other | length) > 0 then $other else empty end)
|
||||
] | unique
|
||||
')
|
||||
if [ "$PLATFORMS" = "[]" ]; then
|
||||
PLATFORMS='["openclaw","nanoclaw"]'
|
||||
fi
|
||||
echo "Platforms: $PLATFORMS"
|
||||
|
||||
# Parse recommended action
|
||||
ACTION=$(echo "$ISSUE_BODY" | sed -n '/^## Recommended Action/,/^---/p' | grep -v '^## Recommended Action' | grep -v '^---' | grep -v '^<!--' | sed '/^\s*$/d' | tr '\n' ' ' | xargs)
|
||||
if [ -z "$ACTION" ]; then
|
||||
ACTION="Review the advisory details and take appropriate action."
|
||||
fi
|
||||
echo "Action: ${ACTION:0:100}..."
|
||||
|
||||
# Parse reporter name
|
||||
REPORTER_NAME=$(echo "$ISSUE_BODY" | grep -A1 '\*\*Agent/User Name:\*\*' | tail -1 | sed 's/\*\*Contact:\*\*.*//' | xargs)
|
||||
if [ -z "$REPORTER_NAME" ]; then
|
||||
REPORTER_NAME=$(echo "$ISSUE_BODY" | sed -n 's/.*\*\*Agent\/User Name:\*\*\s*\(.*\)/\1/p' | xargs)
|
||||
fi
|
||||
echo "Reporter: $REPORTER_NAME"
|
||||
|
||||
# Get current timestamp
|
||||
PUBLISHED=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
|
||||
# Create advisory JSON
|
||||
jq -n \
|
||||
--arg id "$ADVISORY_ID" \
|
||||
--arg severity "$SEVERITY" \
|
||||
--arg type "$REPORT_TYPE" \
|
||||
--arg title "$TITLE" \
|
||||
--arg description "$DESCRIPTION" \
|
||||
--argjson affected "$AFFECTED" \
|
||||
--argjson platforms "$PLATFORMS" \
|
||||
--arg action "$ACTION" \
|
||||
--arg published "$PUBLISHED" \
|
||||
--arg source "Community Report" \
|
||||
--arg issue_url "$ISSUE_URL" \
|
||||
--arg reporter_name "$REPORTER_NAME" \
|
||||
--arg opener_type "$OPENER_TYPE" \
|
||||
'{
|
||||
id: $id,
|
||||
severity: $severity,
|
||||
type: $type,
|
||||
title: $title,
|
||||
description: $description,
|
||||
affected: $affected,
|
||||
platforms: $platforms,
|
||||
action: $action,
|
||||
published: $published,
|
||||
references: [],
|
||||
source: $source,
|
||||
github_issue_url: $issue_url,
|
||||
reporter: {
|
||||
agent_name: $reporter_name,
|
||||
opener_type: $opener_type
|
||||
}
|
||||
}' > tmp_advisory.json
|
||||
|
||||
echo "Created advisory JSON:"
|
||||
cat tmp_advisory.json
|
||||
|
||||
- name: Set up Python for exploitability analysis
|
||||
if: steps.parse.outputs.already_exists != 'true'
|
||||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
||||
with:
|
||||
python-version: '3.10'
|
||||
|
||||
- name: Analyze exploitability for community advisory
|
||||
if: steps.parse.outputs.already_exists != 'true'
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
echo "=== Analyzing exploitability for community advisory ==="
|
||||
|
||||
scripts/ci/enrich_exploitability.sh \
|
||||
--mode single \
|
||||
--input tmp_advisory.json \
|
||||
--output tmp_advisory.json
|
||||
|
||||
echo "=== Exploitability analysis complete ==="
|
||||
echo "Exploitability score: $(jq -r '.exploitability_score // "unknown"' tmp_advisory.json)"
|
||||
|
||||
- name: Update feed
|
||||
if: steps.parse.outputs.already_exists != 'true'
|
||||
run: |
|
||||
NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
|
||||
# Add new advisory to feed
|
||||
jq --argjson new "$(cat tmp_advisory.json)" --arg now "$NOW" '
|
||||
.updated = $now |
|
||||
.advisories = ([$new] + .advisories)
|
||||
' "$FEED_PATH" > tmp_feed.json
|
||||
|
||||
# Validate JSON
|
||||
if jq empty tmp_feed.json 2>/dev/null; then
|
||||
echo "Feed JSON is valid"
|
||||
mv tmp_feed.json "$FEED_PATH"
|
||||
|
||||
# Sync to skill feed
|
||||
mkdir -p "$(dirname "$SKILL_FEED_PATH")"
|
||||
cp "$FEED_PATH" "$SKILL_FEED_PATH"
|
||||
|
||||
echo "Updated feeds:"
|
||||
echo " - $FEED_PATH"
|
||||
echo " - $SKILL_FEED_PATH"
|
||||
|
||||
TOTAL=$(jq '.advisories | length' "$FEED_PATH")
|
||||
echo "Total advisories: $TOTAL"
|
||||
else
|
||||
echo "Error: Generated invalid JSON"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Sign advisory feed and verify
|
||||
if: steps.parse.outputs.already_exists != 'true'
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY }}
|
||||
private_key_passphrase: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY_PASSPHRASE }}
|
||||
input_file: ${{ env.FEED_PATH }}
|
||||
signature_file: ${{ env.FEED_SIG_PATH }}
|
||||
verify_files: |
|
||||
${{ env.FEED_PATH }}
|
||||
${{ env.SKILL_FEED_PATH }}
|
||||
|
||||
- name: Sync advisory signature to skill feed
|
||||
if: steps.parse.outputs.already_exists != 'true'
|
||||
run: cp "$FEED_SIG_PATH" "$SKILL_FEED_SIG_PATH"
|
||||
|
||||
- name: Require automation token for write operations
|
||||
env:
|
||||
AUTOMATION_TOKEN: ${{ secrets.POLL_NVD_CVES_PAT }}
|
||||
run: |
|
||||
if [ -z "$AUTOMATION_TOKEN" ]; then
|
||||
echo "::error::Set POLL_NVD_CVES_PAT with repo write permissions."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Create Pull Request
|
||||
if: steps.parse.outputs.already_exists != 'true'
|
||||
id: create-pr
|
||||
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
|
||||
with:
|
||||
token: ${{ secrets.POLL_NVD_CVES_PAT }}
|
||||
branch: automated/community-advisory-${{ github.event.issue.number }}
|
||||
delete-branch: true
|
||||
title: "chore: add community advisory ${{ steps.parse.outputs.advisory_id }}"
|
||||
body: |
|
||||
## Summary
|
||||
Add community advisory `${{ steps.parse.outputs.advisory_id }}` from issue #${{ github.event.issue.number }}.
|
||||
|
||||
- Issue: ${{ github.event.issue.html_url }}
|
||||
- Reporter: @${{ github.event.issue.user.login }}
|
||||
- Trigger: `advisory-approved` label
|
||||
|
||||
---
|
||||
*This PR was generated by the community advisory workflow.*
|
||||
commit-message: |
|
||||
chore: add community advisory ${{ steps.parse.outputs.advisory_id }}
|
||||
|
||||
Added from issue #${{ github.event.issue.number }}
|
||||
Issue: ${{ github.event.issue.html_url }}
|
||||
add-paths: |
|
||||
${{ env.FEED_PATH }}
|
||||
${{ env.FEED_SIG_PATH }}
|
||||
${{ env.SKILL_FEED_PATH }}
|
||||
${{ env.SKILL_FEED_SIG_PATH }}
|
||||
|
||||
- name: Comment on issue
|
||||
if: steps.parse.outputs.already_exists != 'true'
|
||||
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
||||
with:
|
||||
github-token: ${{ secrets.POLL_NVD_CVES_PAT }}
|
||||
script: |
|
||||
const advisoryId = '${{ steps.parse.outputs.advisory_id }}';
|
||||
const pullRequestUrl = '${{ steps.create-pr.outputs.pull-request-url }}';
|
||||
const operation = '${{ steps.create-pr.outputs.pull-request-operation }}';
|
||||
await github.rest.issues.createComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: context.issue.number,
|
||||
body: `## Advisory Pull Request Opened
|
||||
|
||||
This security report has been prepared for publication in the ClawSec advisory feed.
|
||||
|
||||
**Advisory ID:** \`${advisoryId}\`
|
||||
**Pull Request:** ${pullRequestUrl || 'No PR generated (no file changes detected)'}
|
||||
**PR Operation:** \`${operation || 'none'}\`
|
||||
|
||||
The advisory will be published after the pull request is merged.
|
||||
|
||||
Thank you for your contribution to community security!`
|
||||
});
|
||||
|
||||
- name: Comment if already exists
|
||||
if: steps.parse.outputs.already_exists == 'true'
|
||||
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
||||
with:
|
||||
github-token: ${{ secrets.POLL_NVD_CVES_PAT }}
|
||||
script: |
|
||||
const advisoryId = '${{ steps.parse.outputs.advisory_id }}';
|
||||
await github.rest.issues.createComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: context.issue.number,
|
||||
body: `## Advisory Already Exists
|
||||
|
||||
An advisory with ID \`${advisoryId}\` already exists in the feed. No changes were made.
|
||||
|
||||
If this is a different issue, please open a new issue.`
|
||||
});
|
||||
@@ -1,486 +0,0 @@
|
||||
name: Deploy to GitHub Pages
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
workflow_run:
|
||||
workflows: ["Skill Release"]
|
||||
types: [completed]
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pages: write
|
||||
id-token: write
|
||||
|
||||
concurrency:
|
||||
group: pages
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
# Production build only: manual dispatch, push to main, or trusted release workflows.
|
||||
# PR validation runs in .github/workflows/pages-verify.yml.
|
||||
if: |
|
||||
github.event_name == 'workflow_dispatch' ||
|
||||
(
|
||||
github.event_name == 'push' &&
|
||||
github.ref_name == 'main'
|
||||
) ||
|
||||
(
|
||||
github.event_name == 'workflow_run' &&
|
||||
github.event.workflow_run.conclusion == 'success' &&
|
||||
github.event.workflow_run.name == 'Skill Release' &&
|
||||
github.event.workflow_run.event != 'pull_request'
|
||||
)
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
- name: Verify signing key consistency (repo + docs)
|
||||
run: ./scripts/ci/verify_signing_key_consistency.sh
|
||||
|
||||
- name: Auto-discover skills from releases
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p public/skills
|
||||
mkdir -p public/releases/download
|
||||
|
||||
echo "Fetching releases from GitHub API..."
|
||||
|
||||
# Helper function to download release asset by ID (works for private repos)
|
||||
download_asset() {
|
||||
local asset_id="$1"
|
||||
local output_file="$2"
|
||||
curl -fsSL \
|
||||
-H "Authorization: Bearer ${GITHUB_TOKEN}" \
|
||||
-H "Accept: application/octet-stream" \
|
||||
"https://api.github.com/repos/${REPO}/releases/assets/${asset_id}" \
|
||||
-o "$output_file"
|
||||
}
|
||||
export -f download_asset # Export for use in subshells (while loop)
|
||||
|
||||
# Fetch all releases (paginated)
|
||||
RELEASES=$(gh api --paginate \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
"/repos/${REPO}/releases?per_page=100" \
|
||||
| jq -s 'add // []')
|
||||
|
||||
# Start building skills index
|
||||
echo '{"version":"1.0.0","updated":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","skills":[' > public/skills/index.json
|
||||
|
||||
FIRST_SKILL=true
|
||||
declare -A PROCESSED_SKILLS=()
|
||||
|
||||
# Process each release (using process substitution to avoid subshell)
|
||||
while read -r release; do
|
||||
TAG=$(echo "$release" | jq -r '.tag_name')
|
||||
|
||||
# Parse skill-name-v* pattern
|
||||
if [[ "$TAG" =~ ^(.+)-v([0-9]+\.[0-9]+\.[0-9]+.*)$ ]]; then
|
||||
SKILL_NAME="${BASH_REMATCH[1]}"
|
||||
VERSION="${BASH_REMATCH[2]}"
|
||||
|
||||
# Skip if we already processed a newer version of this skill
|
||||
if [[ -n "${PROCESSED_SKILLS[$SKILL_NAME]+x}" ]]; then
|
||||
echo "Skipping older version: $TAG (already have newer)"
|
||||
continue
|
||||
fi
|
||||
|
||||
echo "Processing: $SKILL_NAME v$VERSION"
|
||||
|
||||
# Get skill.json asset ID from release
|
||||
SKILL_JSON_ID=$(echo "$release" | jq -r '.assets[] | select(.name=="skill.json") | .id')
|
||||
|
||||
if [ -n "$SKILL_JSON_ID" ] && [ "$SKILL_JSON_ID" != "null" ]; then
|
||||
# Basic safety checks before using tag/asset names as paths
|
||||
if [[ "$TAG" == *"/"* ]] || [[ "$TAG" == *".."* ]]; then
|
||||
echo " Warning: Skipping suspicious tag name: $TAG"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Download skill.json first to decide whether the skill is internal
|
||||
SKILL_JSON_TMP=$(mktemp)
|
||||
download_asset "$SKILL_JSON_ID" "$SKILL_JSON_TMP"
|
||||
|
||||
# Skip internal skills (not shown in public catalog or mirrored)
|
||||
IS_INTERNAL=$(jq -r '.openclaw.internal // false' "$SKILL_JSON_TMP")
|
||||
if [ "$IS_INTERNAL" = "true" ]; then
|
||||
echo " Skipping internal skill: $SKILL_NAME"
|
||||
rm -f "$SKILL_JSON_TMP"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Security: Download to temp directory first, verify signatures, then mirror to final location.
|
||||
# This ensures unverified releases never appear in public/releases or the skills catalog.
|
||||
|
||||
# Use temp directory for downloads before verification
|
||||
TEMP_DOWNLOAD_DIR=$(mktemp -d)
|
||||
|
||||
# Move skill.json to temp dir first
|
||||
mv "$SKILL_JSON_TMP" "$TEMP_DOWNLOAD_DIR/skill.json"
|
||||
|
||||
# Download all remaining assets to temp dir
|
||||
while read -r asset; do
|
||||
ASSET_ID=$(echo "$asset" | jq -r '.id')
|
||||
ASSET_NAME=$(echo "$asset" | jq -r '.name')
|
||||
|
||||
# Prevent path traversal / nested directories
|
||||
if [[ "$ASSET_NAME" == *"/"* ]] || [[ "$ASSET_NAME" == *".."* ]]; then
|
||||
echo " Warning: Skipping suspicious asset name: $ASSET_NAME"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Already downloaded above
|
||||
if [ "$ASSET_NAME" = "skill.json" ]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
download_asset "$ASSET_ID" "$TEMP_DOWNLOAD_DIR/$ASSET_NAME"
|
||||
echo " Downloaded to temp: $ASSET_NAME"
|
||||
done < <(echo "$release" | jq -c '.assets[]')
|
||||
|
||||
# Verify signed checksums when signature artifacts are present.
|
||||
# Legacy releases without signatures are still mirrored for backward compatibility.
|
||||
if [ -f "$TEMP_DOWNLOAD_DIR/checksums.sig" ] && [ -f "$TEMP_DOWNLOAD_DIR/signing-public.pem" ] && [ -f "$TEMP_DOWNLOAD_DIR/checksums.json" ]; then
|
||||
openssl base64 -d -A -in "$TEMP_DOWNLOAD_DIR/checksums.sig" -out "$TEMP_DOWNLOAD_DIR/checksums.sig.bin"
|
||||
# Verify Ed25519 signature (requires -rawin)
|
||||
if ! openssl pkeyutl -verify -rawin -pubin -inkey "$TEMP_DOWNLOAD_DIR/signing-public.pem" -sigfile "$TEMP_DOWNLOAD_DIR/checksums.sig.bin" -in "$TEMP_DOWNLOAD_DIR/checksums.json"; then
|
||||
echo " Warning: Invalid checksums signature for $TAG; skipping skill"
|
||||
rm -rf "$TEMP_DOWNLOAD_DIR"
|
||||
continue
|
||||
fi
|
||||
rm -f "$TEMP_DOWNLOAD_DIR/checksums.sig.bin"
|
||||
echo " Verified checksums signature"
|
||||
elif [ -f "$TEMP_DOWNLOAD_DIR/checksums.json" ]; then
|
||||
echo " Warning: Unsigned legacy checksums for $TAG (missing checksums.sig/signing-public.pem)"
|
||||
fi
|
||||
|
||||
# Verification passed or skipped (legacy) - mirror to final location
|
||||
MIRROR_DIR="public/releases/download/${TAG}"
|
||||
mkdir -p "$MIRROR_DIR"
|
||||
cp -r "$TEMP_DOWNLOAD_DIR"/* "$MIRROR_DIR"/
|
||||
echo " Mirrored to: $MIRROR_DIR"
|
||||
|
||||
# Clean up temp directory
|
||||
rm -rf "$TEMP_DOWNLOAD_DIR"
|
||||
|
||||
# Copy the subset needed for the site catalog (skill pages)
|
||||
mkdir -p "public/skills/${SKILL_NAME}"
|
||||
cp "$MIRROR_DIR/skill.json" "public/skills/${SKILL_NAME}/skill.json"
|
||||
echo " Added to catalog: skill.json"
|
||||
|
||||
for file in checksums.json checksums.sig signing-public.pem README.md SKILL.md; do
|
||||
if [ -f "$MIRROR_DIR/$file" ]; then
|
||||
cp "$MIRROR_DIR/$file" "public/skills/${SKILL_NAME}/$file"
|
||||
echo " Added to catalog: $file"
|
||||
fi
|
||||
done
|
||||
|
||||
# Build skill entry for index
|
||||
SKILL_DATA=$(jq -c --arg tag "$TAG" '
|
||||
. as $skill |
|
||||
def object_or_empty($value):
|
||||
if ($value | type) == "object" then $value else {} end;
|
||||
def object_field($name):
|
||||
object_or_empty($skill[$name]?);
|
||||
def platform_meta:
|
||||
($skill.platform as $platform
|
||||
| if ($platform | type) == "string" then object_or_empty($skill[$platform]?)
|
||||
else {}
|
||||
end);
|
||||
def platform_list:
|
||||
([]
|
||||
+ (if ($skill.platforms | type) == "array" then $skill.platforms else [] end)
|
||||
+ (if ($skill.platform | type) == "string" then [$skill.platform] else [] end)
|
||||
+ (["openclaw", "hermes", "nanoclaw", "picoclaw"] | map(select((object_field(.) | length) > 0))))
|
||||
| map(select(type == "string") | ascii_downcase)
|
||||
| unique;
|
||||
{
|
||||
id: .name,
|
||||
name: .name,
|
||||
version: .version,
|
||||
description: .description,
|
||||
emoji: (platform_meta.emoji // object_field("openclaw").emoji // object_field("hermes").emoji // object_field("nanoclaw").emoji // object_field("picoclaw").emoji // "📦"),
|
||||
category: (platform_meta.category // object_field("openclaw").category // object_field("hermes").category // object_field("nanoclaw").category // object_field("picoclaw").category // "utility"),
|
||||
platforms: platform_list,
|
||||
trust: .trust.level,
|
||||
tag: $tag
|
||||
}
|
||||
' "$MIRROR_DIR/skill.json")
|
||||
|
||||
# Append to index (handle first entry without comma)
|
||||
if [ -f "public/skills/.first_done" ]; then
|
||||
echo "," >> public/skills/index.json
|
||||
else
|
||||
touch "public/skills/.first_done"
|
||||
fi
|
||||
echo "$SKILL_DATA" >> public/skills/index.json
|
||||
|
||||
# Mark this skill as processed (track newest only)
|
||||
PROCESSED_SKILLS["$SKILL_NAME"]=1
|
||||
else
|
||||
echo " Warning: skill.json not found in release assets"
|
||||
fi
|
||||
fi
|
||||
done < <(echo "$RELEASES" | jq -c '.[]')
|
||||
|
||||
# Close the JSON array
|
||||
echo ']}' >> public/skills/index.json
|
||||
|
||||
# Clean up temp file
|
||||
rm -f "public/skills/.first_done"
|
||||
|
||||
echo ""
|
||||
echo "=== Skills Index ==="
|
||||
cat public/skills/index.json | jq . || cat public/skills/index.json
|
||||
|
||||
echo ""
|
||||
echo "=== Skills Directory ==="
|
||||
ls -la public/skills/
|
||||
|
||||
- name: Copy advisory feed to public
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p public/advisories
|
||||
cp advisories/feed.json public/advisories/feed.json
|
||||
if [ -f advisories/ghsa-without-cve.json ]; then
|
||||
cp advisories/ghsa-without-cve.json public/advisories/ghsa-without-cve.json
|
||||
fi
|
||||
echo "Copied advisory feed to public/advisories/"
|
||||
cat public/advisories/feed.json | jq '.advisories | length' | xargs -I {} echo "Feed contains {} advisories"
|
||||
if [ -f public/advisories/ghsa-without-cve.json ]; then
|
||||
cat public/advisories/ghsa-without-cve.json | jq '.advisories | length' | xargs -I {} echo "GHSA provisional feed contains {} advisories"
|
||||
fi
|
||||
|
||||
- name: Sign advisory feed and verify
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY }}
|
||||
private_key_passphrase: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY_PASSPHRASE }}
|
||||
input_file: public/advisories/feed.json
|
||||
signature_file: public/advisories/feed.json.sig
|
||||
public_key_output: public/signing-public.pem
|
||||
|
||||
- name: Sign provisional GHSA feed and verify
|
||||
if: hashFiles('public/advisories/ghsa-without-cve.json') != ''
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY }}
|
||||
private_key_passphrase: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY_PASSPHRASE }}
|
||||
input_file: public/advisories/ghsa-without-cve.json
|
||||
signature_file: public/advisories/ghsa-without-cve.json.sig
|
||||
|
||||
- name: Generate advisory checksums manifest
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
FILES_JSON="{}"
|
||||
ADVISORY_ARTIFACTS=(public/advisories/*.json public/advisories/*.json.sig)
|
||||
for file in "${ADVISORY_ARTIFACTS[@]}"; do
|
||||
[ -e "$file" ] || continue
|
||||
REL_PATH="${file#public/}"
|
||||
FILE_SHA=$(sha256sum "$file" | awk '{print $1}')
|
||||
FILE_SIZE=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file")
|
||||
FILES_JSON=$(jq \
|
||||
--arg path "$REL_PATH" \
|
||||
--arg sha "$FILE_SHA" \
|
||||
--argjson size "$FILE_SIZE" \
|
||||
'. + {($path): {sha256: $sha, size: $size, path: $path, url: ("https://clawsec.prompt.security/" + $path)}}' \
|
||||
<<< "$FILES_JSON")
|
||||
done
|
||||
|
||||
# Generate checksums manifest conforming to parseChecksumsManifest expectations:
|
||||
# - schema_version: "1" (manifest format version)
|
||||
# - algorithm: "sha256" (hash algorithm)
|
||||
# - version: "1.1.0" (feed content version, for informational purposes)
|
||||
# - generated_at, repository: metadata
|
||||
# - files: map of path -> {sha256, size, path, url}
|
||||
jq -n \
|
||||
--arg schema_version "1" \
|
||||
--arg algorithm "sha256" \
|
||||
--arg version "1.1.0" \
|
||||
--arg generated "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
||||
--arg repo "${{ github.repository }}" \
|
||||
--argjson files "$FILES_JSON" \
|
||||
'{
|
||||
schema_version: $schema_version,
|
||||
algorithm: $algorithm,
|
||||
version: $version,
|
||||
generated_at: $generated,
|
||||
repository: $repo,
|
||||
files: $files
|
||||
}' > public/checksums.json
|
||||
|
||||
echo "Generated public/checksums.json"
|
||||
jq . public/checksums.json
|
||||
|
||||
- name: Sign checksums and verify
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY }}
|
||||
private_key_passphrase: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY_PASSPHRASE }}
|
||||
input_file: public/checksums.json
|
||||
signature_file: public/checksums.sig
|
||||
|
||||
- name: Verify generated public signing key matches canonical key
|
||||
run: |
|
||||
set -euo pipefail
|
||||
CANONICAL_FPR=$(openssl pkey -pubin -in clawsec-signing-public.pem -outform DER | sha256sum | awk '{print $1}')
|
||||
GENERATED_FPR=$(openssl pkey -pubin -in public/signing-public.pem -outform DER | sha256sum | awk '{print $1}')
|
||||
echo "Canonical key fingerprint: $CANONICAL_FPR"
|
||||
echo "Generated key fingerprint: $GENERATED_FPR"
|
||||
if [ "$CANONICAL_FPR" != "$GENERATED_FPR" ]; then
|
||||
echo "::error::public/signing-public.pem fingerprint mismatch vs clawsec-signing-public.pem"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Copy public key to advisory directory
|
||||
run: |
|
||||
# Clients expect the public key at advisories/feed-signing-public.pem
|
||||
mkdir -p public/advisories
|
||||
cp public/signing-public.pem public/advisories/feed-signing-public.pem
|
||||
echo "Public key available at:"
|
||||
echo " - public/signing-public.pem (root)"
|
||||
echo " - public/advisories/feed-signing-public.pem (advisory-specific)"
|
||||
|
||||
- name: Show signed advisory artifacts
|
||||
run: |
|
||||
echo "Signed advisory artifacts:"
|
||||
ls -la public/advisories/*.json*
|
||||
ls -la public/checksums.json public/checksums.sig public/signing-public.pem
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
|
||||
- name: Get latest clawsec-suite release URL
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
LATEST_TAG=$(
|
||||
gh api --paginate \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
"/repos/${REPO}/releases?per_page=100" \
|
||||
| jq -r -s 'add // [] | [.[] | select(.tag_name | startswith("clawsec-suite-v"))] | first | .tag_name // empty'
|
||||
)
|
||||
|
||||
if [ -n "$LATEST_TAG" ]; then
|
||||
echo "Found latest clawsec-suite tag: $LATEST_TAG"
|
||||
echo "VITE_CLAWSEC_SUITE_URL=https://clawsec.prompt.security/releases/download/${LATEST_TAG}/SKILL.md" >> $GITHUB_ENV
|
||||
|
||||
# Create a local "latest" mirror path for clients that use GitHub-style URLs.
|
||||
# This enables swapping the host:
|
||||
# https://github.com/<repo>/releases/latest/download/<file>
|
||||
# → https://clawsec.prompt.security/releases/latest/download/<file>
|
||||
MIRROR_TAG_DIR="public/releases/download/${LATEST_TAG}"
|
||||
MIRROR_LATEST_DIR="public/releases/latest/download"
|
||||
rm -rf "$MIRROR_LATEST_DIR"
|
||||
mkdir -p "$MIRROR_LATEST_DIR"
|
||||
|
||||
if [ -d "$MIRROR_TAG_DIR" ]; then
|
||||
cp -f "$MIRROR_TAG_DIR"/* "$MIRROR_LATEST_DIR"/ 2>/dev/null || true
|
||||
echo "Mirrored suite release assets to: $MIRROR_LATEST_DIR"
|
||||
else
|
||||
echo "Warning: Suite release assets not mirrored (missing: $MIRROR_TAG_DIR)"
|
||||
fi
|
||||
|
||||
# Mirror advisories feed + signatures at the path referenced by suite docs/heartbeat
|
||||
if [ -f "public/advisories/feed.json" ]; then
|
||||
mkdir -p "$MIRROR_LATEST_DIR/advisories"
|
||||
cp "public/advisories/feed.json" "$MIRROR_LATEST_DIR/advisories/feed.json"
|
||||
cp "public/advisories/feed.json" "$MIRROR_LATEST_DIR/feed.json"
|
||||
fi
|
||||
if [ -f "public/advisories/feed.json.sig" ]; then
|
||||
mkdir -p "$MIRROR_LATEST_DIR/advisories"
|
||||
cp "public/advisories/feed.json.sig" "$MIRROR_LATEST_DIR/advisories/feed.json.sig"
|
||||
cp "public/advisories/feed.json.sig" "$MIRROR_LATEST_DIR/feed.json.sig"
|
||||
fi
|
||||
if [ -f "public/advisories/ghsa-without-cve.json" ]; then
|
||||
mkdir -p "$MIRROR_LATEST_DIR/advisories"
|
||||
cp "public/advisories/ghsa-without-cve.json" "$MIRROR_LATEST_DIR/advisories/ghsa-without-cve.json"
|
||||
cp "public/advisories/ghsa-without-cve.json" "$MIRROR_LATEST_DIR/ghsa-without-cve.json"
|
||||
fi
|
||||
if [ -f "public/advisories/ghsa-without-cve.json.sig" ]; then
|
||||
mkdir -p "$MIRROR_LATEST_DIR/advisories"
|
||||
cp "public/advisories/ghsa-without-cve.json.sig" "$MIRROR_LATEST_DIR/advisories/ghsa-without-cve.json.sig"
|
||||
cp "public/advisories/ghsa-without-cve.json.sig" "$MIRROR_LATEST_DIR/ghsa-without-cve.json.sig"
|
||||
fi
|
||||
if [ -f "public/checksums.json" ]; then
|
||||
cp "public/checksums.json" "$MIRROR_LATEST_DIR/checksums.json"
|
||||
fi
|
||||
if [ -f "public/checksums.sig" ]; then
|
||||
cp "public/checksums.sig" "$MIRROR_LATEST_DIR/checksums.sig"
|
||||
fi
|
||||
if [ -f "public/signing-public.pem" ]; then
|
||||
cp "public/signing-public.pem" "$MIRROR_LATEST_DIR/signing-public.pem"
|
||||
fi
|
||||
else
|
||||
echo "No clawsec-suite release found, using fallback"
|
||||
fi
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Build
|
||||
run: npm run build
|
||||
env:
|
||||
NODE_ENV: production
|
||||
VITE_CLAWSEC_SUITE_URL: ${{ env.VITE_CLAWSEC_SUITE_URL }}
|
||||
|
||||
- name: Copy skills data to dist
|
||||
run: |
|
||||
cp -r public/skills dist/skills 2>/dev/null || echo "No skills directory"
|
||||
cp public/checksums.json dist/checksums.json 2>/dev/null || echo "No checksums manifest"
|
||||
cp public/checksums.sig dist/checksums.sig 2>/dev/null || echo "No checksums signature"
|
||||
cp public/signing-public.pem dist/signing-public.pem 2>/dev/null || echo "No signing public key"
|
||||
cp -r public/advisories dist/advisories 2>/dev/null || echo "No advisories directory"
|
||||
|
||||
echo "=== Dist contents ==="
|
||||
ls -la dist/
|
||||
ls -la dist/skills/ 2>/dev/null || echo "No skills in dist"
|
||||
ls -la dist/advisories/ 2>/dev/null || echo "No advisories in dist"
|
||||
|
||||
- name: Add .nojekyll file
|
||||
run: touch dist/.nojekyll
|
||||
|
||||
- name: Setup Pages
|
||||
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
|
||||
with:
|
||||
path: ./dist
|
||||
|
||||
deploy:
|
||||
# Deploy after a production build succeeds.
|
||||
if: |
|
||||
github.event_name == 'workflow_dispatch' ||
|
||||
(
|
||||
github.event_name == 'push' &&
|
||||
github.ref_name == 'main'
|
||||
) ||
|
||||
(
|
||||
github.event_name == 'workflow_run' &&
|
||||
github.event.workflow_run.conclusion == 'success' &&
|
||||
github.event.workflow_run.name == 'Skill Release' &&
|
||||
github.event.workflow_run.event != 'pull_request'
|
||||
)
|
||||
environment:
|
||||
name: github-pages
|
||||
url: ${{ steps.deployment.outputs.page_url }}
|
||||
runs-on: ubuntu-latest
|
||||
needs: build
|
||||
steps:
|
||||
- name: Deploy to GitHub Pages
|
||||
id: deployment
|
||||
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
|
||||
@@ -1,35 +0,0 @@
|
||||
name: i18n QA
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
paths:
|
||||
- 'README*.md'
|
||||
- 'wiki/**/*.md'
|
||||
- 'scripts/i18n/**'
|
||||
- '.github/workflows/i18n-qa.yml'
|
||||
workflow_dispatch:
|
||||
|
||||
permissions: read-all
|
||||
|
||||
jobs:
|
||||
i18n-qa:
|
||||
name: Translation Integrity Checks
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
||||
with:
|
||||
python-version: '3.12'
|
||||
- name: Run i18n QA
|
||||
run: python scripts/i18n/qa_check.py
|
||||
|
||||
- name: Check markdown links (README/wiki)
|
||||
run: |
|
||||
if [ "${{ github.event_name }}" = "pull_request" ]; then
|
||||
python scripts/i18n/link_check.py --changed-only --base-ref "origin/${{ github.base_ref }}"
|
||||
else
|
||||
python scripts/i18n/link_check.py
|
||||
fi
|
||||
@@ -1,126 +0,0 @@
|
||||
name: Pages Verify
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: pages-verify-${{ github.event.pull_request.number || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
verify-pages-build:
|
||||
name: Verify Pages Build (No Publish)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
- name: Verify signing key consistency (repo + docs)
|
||||
run: ./scripts/ci/verify_signing_key_consistency.sh
|
||||
|
||||
- name: Prepare advisory artifacts for pre-deploy checks
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p public/advisories
|
||||
cp advisories/feed.json public/advisories/feed.json
|
||||
if [ -f advisories/ghsa-without-cve.json ]; then
|
||||
cp advisories/ghsa-without-cve.json public/advisories/ghsa-without-cve.json
|
||||
fi
|
||||
|
||||
- name: Generate advisory checksums manifest
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
FILES_JSON="{}"
|
||||
for file in public/advisories/*.json; do
|
||||
REL_PATH="${file#public/}"
|
||||
FILE_SHA=$(sha256sum "$file" | awk '{print $1}')
|
||||
FILE_SIZE=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file")
|
||||
FILES_JSON=$(jq \
|
||||
--arg path "$REL_PATH" \
|
||||
--arg sha "$FILE_SHA" \
|
||||
--argjson size "$FILE_SIZE" \
|
||||
'. + {($path): {sha256: $sha, size: $size, path: $path, url: ("https://clawsec.prompt.security/" + $path)}}' \
|
||||
<<< "$FILES_JSON")
|
||||
done
|
||||
|
||||
jq -n \
|
||||
--arg schema_version "1" \
|
||||
--arg algorithm "sha256" \
|
||||
--arg version "1.1.0" \
|
||||
--arg generated "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
||||
--arg repo "${{ github.repository }}" \
|
||||
--argjson files "$FILES_JSON" \
|
||||
'{
|
||||
schema_version: $schema_version,
|
||||
algorithm: $algorithm,
|
||||
version: $version,
|
||||
generated_at: $generated,
|
||||
repository: $repo,
|
||||
files: $files
|
||||
}' > public/checksums.json
|
||||
|
||||
- name: Generate ephemeral signing key for PR verification
|
||||
id: test_key
|
||||
run: |
|
||||
set -euo pipefail
|
||||
KEY_FILE=$(mktemp)
|
||||
openssl genpkey -algorithm Ed25519 -out "$KEY_FILE"
|
||||
{
|
||||
echo "private_key<<EOF"
|
||||
cat "$KEY_FILE"
|
||||
echo "EOF"
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
rm -f "$KEY_FILE"
|
||||
|
||||
- name: Sign advisory feed and verify
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ steps.test_key.outputs.private_key }}
|
||||
input_file: public/advisories/feed.json
|
||||
signature_file: public/advisories/feed.json.sig
|
||||
public_key_output: public/signing-public.pem
|
||||
|
||||
- name: Sign provisional GHSA feed and verify
|
||||
if: hashFiles('public/advisories/ghsa-without-cve.json') != ''
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ steps.test_key.outputs.private_key }}
|
||||
input_file: public/advisories/ghsa-without-cve.json
|
||||
signature_file: public/advisories/ghsa-without-cve.json.sig
|
||||
|
||||
- name: Sign checksums and verify
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ steps.test_key.outputs.private_key }}
|
||||
input_file: public/checksums.json
|
||||
signature_file: public/checksums.sig
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Build site
|
||||
run: npm run build
|
||||
env:
|
||||
NODE_ENV: production
|
||||
|
||||
- name: Sanity-check generated artifacts
|
||||
run: |
|
||||
set -euo pipefail
|
||||
test -f dist/index.html
|
||||
test -f public/advisories/feed.json.sig
|
||||
if [ -f public/advisories/ghsa-without-cve.json ]; then
|
||||
test -f public/advisories/ghsa-without-cve.json.sig
|
||||
fi
|
||||
test -f public/checksums.sig
|
||||
test -f public/signing-public.pem
|
||||
@@ -1,158 +0,0 @@
|
||||
name: Poll GHSA Without CVE
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
permissions: read-all
|
||||
|
||||
concurrency:
|
||||
group: poll-ghsa-without-cve
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
FEED_PATH: advisories/feed.json
|
||||
FEED_SIG_PATH: advisories/feed.json.sig
|
||||
GHSA_FEED_PATH: advisories/ghsa-without-cve.json
|
||||
GHSA_FEED_SIG_PATH: advisories/ghsa-without-cve.json.sig
|
||||
SKILL_FEED_PATH: skills/clawsec-feed/advisories/feed.json
|
||||
SKILL_FEED_SIG_PATH: skills/clawsec-feed/advisories/feed.json.sig
|
||||
|
||||
jobs:
|
||||
poll-and-update:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
|
||||
- name: Run GHSA feed tests
|
||||
run: node scripts/test-ghsa-without-cve-feed.mjs
|
||||
|
||||
- name: Poll GitHub Security Advisories
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
node scripts/ghsa-without-cve-feed.mjs \
|
||||
--output "$GHSA_FEED_PATH" \
|
||||
--consolidated-feed "$FEED_PATH" \
|
||||
--existing-feed "$GHSA_FEED_PATH" \
|
||||
--nvd-feed "$FEED_PATH" \
|
||||
--stale-after-days 60
|
||||
|
||||
- name: Sync consolidated feed to clawsec-feed skill
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p "$(dirname "$SKILL_FEED_PATH")"
|
||||
cp "$FEED_PATH" "$SKILL_FEED_PATH"
|
||||
|
||||
- name: Detect feed changes
|
||||
id: changes
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
GHSA_CHANGED=false
|
||||
AGENT_CHANGED=false
|
||||
|
||||
if ! git diff --quiet -- "$GHSA_FEED_PATH" || [ ! -f "$GHSA_FEED_SIG_PATH" ]; then
|
||||
GHSA_CHANGED=true
|
||||
fi
|
||||
|
||||
if ! git diff --quiet -- "$FEED_PATH" "$SKILL_FEED_PATH" || [ ! -f "$FEED_SIG_PATH" ] || [ ! -f "$SKILL_FEED_SIG_PATH" ]; then
|
||||
AGENT_CHANGED=true
|
||||
fi
|
||||
|
||||
echo "ghsa_changed=$GHSA_CHANGED" >> "$GITHUB_OUTPUT"
|
||||
echo "agent_changed=$AGENT_CHANGED" >> "$GITHUB_OUTPUT"
|
||||
|
||||
if [ "$GHSA_CHANGED" = "true" ] || [ "$AGENT_CHANGED" = "true" ]; then
|
||||
echo "changed=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "changed=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Sign GHSA feed and verify
|
||||
if: steps.changes.outputs.ghsa_changed == 'true'
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY }}
|
||||
private_key_passphrase: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY_PASSPHRASE }}
|
||||
input_file: ${{ env.GHSA_FEED_PATH }}
|
||||
signature_file: ${{ env.GHSA_FEED_SIG_PATH }}
|
||||
|
||||
- name: Sign consolidated agent feed and verify
|
||||
if: steps.changes.outputs.agent_changed == 'true'
|
||||
uses: ./.github/actions/sign-and-verify
|
||||
with:
|
||||
private_key: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY }}
|
||||
private_key_passphrase: ${{ secrets.CLAWSEC_SIGNING_PRIVATE_KEY_PASSPHRASE }}
|
||||
input_file: ${{ env.FEED_PATH }}
|
||||
signature_file: ${{ env.FEED_SIG_PATH }}
|
||||
verify_files: |
|
||||
${{ env.FEED_PATH }}
|
||||
${{ env.SKILL_FEED_PATH }}
|
||||
|
||||
- name: Sync consolidated signature to clawsec-feed skill
|
||||
if: steps.changes.outputs.agent_changed == 'true'
|
||||
run: cp "$FEED_SIG_PATH" "$SKILL_FEED_SIG_PATH"
|
||||
|
||||
- name: Create Pull Request
|
||||
if: steps.changes.outputs.changed == 'true'
|
||||
id: create-pr
|
||||
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
|
||||
with:
|
||||
token: ${{ github.token }}
|
||||
branch: automated/ghsa-without-cve-feed
|
||||
delete-branch: true
|
||||
title: 'chore: update provisional GHSA advisory feed'
|
||||
body: |
|
||||
## Summary
|
||||
Updates the provisional GHSA advisory feed and the consolidated agent advisory feed.
|
||||
|
||||
- Feed: `${{ env.GHSA_FEED_PATH }}`
|
||||
- Agent feed: `${{ env.FEED_PATH }}`
|
||||
- Stale threshold: 60 days without a CVE
|
||||
- Statuses: `active`, `matured`, `stale`
|
||||
|
||||
---
|
||||
*This PR was automatically generated by the GHSA-without-CVE polling workflow.*
|
||||
commit-message: |
|
||||
chore: update provisional GHSA advisory feed
|
||||
|
||||
Poll public GitHub Security Advisories without CVE identifiers.
|
||||
add-paths: |
|
||||
${{ env.FEED_PATH }}
|
||||
${{ env.FEED_SIG_PATH }}
|
||||
${{ env.GHSA_FEED_PATH }}
|
||||
${{ env.GHSA_FEED_SIG_PATH }}
|
||||
${{ env.SKILL_FEED_PATH }}
|
||||
${{ env.SKILL_FEED_SIG_PATH }}
|
||||
|
||||
- name: Summary
|
||||
run: |
|
||||
set -euo pipefail
|
||||
echo "## GHSA Without CVE Poll Summary" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Metric | Value |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "|--------|-------|" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Feed changed | ${{ steps.changes.outputs.changed }} |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Agent feed changed | ${{ steps.changes.outputs.agent_changed }} |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| GHSA source feed changed | ${{ steps.changes.outputs.ghsa_changed }} |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Feed path | $GHSA_FEED_PATH |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Agent feed path | $FEED_PATH |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Total advisories | $(jq '.advisories | length' "$GHSA_FEED_PATH") |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Active | $(jq '[.advisories[] | select(.status == "active")] | length' "$GHSA_FEED_PATH") |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Matured | $(jq '[.advisories[] | select(.status == "matured")] | length' "$GHSA_FEED_PATH") |" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "| Stale | $(jq '[.advisories[] | select(.status == "stale")] | length' "$GHSA_FEED_PATH") |" >> "$GITHUB_STEP_SUMMARY"
|
||||
if [ -n "${{ steps.create-pr.outputs.pull-request-url }}" ]; then
|
||||
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "Upserted PR: ${{ steps.create-pr.outputs.pull-request-url }}" >> "$GITHUB_STEP_SUMMARY"
|
||||
fi
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,89 +0,0 @@
|
||||
# This workflow uses actions that are not certified by GitHub. They are provided
|
||||
# by a third-party and are governed by separate terms of service, privacy
|
||||
# policy, and support documentation.
|
||||
|
||||
name: Scorecard supply-chain security
|
||||
on:
|
||||
# For Branch-Protection check. Only the default branch is supported. See
|
||||
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
|
||||
branch_protection_rule:
|
||||
# Run immediately after dependency changes on main so vulnerability alerts close quickly.
|
||||
push:
|
||||
branches: [main]
|
||||
paths:
|
||||
- package.json
|
||||
- package-lock.json
|
||||
- npm-shrinkwrap.json
|
||||
- requirements*.txt
|
||||
- .github/requirements*.txt
|
||||
- .github/requirements-lint-python.txt
|
||||
- .github/workflows/scorecard.yml
|
||||
# To guarantee Maintained check is occasionally updated. See
|
||||
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
|
||||
schedule:
|
||||
- cron: '19 23 * * 0'
|
||||
# Allow maintainers to rescan main on demand after hotfixes.
|
||||
workflow_dispatch:
|
||||
|
||||
# Declare default permissions as read only.
|
||||
permissions: read-all
|
||||
|
||||
jobs:
|
||||
analysis:
|
||||
name: Scorecard analysis
|
||||
runs-on: ubuntu-latest
|
||||
# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
|
||||
if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
|
||||
permissions:
|
||||
# Needed to upload the results to code-scanning dashboard.
|
||||
security-events: write
|
||||
# Needed to publish results and get a badge (see publish_results below).
|
||||
id-token: write
|
||||
# Uncomment the permissions below if installing in a private repository.
|
||||
# contents: read
|
||||
# actions: read
|
||||
|
||||
steps:
|
||||
- name: "Checkout code"
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: "Run analysis"
|
||||
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
||||
with:
|
||||
results_file: results.sarif
|
||||
results_format: sarif
|
||||
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
|
||||
# - you want to enable the Branch-Protection check on a *public* repository, or
|
||||
# - you are installing Scorecard on a *private* repository
|
||||
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
|
||||
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
|
||||
|
||||
# Public repositories:
|
||||
# - Publish results to OpenSSF REST API for easy access by consumers
|
||||
# - Allows the repository to include the Scorecard badge.
|
||||
# - See https://github.com/ossf/scorecard-action#publishing-results.
|
||||
# For private repositories:
|
||||
# - `publish_results` will always be set to `false`, regardless
|
||||
# of the value entered here.
|
||||
publish_results: true
|
||||
|
||||
# (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
|
||||
# file_mode: git
|
||||
|
||||
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
|
||||
# format to the repository Actions tab.
|
||||
- name: "Upload artifact"
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
||||
with:
|
||||
name: SARIF file
|
||||
path: results.sarif
|
||||
retention-days: 5
|
||||
|
||||
# Upload the results to GitHub's code scanning dashboard (optional).
|
||||
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
|
||||
- name: "Upload to code-scanning"
|
||||
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
|
||||
with:
|
||||
sarif_file: results.sarif
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,73 +0,0 @@
|
||||
name: Sync Wiki
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
paths:
|
||||
- 'wiki/**'
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
concurrency:
|
||||
group: wiki-sync
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
sync-wiki:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
- name: Sync wiki folder to repository wiki
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
if [ ! -d wiki ]; then
|
||||
echo "::error::wiki/ directory not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# GitHub Wiki root (/wiki) renders Home.md, not INDEX.md.
|
||||
# INDEX.md is the canonical source; generate Home.md from it.
|
||||
if [ ! -f wiki/INDEX.md ]; then
|
||||
echo "::error::wiki/INDEX.md not found. It is required to generate wiki/Home.md."
|
||||
exit 1
|
||||
fi
|
||||
cp wiki/INDEX.md wiki/Home.md
|
||||
|
||||
WIKI_REMOTE="https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.wiki.git"
|
||||
if ! git ls-remote "$WIKI_REMOTE" >/dev/null 2>&1; then
|
||||
echo "::warning::Wiki remote unavailable (repository wiki may be disabled). Skipping sync."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
WIKI_TMP="$(mktemp -d)"
|
||||
trap 'rm -rf "$WIKI_TMP"' EXIT
|
||||
|
||||
git clone --depth 1 "$WIKI_REMOTE" "$WIKI_TMP"
|
||||
rsync -a --delete --exclude '.git/' wiki/ "$WIKI_TMP/"
|
||||
|
||||
cd "$WIKI_TMP"
|
||||
if [ -z "$(git status --porcelain)" ]; then
|
||||
echo "No wiki changes to sync."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
WIKI_HEAD_REF="$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null || true)"
|
||||
if [ -n "$WIKI_HEAD_REF" ]; then
|
||||
WIKI_BRANCH="${WIKI_HEAD_REF#origin/}"
|
||||
else
|
||||
WIKI_BRANCH="master"
|
||||
fi
|
||||
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
||||
git add -A
|
||||
git commit -m "docs(wiki): sync from ${GITHUB_SHA}"
|
||||
# Clone may sanitize credentials from origin URL; push with explicit auth URL.
|
||||
git push "$WIKI_REMOTE" HEAD:"$WIKI_BRANCH"
|
||||
-53
@@ -1,53 +0,0 @@
|
||||
.claude
|
||||
.auto-claude/
|
||||
.codex
|
||||
_bmad
|
||||
_bmad-output
|
||||
ext-docs
|
||||
# Logs
|
||||
logs
|
||||
*.log
|
||||
npm-debug.log*
|
||||
yarn-debug.log*
|
||||
yarn-error.log*
|
||||
pnpm-debug.log*
|
||||
lerna-debug.log*
|
||||
|
||||
node_modules
|
||||
dist
|
||||
dist-ssr
|
||||
*.local
|
||||
|
||||
# Environment files (may contain secrets)
|
||||
.env*
|
||||
!.env.example
|
||||
|
||||
# Derived public assets (copied during build)
|
||||
public/advisories
|
||||
public/skills
|
||||
public/wiki/
|
||||
|
||||
# Python bytecode
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
|
||||
# Editor directories and files
|
||||
.vscode/*
|
||||
!.vscode/extensions.json
|
||||
.idea
|
||||
.DS_Store
|
||||
*.suo
|
||||
*.ntvs*
|
||||
*.njsproj
|
||||
*.sln
|
||||
*.sw?
|
||||
clawsec-signing-private.pem
|
||||
|
||||
# Auto Claude generated files
|
||||
.auto-claude/
|
||||
.auto-claude-security.json
|
||||
.auto-claude-status
|
||||
.claude_settings.json
|
||||
.worktrees/
|
||||
.security-key
|
||||
logs/security/
|
||||
@@ -1,63 +0,0 @@
|
||||
# Repository Guidelines
|
||||
|
||||
## Project Structure & Module Organization
|
||||
ClawSec combines a Vite + React frontend with security skill packages and release tooling.
|
||||
- Frontend entrypoints: `index.tsx`, `App.tsx`
|
||||
- UI and routes: `components/`, `pages/`
|
||||
- Shared types/constants: `types.ts`, `constants.ts`
|
||||
- Wiki source docs: `wiki/` (synced to GitHub Wiki by `.github/workflows/wiki-sync.yml`)
|
||||
- Generated wiki exports: `public/wiki/` (`llms.txt` outputs; generated locally/CI and gitignored)
|
||||
- Skills: `skills/<skill-name>/` (`skill.json`, `SKILL.md`, optional `scripts/`, `test/`)
|
||||
- Advisory feed: `advisories/feed.json`, `advisories/feed.json.sig`
|
||||
- Automation: `scripts/`, `.github/workflows/`
|
||||
- Python utilities: `utils/validate_skill.py`, `utils/package_skill.py`
|
||||
|
||||
## Build, Test, and Development Commands
|
||||
- `npm install`: install dependencies.
|
||||
- `npm run dev`: run local Vite server.
|
||||
- `npm run build`: create production build (CI gate).
|
||||
- `npm run preview`: preview built app.
|
||||
- `npm run gen:wiki-llms`: generate wiki `llms.txt` exports from `wiki/` into `public/wiki/`.
|
||||
- `./scripts/prepare-to-push.sh [--fix]`: run lint, types, build, and security checks.
|
||||
- `./scripts/populate-local-wiki.sh`: regenerate local wiki `llms.txt` exports for preview.
|
||||
- `npx eslint . --ext .ts,.tsx,.js,.jsx,.mjs --max-warnings 0`: lint JS/TS.
|
||||
- `npx tsc --noEmit`: type-check TypeScript.
|
||||
- `node skills/clawsec-suite/test/feed_verification.test.mjs`: run a skill-local Node test.
|
||||
- `python utils/validate_skill.py skills/<skill-name>`: validate skill schema/metadata.
|
||||
|
||||
## Coding Style & Naming Conventions
|
||||
- Use TypeScript/TSX for frontend code and ESM for scripts.
|
||||
- Follow `eslint.config.js`; prefix intentionally unused vars/args with `_`.
|
||||
- Python under `utils/` follows `pyproject.toml` Ruff/Bandit rules (line length 120).
|
||||
- Name React files in PascalCase (for example, `SkillCard.tsx`), skill directories in kebab-case (for example, `skills/clawsec-feed`), and tests as `*.test.mjs`.
|
||||
|
||||
## Testing Guidelines
|
||||
There is no root `npm test`; tests are mostly skill-local.
|
||||
- Run changed tests directly: `node skills/<skill>/test/<name>.test.mjs`.
|
||||
- For frontend/config changes, run ESLint, `npx tsc --noEmit`, and `npm run build`.
|
||||
- For wiki rendering/export changes, run `npm run gen:wiki-llms` and `npm run build`.
|
||||
- For Python utility updates, run `ruff check utils/` and `bandit -r utils/ -ll`.
|
||||
|
||||
## Pull Request Guidelines
|
||||
- Follow Conventional Commits: `feat(scope): ...`, `fix(scope): ...`, `chore(scope): ...`.
|
||||
- Use skill branches like `skill/<name>-...`.
|
||||
- Keep PRs focused and include summary, security benefit, and testing performed.
|
||||
- Keep versions aligned between `skills/<skill>/skill.json` and `skills/<skill>/SKILL.md`.
|
||||
- Do not push release tags from PR branches; releases are tagged from `main`.
|
||||
- Do not commit generated `public/wiki/` artifacts; edit `wiki/` source files instead.
|
||||
|
||||
## Agent Collaboration & Git Safety
|
||||
- Delete unused or obsolete files only when your changes make them irrelevant; revert files only when the change is yours or explicitly requested. If a git operation creates uncertainty about another agent’s in-flight work, stop and coordinate instead of deleting.
|
||||
- Before deleting any file to fix local type/lint failures, stop and ask the user.
|
||||
- Never edit `.env` or any environment variable files.
|
||||
- Coordinate with other agents before removing their in-progress edits; do not revert or delete work you did not author unless everyone agrees.
|
||||
- Moving, renaming, and restoring files is allowed when done safely.
|
||||
- Never run destructive git operations without explicit written instruction in this conversation: `git reset --hard`, `rm`, `git checkout`/`git restore` to older commits. Treat these as catastrophic; if unsure, stop and ask. In Cursor or Codex Web, use platform tooling as applicable.
|
||||
- Never use `git restore` (or similar revert commands) on files you did not author.
|
||||
- Always run `git status` before committing.
|
||||
- Keep commits atomic and commit only touched files with explicit paths.
|
||||
- For tracked files: `git commit -m "<scoped message>" -- path/to/file1 path/to/file2`.
|
||||
- For new files: `git restore --staged :/ && git add "path/to/file1" "path/to/file2" && git commit -m "<scoped message>" -- path/to/file1 path/to/file2`.
|
||||
- Quote any git path containing brackets or parentheses when staging/committing (for example, `"src/app/[candidate]/**"`).
|
||||
- For rebases, avoid editors: `GIT_EDITOR=:` and `GIT_SEQUENCE_EDITOR=:` (or `--no-edit`).
|
||||
- Never amend commits without explicit written approval in this task thread.
|
||||
@@ -1,30 +0,0 @@
|
||||
import React from 'react';
|
||||
import { HashRouter as Router, Routes, Route } from 'react-router-dom';
|
||||
import { Layout } from './components/Layout';
|
||||
import { Home } from './pages/Home';
|
||||
import { FeedSetup } from './pages/FeedSetup';
|
||||
import { SkillsCatalog } from './pages/SkillsCatalog';
|
||||
import { SkillDetail } from './pages/SkillDetail';
|
||||
import { AdvisoryDetail } from './pages/AdvisoryDetail';
|
||||
import { WikiBrowser } from './pages/WikiBrowser';
|
||||
import { ProductDemo } from './pages/ProductDemo';
|
||||
|
||||
const App: React.FC = () => {
|
||||
return (
|
||||
<Router>
|
||||
<Layout>
|
||||
<Routes>
|
||||
<Route path="/" element={<Home />} />
|
||||
<Route path="/skills" element={<SkillsCatalog />} />
|
||||
<Route path="/skills/:skillId" element={<SkillDetail />} />
|
||||
<Route path="/feed" element={<FeedSetup />} />
|
||||
<Route path="/feed/:advisoryId" element={<AdvisoryDetail />} />
|
||||
<Route path="/demo" element={<ProductDemo />} />
|
||||
<Route path="/wiki/*" element={<WikiBrowser />} />
|
||||
</Routes>
|
||||
</Layout>
|
||||
</Router>
|
||||
);
|
||||
};
|
||||
|
||||
export default App;
|
||||
@@ -1,30 +0,0 @@
|
||||
cff-version: 1.2.0
|
||||
message: "If you use ClawSec in research or security tooling, please cite it as below."
|
||||
title: "ClawSec"
|
||||
version: "0.1.0"
|
||||
date-released: "2026-05-26"
|
||||
abstract: >-
|
||||
ClawSec is a security skill suite for AI agent platforms. It provides
|
||||
advisory monitoring, cryptographic signature verification, guarded skill
|
||||
installation, file integrity checks, and platform-specific security
|
||||
capabilities for OpenClaw, NanoClaw, Hermes, and Picoclaw deployments.
|
||||
type: software
|
||||
license: "AGPL-3.0-or-later"
|
||||
url: "https://clawsec.prompt.security/"
|
||||
repository-code: "https://github.com/prompt-security/clawsec"
|
||||
keywords:
|
||||
- ai-security
|
||||
- agent-security
|
||||
- prompt-injection
|
||||
- security-advisories
|
||||
- software-supply-chain
|
||||
- integrity-verification
|
||||
- openclaw
|
||||
- nanoclaw
|
||||
- hermes
|
||||
- picoclaw
|
||||
authors:
|
||||
- given-names: David
|
||||
family-names: Abutbul
|
||||
affiliation: "Prompt Security"
|
||||
orcid: "https://orcid.org/0009-0001-7883-3593"
|
||||
@@ -1,116 +0,0 @@
|
||||
# CLAUDE.md
|
||||
|
||||
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
|
||||
|
||||
## Development Setup
|
||||
|
||||
```bash
|
||||
npm install # install JS dependencies
|
||||
npm run dev # start Vite dev server on http://localhost:3000
|
||||
npm run build # production build to dist/
|
||||
```
|
||||
|
||||
Python environment (use `uv`, not raw `pip`):
|
||||
|
||||
```bash
|
||||
uv venv # create .venv in repo root
|
||||
source .venv/bin/activate
|
||||
uv pip install ruff bandit # linters configured in pyproject.toml
|
||||
```
|
||||
|
||||
Required tools: Node 20+, Python 3.10+, openssl, jq, shellcheck (`brew install shellcheck`).
|
||||
|
||||
## Common Commands
|
||||
|
||||
**Pre-push validation** (mirrors CI — run before pushing):
|
||||
|
||||
```bash
|
||||
./scripts/prepare-to-push.sh # lint, typecheck, build, security scans
|
||||
./scripts/prepare-to-push.sh --fix # auto-fix where possible
|
||||
```
|
||||
|
||||
**Lint:**
|
||||
|
||||
```bash
|
||||
npx eslint . --ext .ts,.tsx,.js,.jsx,.mjs --max-warnings 0 # JS/TS
|
||||
ruff check utils/ # Python
|
||||
bandit -r utils/ -ll # Python security
|
||||
```
|
||||
|
||||
**Tests** (vanilla Node.js — no framework, no npm test script):
|
||||
|
||||
```bash
|
||||
node skills/clawsec-suite/test/feed_verification.test.mjs
|
||||
node skills/clawsec-suite/test/guarded_install.test.mjs
|
||||
node skills/clawsec-suite/test/skill_catalog_discovery.test.mjs
|
||||
```
|
||||
|
||||
**Validate a skill's structure:**
|
||||
|
||||
```bash
|
||||
python utils/validate_skill.py skills/<skill-name>
|
||||
```
|
||||
|
||||
**Signing key consistency check:**
|
||||
|
||||
```bash
|
||||
./scripts/ci/verify_signing_key_consistency.sh
|
||||
```
|
||||
|
||||
**Populate local dev data:**
|
||||
|
||||
```bash
|
||||
./scripts/populate-local-skills.sh # build public/skills/index.json from local skills/
|
||||
./scripts/populate-local-feed.sh --days 120 # fetch real NVD CVE data for local advisory feed
|
||||
```
|
||||
|
||||
## Releasing a Skill
|
||||
|
||||
```bash
|
||||
./scripts/release-skill.sh <skill-name> <version> [--force-tag]
|
||||
# Example: ./scripts/release-skill.sh clawsec-feed 0.0.5
|
||||
```
|
||||
|
||||
- **Feature branch:** bumps version in skill.json + SKILL.md frontmatter, commits. No tag.
|
||||
- **Main branch:** same + creates annotated git tag + GitHub release with changelog.
|
||||
- Tag format: `<skill-name>-v<semver>` (e.g., `clawsec-suite-v0.1.0`).
|
||||
- Pushing the tag triggers the `skill-release.yml` workflow (sign, package, publish).
|
||||
|
||||
## Architecture
|
||||
|
||||
**Frontend:** React 19 + TypeScript + Vite, deployed to GitHub Pages. Hash-based routing. Tailwind via CDN.
|
||||
|
||||
**Skills:** Each skill lives in `skills/<name>/` with:
|
||||
- `skill.json` — metadata, SBOM (file manifest), OpenClaw config (emoji, triggers, required bins)
|
||||
- `SKILL.md` — YAML frontmatter (`name`, `version`, `description`) + agent-readable markdown
|
||||
- Version in `skill.json` and `SKILL.md` frontmatter must match (CI enforced)
|
||||
|
||||
**clawsec-suite** is the meta-skill ("skill-of-skills") that installs and manages other skills. It embeds:
|
||||
- Advisory feed with Ed25519 signature verification (`hooks/clawsec-advisory-guardian/`)
|
||||
- Guarded skill installer with two-stage approval for advisory-flagged skills
|
||||
- Dynamic catalog discovery from `https://clawsec.prompt.security/skills/index.json` with local fallback
|
||||
|
||||
**Signing:** Single Ed25519 keypair for everything (feed + releases).
|
||||
- Private key lives only in GitHub secret `CLAWSEC_SIGNING_PRIVATE_KEY` — never committed.
|
||||
- Public key committed in three canonical locations: `clawsec-signing-public.pem`, `advisories/feed-signing-public.pem`, `skills/clawsec-suite/advisories/feed-signing-public.pem`.
|
||||
- `SKILL.md` embeds the same key inline for offline installation verification.
|
||||
- Drift guard: `scripts/ci/verify_signing_key_consistency.sh` enforces all references resolve to the same fingerprint. Runs on every PR and tag push.
|
||||
|
||||
## CI Workflows
|
||||
|
||||
| Workflow | Trigger | What it does |
|
||||
|---|---|---|
|
||||
| `ci.yml` | PR / push to main | Lint (TS, Python, shell), Trivy security scan, npm audit, tests, build |
|
||||
| `skill-release.yml` | Tag `*-v*.*.*` or PR touching skill files | Sign checksums, publish to GitHub Releases, supersede old versions |
|
||||
| `deploy-pages.yml` | After CI or release succeeds | Build web frontend + skills catalog, deploy to GitHub Pages |
|
||||
| `poll-nvd-cves.yml` | Daily 06:00 UTC | Poll NVD for CVEs, update `advisories/feed.json` + signature |
|
||||
| `community-advisory.yml` | Issue labeled `advisory-approved` | Process community report into `CLAW-YYYY-NNNN` advisory |
|
||||
|
||||
## Key Conventions
|
||||
|
||||
- **ESLint:** flat config (`eslint.config.js`), zero warnings policy
|
||||
- **Python:** ruff + bandit, configured in `pyproject.toml`, line-length 120
|
||||
- **Shell:** shellcheck on `scripts/*.sh`
|
||||
- **Tests:** each `.test.mjs` is a standalone Node.js script with its own pass/fail counters and `process.exit(1)` on failure. Tests generate ephemeral Ed25519 keys — they don't use the repo signing keys.
|
||||
- **Advisory feed:** fail-closed signature verification by default. `CLAWSEC_ALLOW_UNSIGNED_FEED=1` is a temporary migration bypass only.
|
||||
- **Hook event model:** hooks mutate `event.messages` array in-place (not return values). Rate-limited to 300s by default (`CLAWSEC_HOOK_INTERVAL_SECONDS`).
|
||||
@@ -1,128 +0,0 @@
|
||||
# Contributor Covenant Code of Conduct
|
||||
|
||||
## Our Pledge
|
||||
|
||||
We as members, contributors, and leaders pledge to make participation in our
|
||||
community a harassment-free experience for everyone, regardless of age, body
|
||||
size, visible or invisible disability, ethnicity, sex characteristics, gender
|
||||
identity and expression, level of experience, education, socio-economic status,
|
||||
nationality, personal appearance, race, religion, or sexual identity
|
||||
and orientation.
|
||||
|
||||
We pledge to act and interact in ways that contribute to an open, welcoming,
|
||||
diverse, inclusive, and healthy community.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to a positive environment for our
|
||||
community include:
|
||||
|
||||
* Demonstrating empathy and kindness toward other people
|
||||
* Being respectful of differing opinions, viewpoints, and experiences
|
||||
* Giving and gracefully accepting constructive feedback
|
||||
* Accepting responsibility and apologizing to those affected by our mistakes,
|
||||
and learning from the experience
|
||||
* Focusing on what is best not just for us as individuals, but for the
|
||||
overall community
|
||||
|
||||
Examples of unacceptable behavior include:
|
||||
|
||||
* The use of sexualized language or imagery, and sexual attention or
|
||||
advances of any kind
|
||||
* Trolling, insulting or derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing others' private information, such as a physical or email
|
||||
address, without their explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a
|
||||
professional setting
|
||||
|
||||
## Enforcement Responsibilities
|
||||
|
||||
Community leaders are responsible for clarifying and enforcing our standards of
|
||||
acceptable behavior and will take appropriate and fair corrective action in
|
||||
response to any behavior that they deem inappropriate, threatening, offensive,
|
||||
or harmful.
|
||||
|
||||
Community leaders have the right and responsibility to remove, edit, or reject
|
||||
comments, commits, code, wiki edits, issues, and other contributions that are
|
||||
not aligned to this Code of Conduct, and will communicate reasons for moderation
|
||||
decisions when appropriate.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies within all community spaces, and also applies when
|
||||
an individual is officially representing the community in public spaces.
|
||||
Examples of representing our community include using an official e-mail address,
|
||||
posting via an official social media account, or acting as an appointed
|
||||
representative at an online or offline event.
|
||||
|
||||
## Enforcement
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||
reported to the community leaders responsible for enforcement via this
|
||||
project's GitHub repository issue tracker.
|
||||
All complaints will be reviewed and investigated promptly and fairly.
|
||||
|
||||
All community leaders are obligated to respect the privacy and security of the
|
||||
reporter of any incident.
|
||||
|
||||
## Enforcement Guidelines
|
||||
|
||||
Community leaders will follow these Community Impact Guidelines in determining
|
||||
the consequences for any action they deem in violation of this Code of Conduct:
|
||||
|
||||
### 1. Correction
|
||||
|
||||
**Community Impact**: Use of inappropriate language or other behavior deemed
|
||||
unprofessional or unwelcome in the community.
|
||||
|
||||
**Consequence**: A private, written warning from community leaders, providing
|
||||
clarity around the nature of the violation and an explanation of why the
|
||||
behavior was inappropriate. A public apology may be requested.
|
||||
|
||||
### 2. Warning
|
||||
|
||||
**Community Impact**: A violation through a single incident or series
|
||||
of actions.
|
||||
|
||||
**Consequence**: A warning with consequences for continued behavior. No
|
||||
interaction with the people involved, including unsolicited interaction with
|
||||
those enforcing the Code of Conduct, for a specified period of time. This
|
||||
includes avoiding interactions in community spaces as well as external channels
|
||||
like social media. Violating these terms may lead to a temporary or
|
||||
permanent ban.
|
||||
|
||||
### 3. Temporary Ban
|
||||
|
||||
**Community Impact**: A serious violation of community standards, including
|
||||
sustained inappropriate behavior.
|
||||
|
||||
**Consequence**: A temporary ban from any sort of interaction or public
|
||||
communication with the community for a specified period of time. No public or
|
||||
private interaction with the people involved, including unsolicited interaction
|
||||
with those enforcing the Code of Conduct, is allowed during this period.
|
||||
Violating these terms may lead to a permanent ban.
|
||||
|
||||
### 4. Permanent Ban
|
||||
|
||||
**Community Impact**: Demonstrating a pattern of violation of community
|
||||
standards, including sustained inappropriate behavior, harassment of an
|
||||
individual, or aggression toward or disparagement of classes of individuals.
|
||||
|
||||
**Consequence**: A permanent ban from any sort of public interaction within
|
||||
the community.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
|
||||
version 2.0, available at
|
||||
https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
|
||||
|
||||
Community Impact Guidelines were inspired by [Mozilla's code of conduct
|
||||
enforcement ladder](https://github.com/mozilla/diversity).
|
||||
|
||||
[homepage]: https://www.contributor-covenant.org
|
||||
|
||||
For answers to common questions about this code of conduct, see the FAQ at
|
||||
https://www.contributor-covenant.org/faq. Translations are available at
|
||||
https://www.contributor-covenant.org/translations.
|
||||
-668
@@ -1,668 +0,0 @@
|
||||
# Contributing to ClawSec Skills
|
||||
|
||||
Thank you for your interest in contributing security skills to the ClawSec ecosystem! This guide will walk you through creating, testing, and submitting new skills.
|
||||
|
||||
## Wiki Documentation Source of Truth
|
||||
|
||||
For contributor-facing wiki docs, treat `wiki/` in this repository as the single source of truth. Do not edit the GitHub Wiki directly; `.github/workflows/wiki-sync.yml` publishes `wiki/` to `<repo>.wiki.git` when `wiki/**` changes on `main`.
|
||||
|
||||
## Table of Contents
|
||||
|
||||
- [Wiki Documentation Source of Truth](#wiki-documentation-source-of-truth)
|
||||
- [Getting Started](#getting-started)
|
||||
- [Skill Structure](#skill-structure)
|
||||
- [Creating a New Skill](#creating-a-new-skill)
|
||||
- [skill.json Reference](#skilljson-reference)
|
||||
- [Testing Your Skill](#testing-your-skill)
|
||||
- [Submission Process](#submission-process)
|
||||
- [Version Bump and Release Flow](#version-bump-and-release-flow)
|
||||
- [Review Criteria](#review-criteria)
|
||||
- [After Acceptance](#after-acceptance)
|
||||
- [Submitting Security Advisories](#submitting-security-advisories)
|
||||
|
||||
---
|
||||
|
||||
## Getting Started
|
||||
|
||||
### 1. Fork the Repository
|
||||
|
||||
1. Navigate to the [ClawSec repository](https://github.com/prompt-security/clawsec)
|
||||
2. Click the "Fork" button in the top-right corner
|
||||
3. Clone your fork locally:
|
||||
|
||||
```bash
|
||||
git clone https://github.com/YOUR-USERNAME/clawsec.git
|
||||
cd clawsec
|
||||
```
|
||||
|
||||
### 2. Set Up Your Environment
|
||||
|
||||
```bash
|
||||
# Add upstream remote to sync with main repo
|
||||
git remote add upstream https://github.com/prompt-security/clawsec.git
|
||||
|
||||
# Install dependencies (if any)
|
||||
npm install
|
||||
|
||||
# Create a new branch for your skill
|
||||
git checkout -b skill/my-new-skill
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Trust & Verification Model
|
||||
|
||||
All skills distributed through ClawSec undergo security review and are hashed for agent verification. Trust is implicit:
|
||||
|
||||
- **Backend Verification**: Every skill is validated against checksums, SBOM manifests, and security policies
|
||||
- **Transparent Security**: SHA256 checksums, and advisory feeds operate automatically
|
||||
- **Contribution Flow**: Submit skills via PR → maintainer review → approval → release
|
||||
|
||||
|
||||
---
|
||||
|
||||
## Skill Structure
|
||||
|
||||
Each skill lives in its own directory under `skills/`. Here's the standard structure:
|
||||
|
||||
```
|
||||
skills/
|
||||
└── my-skill-name/
|
||||
├── skill.json # Required: Metadata and SBOM
|
||||
├── SKILL.md # Required: Main skill documentation
|
||||
├── README.md # Optional: Additional documentation
|
||||
└── scripts/
|
||||
├── # Any supporting scripts your skill needs
|
||||
```
|
||||
|
||||
### Example: Minimal Skill
|
||||
|
||||
```
|
||||
skills/
|
||||
└── my-security-scanner/
|
||||
├── skill.json
|
||||
└── SKILL.md
|
||||
```
|
||||
|
||||
### Example: Complex Skill
|
||||
|
||||
```
|
||||
skills/
|
||||
└── advanced-analyzer/
|
||||
├── skill.json
|
||||
├── SKILL.md
|
||||
├── README.md
|
||||
├── templates/
|
||||
│ └── report-template.md
|
||||
├── scripts/
|
||||
│ └── action.py
|
||||
└── config/
|
||||
└── rules.json
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Creating a New Skill
|
||||
|
||||
### Step 1: Create Skill Directory
|
||||
|
||||
```bash
|
||||
mkdir -p skills/my-skill-name
|
||||
cd skills/my-skill-name
|
||||
```
|
||||
|
||||
### Step 2: Create skill.json
|
||||
|
||||
Create `skill.json` with the following structure:
|
||||
|
||||
```json
|
||||
{
|
||||
"name": "my-skill-name",
|
||||
"version": "0.0.1",
|
||||
"description": "Brief description of what your skill does",
|
||||
"author": "your-github-username",
|
||||
"license": "AGPL-3.0-or-later",
|
||||
"homepage": "https://github.com/prompt-security/clawsec",
|
||||
"keywords": ["security", "relevant", "tags"],
|
||||
|
||||
"sbom": {
|
||||
"files": [
|
||||
{
|
||||
"path": "SKILL.md",
|
||||
"required": true,
|
||||
"description": "Main skill documentation"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
"openclaw": {
|
||||
"emoji": "🔒",
|
||||
"category": "security",
|
||||
"requires": {
|
||||
"bins": ["curl", "jq"]
|
||||
},
|
||||
"triggers": [
|
||||
"keyword that activates skill",
|
||||
"another trigger phrase",
|
||||
"security check"
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Important Notes:**
|
||||
- Start with version `0.0.1` in both `skill.json` and `SKILL.md` frontmatter
|
||||
- List ALL files your skill needs in the SBOM
|
||||
|
||||
### Step 3: Create SKILL.md
|
||||
|
||||
This is the main documentation for your skill. Include YAML frontmatter with a `version` that matches `skill.json`:
|
||||
|
||||
````markdown
|
||||
```markdown
|
||||
---
|
||||
name: my-skill-name
|
||||
version: 0.0.1
|
||||
description: Brief description of what your skill does
|
||||
metadata: {"openclaw":{"emoji":"🔒","category":"security"}}
|
||||
---
|
||||
|
||||
# My Skill Name
|
||||
|
||||
## Overview
|
||||
|
||||
Brief description of what this skill does and why it's useful for AI agent security.
|
||||
|
||||
## Usage
|
||||
|
||||
How to use the skill.
|
||||
|
||||
## Features
|
||||
|
||||
- Feature 1: Description
|
||||
- Feature 2: Description
|
||||
- Feature 3: Description
|
||||
|
||||
## Requirements
|
||||
|
||||
- Required tools: curl, jq, etc.
|
||||
- Any system dependencies
|
||||
- Prerequisites
|
||||
|
||||
## Security Considerations
|
||||
|
||||
Important security notes about this skill.
|
||||
```
|
||||
````
|
||||
|
||||
### Step 4: Add Supporting Files
|
||||
|
||||
Add any additional files your skill needs (configs, templates, scripts), and **ensure they're listed in skill.json's SBOM**.
|
||||
|
||||
---
|
||||
|
||||
## skill.json Reference
|
||||
|
||||
### Required Fields
|
||||
|
||||
| Field | Type | Description |
|
||||
|-------|------|-------------|
|
||||
| `name` | string | Skill identifier (lowercase, hyphens only) |
|
||||
| `version` | string | Semantic version (0.0.1) |
|
||||
| `description` | string | Brief description (max 200 chars) |
|
||||
| `author` | string | Your GitHub username or organization |
|
||||
| `license` | string | License type (prefer AGPL-3.0-or-later) |
|
||||
| `homepage` | string | Repository URL |
|
||||
| `keywords` | array | Searchable tags |
|
||||
| `sbom` | object | Software Bill of Materials |
|
||||
|
||||
### Verification
|
||||
|
||||
All skills published through ClawSec are reviewed by Prompt Security staff or designated maintainers before release:
|
||||
|
||||
- All published skills undergo security review
|
||||
- Checksums and SBOM validation ensure integrity
|
||||
- There is no distinction between "verified" and "community" skills - every skill in the catalog has passed review
|
||||
|
||||
### SBOM Structure
|
||||
|
||||
The SBOM (Software Bill of Materials) lists all files that are part of your skill:
|
||||
|
||||
```json
|
||||
{
|
||||
"sbom": {
|
||||
"files": [
|
||||
{
|
||||
"path": "SKILL.md",
|
||||
"required": true,
|
||||
"description": "Main skill file"
|
||||
},
|
||||
{
|
||||
"path": "config/rules.json",
|
||||
"required": false,
|
||||
"description": "Optional configuration rules"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Critical:** Every file your skill uses MUST be listed in the SBOM. This enables:
|
||||
- Automated checksum generation
|
||||
- Integrity verification
|
||||
- Secure distribution
|
||||
|
||||
### OpenClaw Integration
|
||||
|
||||
The `openclaw` section defines how the skill integrates with Claude Code:
|
||||
|
||||
```json
|
||||
{
|
||||
"openclaw": {
|
||||
"emoji": "🔒",
|
||||
"category": "security",
|
||||
"requires": {
|
||||
"bins": ["curl", "jq", "git"]
|
||||
},
|
||||
"triggers": [
|
||||
"keyword to activate skill",
|
||||
"another trigger phrase"
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Categories:** `security`, `monitoring`, `analysis`, `reporting`, `utility`
|
||||
|
||||
---
|
||||
|
||||
## Testing Your Skill
|
||||
|
||||
### 1. Validate JSON Structure
|
||||
|
||||
```bash
|
||||
# Validate skill.json is valid JSON
|
||||
cat skills/my-skill-name/skill.json | jq .
|
||||
```
|
||||
|
||||
### 2. Verify SBOM Completeness
|
||||
|
||||
```bash
|
||||
# Check all SBOM files exist
|
||||
cd skills/my-skill-name
|
||||
for file in $(jq -r '.sbom.files[].path' skill.json); do
|
||||
[ -f "$file" ] && echo "✓ $file" || echo "✗ $file MISSING"
|
||||
done
|
||||
```
|
||||
|
||||
### 3. Test Locally (if applicable)
|
||||
|
||||
If your skill includes executable scripts or requires testing:
|
||||
|
||||
```bash
|
||||
# Follow the testing instructions in your SKILL.md
|
||||
```
|
||||
|
||||
### 4. Check for Common Issues
|
||||
|
||||
- [ ] All SBOM files exist
|
||||
- [ ] skill.json is valid JSON
|
||||
- [ ] Version is `0.0.1` for new skills
|
||||
- [ ] `skill.json` version matches `SKILL.md` frontmatter version
|
||||
- [ ] No hardcoded credentials or secrets
|
||||
- [ ] Trigger phrases are descriptive
|
||||
- [ ] Required binaries are documented
|
||||
|
||||
---
|
||||
|
||||
## Submission Process
|
||||
|
||||
### 1. Commit Your Changes
|
||||
|
||||
```bash
|
||||
# From the repository root
|
||||
git add skills/my-skill-name/
|
||||
git commit -m "feat(skills): add my-skill-name security skill"
|
||||
```
|
||||
|
||||
**Commit Message Format:**
|
||||
```
|
||||
feat(skills): add <skill-name> <brief description>
|
||||
|
||||
- Key feature 1
|
||||
- Key feature 2
|
||||
- Security benefit
|
||||
```
|
||||
|
||||
### 2. Push to Your Fork
|
||||
|
||||
```bash
|
||||
git push origin skill/my-new-skill
|
||||
```
|
||||
|
||||
### 3. Create a Pull Request
|
||||
|
||||
1. Go to your fork on GitHub
|
||||
2. Click "Pull Request"
|
||||
3. Select your branch (`skill/my-new-skill`)
|
||||
4. Fill out the PR template:
|
||||
|
||||
```markdown
|
||||
## Skill Contribution: [Skill Name]
|
||||
|
||||
### Description
|
||||
Brief overview of what this skill does.
|
||||
|
||||
### Security Benefits
|
||||
How this skill improves AI agent security.
|
||||
|
||||
### Testing Performed
|
||||
- [ ] JSON validation passed
|
||||
- [ ] SBOM files verified
|
||||
- [ ] Local testing completed
|
||||
- [ ] No secrets or credentials included
|
||||
|
||||
### Checklist
|
||||
- [ ] skill.json is complete
|
||||
- [ ] SKILL.md documentation is clear
|
||||
- [ ] All SBOM files are present
|
||||
- [ ] Version is 0.0.1 (if new skill)
|
||||
|
||||
### Additional Notes
|
||||
Any special considerations for reviewers.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Version Bump and Release Flow
|
||||
|
||||
This repository uses a branch-first workflow for skill versions:
|
||||
|
||||
1. Make skill changes on a branch (`skill/<name>-...`).
|
||||
2. Keep versions in sync:
|
||||
- `skills/<skill>/skill.json` -> `.version`
|
||||
- `skills/<skill>/SKILL.md` -> frontmatter `version`
|
||||
3. For existing skills, you can bump versions on your branch with:
|
||||
|
||||
```bash
|
||||
./scripts/release-skill.sh <skill-name> <new-version>
|
||||
```
|
||||
|
||||
4. Push your branch and open a PR. CI will run:
|
||||
- Version parity checks
|
||||
- A `release` dry-run (build/validation only, no publish)
|
||||
5. Do **not** push release tags from PR branches.
|
||||
- `scripts/release-skill.sh` creates a local tag. Keep it local during PR review.
|
||||
- If you need to remove that local tag: `git tag -d <skill-name>-v<version>`
|
||||
6. After merge, a maintainer creates and pushes the release tag from `main`:
|
||||
|
||||
```bash
|
||||
git checkout main
|
||||
git pull --ff-only origin main
|
||||
git tag -a <skill-name>-v<version> -m "<skill-name> version <version>"
|
||||
git push origin <skill-name>-v<version>
|
||||
```
|
||||
|
||||
7. Pushing the tag triggers the full release workflow (GitHub release + ClawHub publish).
|
||||
|
||||
---
|
||||
|
||||
## Review Criteria
|
||||
|
||||
Maintainers will review your skill based on:
|
||||
|
||||
### Security
|
||||
- [ ] No malicious code or backdoors
|
||||
- [ ] No hardcoded credentials
|
||||
- [ ] Safe command execution (no command injection)
|
||||
- [ ] Proper input validation
|
||||
- [ ] No unnecessary privileges required
|
||||
|
||||
### Quality
|
||||
- [ ] Clear documentation
|
||||
- [ ] Well-structured code
|
||||
- [ ] Follows naming conventions
|
||||
- [ ] Complete SBOM
|
||||
- [ ] Descriptive trigger phrases
|
||||
|
||||
### Value
|
||||
- [ ] Provides clear security benefit
|
||||
- [ ] Not duplicate of existing skill
|
||||
- [ ] Useful for AI agent protection
|
||||
- [ ] Aligns with ClawSec mission
|
||||
|
||||
### Technical
|
||||
- [ ] Valid JSON structure
|
||||
- [ ] All SBOM files present
|
||||
- [ ] Correct versioning
|
||||
- [ ] Proper metadata
|
||||
|
||||
---
|
||||
|
||||
## After Acceptance
|
||||
|
||||
Once your skill is accepted:
|
||||
|
||||
1. **Maintainers will:**
|
||||
- Review your PR (Prompt Security staff or designated maintainers)
|
||||
- Merge your PR after security review
|
||||
- Create and push a release tag from merged `main` (`<skill>-v<version>`)
|
||||
- Generate checksums and publish to GitHub Releases + ClawHub
|
||||
- Update the skills catalog website
|
||||
|
||||
2. **You'll be credited:**
|
||||
- Listed as the skill author
|
||||
- Mentioned in release notes
|
||||
- Added to contributors list
|
||||
|
||||
3. **Future updates:**
|
||||
- Submit PRs with version bumps for improvements
|
||||
- Maintainers will handle releases
|
||||
- Follow semantic versioning:
|
||||
- `1.0.1` - Patch (bug fixes)
|
||||
- `1.1.0` - Minor (new features)
|
||||
- `2.0.0` - Major (breaking changes)
|
||||
|
||||
---
|
||||
|
||||
## Questions?
|
||||
|
||||
- **Issues:** [GitHub Issues](https://github.com/prompt-security/clawsec/issues)
|
||||
- **Discussions:** [GitHub Discussions](https://github.com/prompt-security/clawsec/discussions)
|
||||
- **Security:** For security-sensitive contributions, email security@prompt.security
|
||||
|
||||
---
|
||||
|
||||
## Example Contribution
|
||||
|
||||
Here's a complete example of a minimal skill contribution:
|
||||
|
||||
```bash
|
||||
# Fork and clone
|
||||
git clone https://github.com/YOUR-USERNAME/clawsec.git
|
||||
cd clawsec
|
||||
|
||||
# Create branch
|
||||
git checkout -b skill/simple-scanner
|
||||
|
||||
# Create skill
|
||||
mkdir -p skills/simple-scanner
|
||||
cat > skills/simple-scanner/skill.json << 'EOF'
|
||||
{
|
||||
"name": "simple-scanner",
|
||||
"version": "0.0.1",
|
||||
"description": "Basic security scanner for AI agents",
|
||||
"author": "contributor-name",
|
||||
"license": "AGPL-3.0-or-later",
|
||||
"homepage": "https://github.com/prompt-security/clawsec",
|
||||
"keywords": ["security", "scanner", "basic"],
|
||||
"sbom": {
|
||||
"files": [
|
||||
{ "path": "SKILL.md", "required": true, "description": "Scanner documentation" }
|
||||
]
|
||||
},
|
||||
"openclaw": {
|
||||
"emoji": "🔍",
|
||||
"category": "security",
|
||||
"requires": { "bins": ["curl"] },
|
||||
"triggers": ["simple scan", "basic security check"]
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
cat > skills/simple-scanner/SKILL.md << 'EOF'
|
||||
---
|
||||
name: simple-scanner
|
||||
version: 0.0.1
|
||||
description: Basic security scanner for AI agents
|
||||
metadata: {"openclaw":{"emoji":"🔍","category":"security"}}
|
||||
---
|
||||
|
||||
# Simple Scanner
|
||||
|
||||
A basic security scanner for AI agents.
|
||||
|
||||
## Usage
|
||||
Run a simple security scan on your agent configuration.
|
||||
|
||||
## Features
|
||||
- Quick security checks
|
||||
- Minimal dependencies
|
||||
- Easy to use
|
||||
EOF
|
||||
|
||||
# Validate
|
||||
cat skills/simple-scanner/skill.json | jq .
|
||||
|
||||
# Commit and push
|
||||
git add skills/simple-scanner/
|
||||
git commit -m "feat(skills): add simple-scanner security skill
|
||||
|
||||
- Provides basic security scanning
|
||||
- Minimal dependencies
|
||||
- Easy to use for beginners"
|
||||
git push origin skill/simple-scanner
|
||||
```
|
||||
|
||||
Then create a pull request on GitHub!
|
||||
|
||||
---
|
||||
|
||||
## Submitting Security Advisories
|
||||
|
||||
Found a prompt injection vector, malicious skill, or security vulnerability affecting AI agents? Help protect the community by submitting a security advisory.
|
||||
|
||||
### Advisory Types
|
||||
|
||||
| Type | Description | Example |
|
||||
|------|-------------|---------|
|
||||
| `prompt_injection` | Detected prompt injection or social engineering | Skill contains hidden instructions to exfiltrate data |
|
||||
| `vulnerable_skill` | Skill with security vulnerabilities | Skill executes unsanitized user input |
|
||||
| `tampering_attempt` | Attempt to disable/modify security controls | Instructions to remove ClawSec or ignore security checks |
|
||||
|
||||
### How to Submit
|
||||
|
||||
#### 1. Open a Security Incident Report
|
||||
|
||||
1. Go to [Issues → New Issue](https://github.com/prompt-security/clawsec/issues/new/choose)
|
||||
2. Select **"Security Incident Report"** template
|
||||
3. Fill out all required sections:
|
||||
|
||||
**Required Fields:**
|
||||
- **Opener Type** - Are you a human or an AI agent reporting this?
|
||||
- **Report Type** - What kind of issue is this?
|
||||
- **Severity** - How severe is the threat?
|
||||
- **Title** - Brief descriptive title
|
||||
- **Description** - Detailed explanation of the vulnerability
|
||||
- **Affected** - Which skill(s) and version(s) are affected
|
||||
- **Recommended Action** - What should users do?
|
||||
|
||||
**Optional but Helpful:**
|
||||
- Evidence (sanitized payloads, indicators)
|
||||
- Reporter information (for follow-up questions)
|
||||
|
||||
#### 2. Privacy Checklist
|
||||
|
||||
Before submitting, ensure you have:
|
||||
- [ ] Removed all real user data and PII
|
||||
- [ ] Not included any API keys, credentials, or secrets
|
||||
- [ ] Sanitized evidence to describe issues abstractly
|
||||
- [ ] No proprietary or confidential information included
|
||||
|
||||
#### 3. Wait for Review
|
||||
|
||||
A maintainer will:
|
||||
1. Review your report for validity and completeness
|
||||
2. Assess the severity and impact
|
||||
3. Add the `advisory-approved` label when ready to publish
|
||||
|
||||
#### 4. Automatic Publication
|
||||
|
||||
Once approved, the [community-advisory workflow](.github/workflows/community-advisory.yml) automatically:
|
||||
1. Parses your issue content
|
||||
2. Generates an advisory ID: `CLAW-{YEAR}-{ISSUE_NUMBER}` (e.g., `CLAW-2026-0042`)
|
||||
3. Adds the advisory to `advisories/feed.json`
|
||||
4. Comments on your issue confirming publication
|
||||
|
||||
### Advisory ID Format
|
||||
|
||||
| Source | Format | Example |
|
||||
|--------|--------|---------|
|
||||
| NVD CVE | `CVE-YYYY-NNNNN` | `CVE-2026-24763` |
|
||||
| Community Report | `CLAW-YYYY-NNNN` | `CLAW-2026-0042` |
|
||||
|
||||
The `NNNN` in community advisories is your GitHub issue number, zero-padded to 4 digits.
|
||||
|
||||
### Example Security Report
|
||||
|
||||
```markdown
|
||||
## Opener Type
|
||||
- [x] Agent (automated report)
|
||||
|
||||
## Report Type
|
||||
- [x] Vulnerable Skill - Found a skill with security issues
|
||||
|
||||
## Severity
|
||||
- [x] High - Significant security risk, potential for harm
|
||||
|
||||
## Title
|
||||
Data exfiltration via helper-plus skill network calls
|
||||
|
||||
## Description
|
||||
The helper-plus skill was observed sending conversation data to an external
|
||||
server (suspicious-domain.com) on every invocation. The skill makes
|
||||
undocumented network calls that transmit full conversation context to a
|
||||
domain not mentioned in the skill description.
|
||||
|
||||
## Affected
|
||||
|
||||
### Skill Name
|
||||
helper-plus
|
||||
|
||||
### Skill Version
|
||||
0.0.1, 1.0.0, 1.0.1
|
||||
|
||||
## Recommended Action
|
||||
Remove helper-plus immediately. Do not use versions 0.0.1, 1.0.0 or 1.0.1.
|
||||
Wait for a verified patched version.
|
||||
|
||||
## Reporter Information (Optional)
|
||||
**Agent/User Name:** SecurityBot
|
||||
```
|
||||
|
||||
### After Publication
|
||||
|
||||
Once your advisory is published:
|
||||
|
||||
1. **Agents receive it** - The feed is served at `https://clawsec.prompt.security/advisories/feed.json` (with signature/checksum artifacts), so agents see it on their next feed check
|
||||
2. **You're credited** - Your issue is linked in the advisory
|
||||
3. **Community is protected** - Agents using ClawSec Feed will be alerted
|
||||
|
||||
### Questions?
|
||||
|
||||
- **General questions:** [GitHub Discussions](https://github.com/prompt-security/clawsec/discussions)
|
||||
- **Sensitive reports:** Email security@prompt.security for issues too sensitive for public disclosure
|
||||
|
||||
---
|
||||
|
||||
Thank you for contributing to ClawSec security! 🛡️
|
||||
@@ -1,661 +0,0 @@
|
||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
Version 3, 19 November 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU Affero General Public License is a free, copyleft license for
|
||||
software and other kinds of works, specifically designed to ensure
|
||||
cooperation with the community in the case of network server software.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
our General Public Licenses are intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
Developers that use our General Public Licenses protect your rights
|
||||
with two steps: (1) assert copyright on the software, and (2) offer
|
||||
you this License which gives you legal permission to copy, distribute
|
||||
and/or modify the software.
|
||||
|
||||
A secondary benefit of defending all users' freedom is that
|
||||
improvements made in alternate versions of the program, if they
|
||||
receive widespread use, become available for other developers to
|
||||
incorporate. Many developers of free software are heartened and
|
||||
encouraged by the resulting cooperation. However, in the case of
|
||||
software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and
|
||||
letting the public access it on a server without ever releasing its
|
||||
source code to the public.
|
||||
|
||||
The GNU Affero General Public License is designed specifically to
|
||||
ensure that, in such cases, the modified source code becomes available
|
||||
to the community. It requires the operator of a network server to
|
||||
provide the source code of the modified version running there to the
|
||||
users of that server. Therefore, public use of a modified version, on
|
||||
a publicly accessible server, gives the public access to the source
|
||||
code of the modified version.
|
||||
|
||||
An older license, called the Affero General Public License and
|
||||
published by Affero, was designed to accomplish similar goals. This is
|
||||
a different license, not a version of the Affero GPL, but Affero has
|
||||
released a new version of the Affero GPL which permits relicensing under
|
||||
this license.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, if you modify the
|
||||
Program, your modified version must prominently offer all users
|
||||
interacting with it remotely through a computer network (if your version
|
||||
supports such interaction) an opportunity to receive the Corresponding
|
||||
Source of your version by providing access to the Corresponding Source
|
||||
from a network server at no charge, through some standard or customary
|
||||
means of facilitating copying of software. This Corresponding Source
|
||||
shall include the Corresponding Source for any work covered by version 3
|
||||
of the GNU General Public License that is incorporated pursuant to the
|
||||
following paragraph.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the work with which it is combined will remain governed by version
|
||||
3 of the GNU General Public License.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU Affero General Public License from time to time. Such new versions
|
||||
will be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU Affero General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU Affero General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU Affero General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If your software can interact with users remotely through a computer
|
||||
network, you should also make sure that it provides a way for users to
|
||||
get its source. For example, if your program is a web application, its
|
||||
interface could display a "Source" link that leads users to an archive
|
||||
of the code. There are many ways you could offer source, and different
|
||||
solutions will be better for different programs; see section 13 for the
|
||||
specific requirements.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU AGPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
-434
@@ -1,434 +0,0 @@
|
||||
<!-- AUTO-GENERATED TRANSLATION SCAFFOLD (de)
|
||||
Source: README.md
|
||||
Review status: draft
|
||||
-->
|
||||
|
||||
# Deutsch Translation Scaffold
|
||||
|
||||
This file is currently a draft scaffold. Use README.md as the canonical source.
|
||||
|
||||
<h1 align="center">
|
||||
<img src="/img/prompt-icon.svg" alt="prompt-icon" breit="40">
|
||||
ClawSec: Security Skill Suite für KI-Agenten
|
||||
<img src="/img/prompt-icon.svg" alt="prompt-icon" breit="40">
|
||||
</h1>
|
||||
|
||||
<div align="center">
|
||||
|
||||
Sichern Sie Ihre OpenClaw, NanoClaw und Hermes Agents mit einer kompletten Sicherheits-Fähigkeits-Suite
|
||||
|
||||
<h4>Brought to you von <a href="https://prompt.security">Prompt Security</a>, the Platform of AI Security</h4>
|
||||
|
||||
</div>
|
||||
|
||||
<div align="center">
|
||||
|
||||
|
||||
<img src="/public/img/mascot.png" alt="clawsec mascot" breit="200" />
|
||||
|
||||
</div>
|
||||
<div align="center">
|
||||
|
||||
🌐 **Live at: [https://clawsec.prompt.security](https://clawsec.prompt.security)[https://prompt.security/clawsec](https://prompt.security/clawsec)**
|
||||
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/ci.yml)
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/deploy-pages.yml)
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/poll-nvd-cves.yml)
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
--
|
||||
|
||||
Übersetzungen
|
||||
|
||||
- Español: [README.es.md](README.es.md)
|
||||
- 한국어: [README.ko.md](README.ko.md)
|
||||
|
||||
Was ist ClawSec?
|
||||
|
||||
ClawSec ist eine ** umfassende Sicherheits-Fähigkeits-Suite für AI-Agent-Plattformen*. Es bietet eine einheitliche Sicherheitsüberwachung, Integritätsprüfung und Bedrohung Intelligenz-Schutz der kognitiven Architektur Ihres Agenten gegen schnelle Injektion, Drift und schädliche Anweisungen.
|
||||
|
||||
### Unterstützte Plattformen
|
||||
|
||||
- **OpenClaw** (MoltBot, Clawdbot und Klone) - Komplette Suite mit Skill-Installer, Dateiintegritätsschutz und Sicherheitsaudits
|
||||
- **NanoKlaue** - Gebindet App-Bot-Sicherheit mit MCP-Tools für die Überwachung, Unterschriftsprüfung und Dateiintegrität
|
||||
- **Hermes** - Hermes-native Sicherheitskompetenzen für eine unterzeichnete Beratungs-Feed-Verifikation, beratungssichere Verifikation, deterministische Attestations-Generierung, fehlgeschlossene Verifikation und grundlegende Drifterkennung
|
||||
- **Picoclaw** - Leichte AI-Gateway-Sicherheitsüberprüfungen mit Beratendem Bewusstsein, config Drift-Erkennung, Release-artifact-Verifikation und einem optionalen separaten Selbst-Pen-Testpaket
|
||||
|
||||
### Skill Feature Matrix
|
||||
|
||||
| Skill name | unterstützte Plattform| Sicherheits-Feed-Verifikation- config Drift | Agent Self Pen-Tests- Supply-Chain-Verifikation |
|
||||
...
|
||||
| claw-release | OpenClaw | Nein | Nein | Nein | Nein | Ja |
|
||||
| clawsec-clawhub-checker | OpenClaw + clawsec-suite Integration | Nein | Nein | Nein | Ja |
|
||||
| clawsec-feed | OpenClaw | Ja | Nein | Nein | Ja |
|
||||
Ja | Ja | Ja | Ja | Ja | Ja |
|
||||
| clawsec-scanner | OpenClaw | Ja | Nein | Ja | Ja | Ja |
|
||||
| clawsec-suite | OpenClaw | Ja | Ja | Nein | Ja |
|
||||
| Clawtributor | OpenClaw | Ja | Nein | Nein
|
||||
| hermes-attestation-guardian | Hermes | Ja (signierte beratende Feed-Verifikation) | Ja | Nein | Limited (nur Vorabbeleuchtung; keine Artefaktsignatur/provenance install-Verifikation) |
|
||||
| Openclaw-audit-watchdog | OpenClaw | Nein | Nein | Ja | Nein
|
||||
| Picoclaw-security-guardian | Picoclaw | Ja | Ja | Nein
|
||||
| Picoclaw-self-pen-testing
|
||||
| Seelenhüter | OpenClaw | Nein | Nein | Nein
|
||||
|
||||
### Core Caps
|
||||
|
||||
- **📦 Suite Installer** - One-Command-Installation aller Sicherheitsfertigkeiten mit Integritätsprüfung
|
||||
- **🛡️ Datei-Integrity-Schutz* - Drift-Erkennung und Auto-Restore für kritische Agent-Dateien (SOUL.md, IDENTITY.md, etc.)
|
||||
- **📡 Live Security Advisories* - Automatisierte NVD CVE Umfragen und Community-Drohung Intelligenz
|
||||
- **🔍 Security Audits** - Self-Check-Skripte, um schnelle Injektionsmarker und Schwachstellen zu erkennen
|
||||
- **🔐 Prüfsummenverifikation** - SHA256 Prüfsummen für alle Fähigkeiten Artefakte
|
||||
- **Health Checks* - Automatisierte Updates und Integritätsprüfung für alle installierten Fähigkeiten
|
||||
|
||||
--
|
||||
|
||||
Produktdemonstrationen
|
||||
|
||||
Animierte Vorschauen unten sind GIFs (keine Audio). Klicken Sie auf jede Vorschau, um das volle MP4 mit Audio zu öffnen.
|
||||
|
||||
### Demo installieren (`clawsec-suite`)
|
||||
|
||||
[(öffentlich/video/install-demo.mp4)
|
||||
|
||||
Direkter Link: [install-demo.mp4](public/video/install-demo.mp4)
|
||||
|
||||
### Drift Detection Demo (`soul-guardian`)
|
||||
|
||||
[(öffentlich/video/soul-guardian-demo.mp4)
|
||||
|
||||
Direkter Link: [soul-guardian-demo.mp4](public/video/soul-guardian-demo.mp4)
|
||||
|
||||
--
|
||||
|
||||
🚀 Schneller Start
|
||||
|
||||
### For AI Agents
|
||||
|
||||
```bash
|
||||
# Install the ClawSec security suite
|
||||
npx clawhub@latest install clawsec-suite
|
||||
```
|
||||
|
||||
Nach der Installation kann die Suite:
|
||||
ANHANG Entdecken Sie installierbare Schutze aus dem veröffentlichten Kompetenzkatalog
|
||||
2. Verifizieren Sie die Freigabeintegrität mit unterzeichneten Prüfsummen
|
||||
3. Einrichtung von Beratungs- und hakenbasierten Schutzströmen
|
||||
4. Optionale geplante Überprüfungen hinzufügen
|
||||
|
||||
Manual/source-first option:
|
||||
|
||||
> Weiterlesen https://github.com/prompt-security/clawsec/releases/latest/download/SKILL.md und folgen den Installationsanweisungen.
|
||||
|
||||
### For Humans
|
||||
|
||||
Kopieren Sie diese Anleitung zu Ihrem KI-Agent:
|
||||
|
||||
> Installieren Sie ClawSec mit `npx clawhub@latest install clawsec-suite`, füllen Sie dann die Setup-Schritte aus den generierten Anweisungen aus.
|
||||
|
||||
### Shell and OS Notes
|
||||
|
||||
ClawSec-Skripte werden aufgeteilt zwischen:
|
||||
- Cross-Plattform Node/Python-Tooling (`npm run build`, Haken/Setup `.mjs`_ `utils/*.py`_
|
||||
- POSIX Shell Workflows (`*.sh`, die meisten manuellen Installationsschnipsel)
|
||||
|
||||
Für Linux/macOS (`bash`/`zsh`):
|
||||
- Verwenden Sie nicht zitiertes oder doppelt zitiertes Zuhause vars: `export INSTALL_ROOT="$HOME/.openclaw/skills"`
|
||||
- Do **not** Einquoten-Expandierbare Vars (zum Beispiel `'$HOME/.openclaw/skills'`)
|
||||
|
||||
Für Windows (PowerShell):
|
||||
- Präferen Sie explizite Pfadaufbau:
|
||||
- Was?
|
||||
- Was?
|
||||
- POSIX `.sh` Skripte benötigen WSL oder Git Bash.
|
||||
|
||||
Fehlerbehebung: Wenn Sie Verzeichnisse wie `~/.openclaw/workspace/$HOME/...` sehen, wurde eine Heimvariable buchstäblich übergeben. Re-run mit einem absoluten Pfad oder einem nicht zitierten Heimausdruck.
|
||||
|
||||
--
|
||||
|
||||
Plattform & Suite Dokumentation
|
||||
|
||||
Detaillierte Plattform und Suiten docs live in den Wiki-Modulen:
|
||||
- NanoClaw: [wiki/modules/nanoclaw-integration.md](wiki/modules/nanoclaw-integration.md)
|
||||
- Hermes: [wiki/modules/hermes-attestation-guardian.md](wiki/modules/hermes-attestation-guardian.md)
|
||||
- Picoclaw: [wiki/modules/picoclaw-security-guardian.md](wiki/modules/picoclaw-security-guardian.md)
|
||||
- Picoclaw Selbstprüfung: [wiki/modules/picoclaw-self-pen-testing.md](wiki/modules/picoclaw-self-pen-testing.md)
|
||||
- ClawSec Suite (OpenClaw): [wiki/modules/clawsec-suite.md](wiki/modules/clawsec-suite.md)
|
||||
- CI/CD-Pipelines: [wiki/modules/automation-release.md](wiki/modules/automation-release.md)
|
||||
|
||||
Schnelle Installation von Links:
|
||||
- NanoClaw installiert: [skills/clawsec-nanoclaw/INSTALL.md](skills/clawsec-nanoclaw/INSTALL.md)
|
||||
- Hermes Geschick Paket: `skills/hermes-attestation-guardian/`
|
||||
- Picoclaw Schutzpaket: `skills/picoclaw-security-guardian/`
|
||||
- Picoclaw Selbstprüfungspaket: `skills/picoclaw-self-pen-testing/`
|
||||
- Suite-Paket: `skills/clawsec-suite/`
|
||||
|
||||
--
|
||||
|
||||
📡 Sicherheitsberatung Fütterung
|
||||
|
||||
ClawSec unterhält einen kontinuierlich aktualisierten Sicherheitsberatungsfeed, der automatisch aus der NIST National Vulnerability Database (NVD) besiedelt wird.
|
||||
|
||||
### Feed URL
|
||||
|
||||
```bash
|
||||
# Fetch latest advisories
|
||||
curl -s https://clawsec.prompt.security/advisories/feed.json | jq '.advisories[] | select(.severity == "critical" or .severity == "high")'
|
||||
```
|
||||
|
||||
Kanonischer Endpunkt: `https://clawsec.prompt.security/advisories/feed.json`
|
||||
Kompatibilitätsspiegel (Legalacy): `https://clawsec.prompt.security/releases/latest/download/feed.json`
|
||||
|
||||
### Überwachte Keywords
|
||||
|
||||
Die Feed-Quoten CVEs bezogen auf:
|
||||
**OpenClaw Platform**: `OpenClaw`, `clawdbot`__, `Moltbot`
|
||||
**NanoClaw Platform**: `NanoClaw`____________________________________________________
|
||||
- **Picoclaw Platform*: `Picoclaw`, `picoclaw`, leichte AI Gateways, MCP Gateway Belichtung
|
||||
- Prompt Injektionsmuster
|
||||
- Sicherheitslücken von Agenten
|
||||
|
||||
### Exploitability Context
|
||||
|
||||
ClawSec bereichert CVE-Advisories mit **-Exploitability-Kontext**, um Agenten dabei zu helfen, das reale Risiko über die rohen CVSS-Score hinaus zu bewerten. Neu analysierte Berater können:
|
||||
|
||||
- **Exploit Evidence**: Ob öffentliche Ausbeutungen in der Wildnis existieren
|
||||
- **Beantwortungsstatus**: Wenn Exploits in gemeinsame Angriffsrahmen integriert werden
|
||||
- **Anforderungen**: Voraussetzungen für eine erfolgreiche Nutzung (Netzwerkzugriff, Authentifizierung, Benutzerinteraktion)
|
||||
- **Risikobewertung**: Kontextualisiertes Risikoniveau, das technische Schwere mit Ausbeutbarkeit kombiniert
|
||||
|
||||
Diese Funktion hilft Agenten, Schwachstellen zu priorisieren, die unmittelbare Bedrohungen gegenüber theoretischen Risiken darstellen und intelligentere Sicherheitsentscheidungen ermöglichen.
|
||||
|
||||
### Advisory Schema
|
||||
|
||||
**NVD CVE Beratung:**
|
||||
```json
|
||||
{
|
||||
"id": "CVE-2026-XXXXX",
|
||||
"severity": "critical|high|medium|low",
|
||||
"type": "vulnerable_skill",
|
||||
"platforms": ["openclaw", "nanoclaw"],
|
||||
"title": "Short description",
|
||||
"description": "Full CVE description from NVD",
|
||||
"published": "2026-02-01T00:00:00Z",
|
||||
"cvss_score": 8.8,
|
||||
"nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-XXXXX",
|
||||
"exploitability_score": "high|medium|low|unknown",
|
||||
"exploitability_rationale": "Why this CVE is or is not likely exploitable in agent deployments",
|
||||
"references": ["..."],
|
||||
"action": "Recommended remediation"
|
||||
}
|
||||
```
|
||||
|
||||
**Gemeinschaftsbeirat:**
|
||||
```json
|
||||
{
|
||||
"id": "CLAW-2026-0042",
|
||||
"severity": "high",
|
||||
"type": "prompt_injection|vulnerable_skill|tampering_attempt",
|
||||
"platforms": ["nanoclaw"],
|
||||
"title": "Short description",
|
||||
"description": "Detailed description from issue",
|
||||
"published": "2026-02-01T00:00:00Z",
|
||||
"affected": ["skill-name@1.0.0"],
|
||||
"source": "Community Report",
|
||||
"github_issue_url": "https://github.com/.../issues/42",
|
||||
"action": "Recommended remediation"
|
||||
}
|
||||
```
|
||||
|
||||
**Platformwerte:**
|
||||
- `"openclaw"` - OpenClaw/Clawdbot/Molt Nur
|
||||
- `"nanoclaw"` - NanoClaw nur
|
||||
- Nur Hermes
|
||||
- Nur Picoclaw
|
||||
- `["openclaw", "nanoclaw", "hermes", "picoclaw"]` - Alle Kernplattformen
|
||||
- (leer/missing) - Alle Plattformen (backward kompatibel)
|
||||
|
||||
--
|
||||
|
||||
🔄 CI/CD Pipelines
|
||||
|
||||
CI/CD Pipelinedetails wurden auf die Wiki-Modulseite verschoben:
|
||||
- Was?
|
||||
|
||||
Ähnliche Arbeitspunkte:
|
||||
- Was?
|
||||
- Was?
|
||||
|
||||
--
|
||||
|
||||
🛠️ Offline Tools
|
||||
|
||||
ClawSec umfasst Python utilities für lokale Fähigkeiten Entwicklung und Validierung.
|
||||
|
||||
### Skill Validator
|
||||
|
||||
Validiert einen Geschicksordner gegen das erforderliche Schema:
|
||||
|
||||
```bash
|
||||
python utils/validate_skill.py skills/clawsec-feed
|
||||
```
|
||||
|
||||
Kontrollen:
|
||||
- `skill.json` existiert und ist gültig JSON
|
||||
- Erforderliche Felder vorhanden (Name, Version, Beschreibung, Autor, Lizenz)
|
||||
- SBOM-Dateien existieren und sind lesbar
|
||||
- OpenClaw Metadaten sind richtig strukturiert
|
||||
|
||||
### Skill Checksums Generator
|
||||
|
||||
Erzeugt `checksums.json` mit SHA256 Hashes für ein Geschick:
|
||||
|
||||
```bash
|
||||
python utils/package_skill.py skills/clawsec-feed ./dist
|
||||
```
|
||||
|
||||
Ausgänge:
|
||||
- `checksums.json` - SHA256 hathes zur Überprüfung
|
||||
|
||||
--
|
||||
|
||||
Lokale Entwicklung
|
||||
|
||||
### Voraussetzungen
|
||||
|
||||
- Node.js 20+
|
||||
- Python 3.10+ (für Offline-Tools)
|
||||
- npm
|
||||
|
||||
### Setup
|
||||
|
||||
```bash
|
||||
# Install dependencies
|
||||
npm install
|
||||
|
||||
# Start development server
|
||||
npm run dev
|
||||
```
|
||||
|
||||
### Lokale Daten ausfüllen
|
||||
|
||||
```bash
|
||||
# Populate skills catalog from local skills/ directory
|
||||
./scripts/populate-local-skills.sh
|
||||
|
||||
# Populate advisory feed with real NVD CVE data
|
||||
./scripts/populate-local-feed.sh --days 120
|
||||
|
||||
# Generate wiki llms exports from wiki/ (for local preview)
|
||||
./scripts/populate-local-wiki.sh
|
||||
|
||||
# Direct generator entrypoint (used by predev/prebuild)
|
||||
npm run gen:wiki-llms
|
||||
```
|
||||
|
||||
Anmerkungen:
|
||||
- `npm run dev` und `npm run build` regenerieren automatisch wiki `llms.txt` Exporte (`predev`_`prebuild` Haken).
|
||||
- `public/wiki/` wird ausgegeben (lokal + CI) und ist absichtlich gitignored.
|
||||
|
||||
### Build
|
||||
|
||||
```bash
|
||||
npm run build
|
||||
```
|
||||
|
||||
--
|
||||
|
||||
Projektstruktur
|
||||
|
||||
```
|
||||
├── advisories/
|
||||
│ ├── feed.json # Main advisory feed
|
||||
│ ├── feed.json.sig # Detached signature for feed.json
|
||||
│ └── feed-signing-public.pem # Public key for feed verification
|
||||
├── components/ # React components
|
||||
├── pages/ # Route/page components
|
||||
├── wiki/ # Source-of-truth docs (synced to GitHub Wiki)
|
||||
├── scripts/
|
||||
│ ├── generate-wiki-llms.mjs # wiki/*.md -> public/wiki/**/llms.txt
|
||||
│ ├── populate-local-feed.sh # Local CVE feed populator
|
||||
│ ├── populate-local-skills.sh # Local skills catalog populator
|
||||
│ ├── populate-local-wiki.sh # Local wiki llms export populator
|
||||
│ ├── prepare-to-push.sh # Local CI-style quality gate
|
||||
│ ├── validate-release-links.sh # Release link checks
|
||||
│ └── release-skill.sh # Manual skill release helper
|
||||
├── skills/
|
||||
│ ├── claw-release/ # 🚀 Release automation workflow skill
|
||||
│ ├── clawsec-suite/ # 📦 Suite installer (skill-of-skills)
|
||||
│ ├── clawsec-feed/ # 📡 Advisory feed skill
|
||||
│ ├── clawsec-scanner/ # 🔍 Vulnerability scanner (deps + SAST + OpenClaw DAST)
|
||||
│ ├── clawsec-nanoclaw/ # 📱 NanoClaw platform security suite
|
||||
│ ├── clawsec-clawhub-checker/ # 🧪 ClawHub reputation checks
|
||||
│ ├── clawtributor/ # 🤝 Community reporting skill
|
||||
│ ├── hermes-attestation-guardian/ # 🛡️ Hermes attestation + drift verification
|
||||
│ ├── openclaw-audit-watchdog/ # 🔭 Automated audit skill
|
||||
│ ├── picoclaw-security-guardian/ # 🦐 Picoclaw posture/advisory/drift/supply-chain checks
|
||||
│ ├── picoclaw-self-pen-testing/ # 🧪 Picoclaw self-pen-testing checks (separate package)
|
||||
│ └── soul-guardian/ # 👻 File integrity skill
|
||||
├── utils/
|
||||
│ ├── package_skill.py # Skill packager utility
|
||||
│ └── validate_skill.py # Skill validator utility
|
||||
├── .github/workflows/
|
||||
│ ├── ci.yml # Cross-platform lint/type/build + tests
|
||||
│ ├── pages-verify.yml # PR-only pages build/signing verification
|
||||
│ ├── poll-nvd-cves.yml # CVE polling pipeline
|
||||
│ ├── community-advisory.yml # Approved issue -> advisory PR
|
||||
│ ├── skill-release.yml # Skill release/signing pipeline
|
||||
│ ├── deploy-pages.yml # GitHub Pages deployment
|
||||
│ ├── wiki-sync.yml # Sync repo wiki/ to GitHub Wiki
|
||||
│ ├── codeql.yml # CodeQL security analysis
|
||||
│ └── scorecard.yml # OpenSSF Scorecard checks
|
||||
└── public/ # Static assets + generated wiki exports
|
||||
```
|
||||
|
||||
--
|
||||
|
||||
Beiträge
|
||||
|
||||
Wir begrüßen Beiträge! Siehe [CONTRIBUTING.md](CONTRIBUTING.md) für Richtlinien.
|
||||
|
||||
### Sicherheitsberater einfügen
|
||||
|
||||
Haben Sie einen schnellen Injektionsvektor, bösartige Fähigkeiten oder Sicherheitslücke gefunden? Über GitHub Issues melden:
|
||||
|
||||
ANHANG Öffne ein neues Problem mit der Vorlage **Security Incident Report***
|
||||
2. Füllen Sie die erforderlichen Felder aus (Stärke, Art, Beschreibung, Betroffene Fähigkeiten)
|
||||
3. Ein Betreuer überprüft und fügt das `advisory-approved` Label hinzu
|
||||
4. Die Beratung wird automatisch im Feed veröffentlicht als `CLAW-{YEAR}-{ISSUE#}`
|
||||
|
||||
Siehe `CLAW-{YEAR}-{ISSUE#}` für detaillierte Richtlinien.
|
||||
|
||||
### Neue Fähigkeiten hinzufügen
|
||||
|
||||
ANHANG Erstellen Sie einen Kompetenzordner unter `skills/`
|
||||
2. Hinzufügen `skill.json` mit benötigten Metadaten und SBOM
|
||||
3. `SKILL.md` mit agentenlesbaren Anweisungen hinzufügen
|
||||
4. Gültig mit `python utils/validate_skill.py skills/your-skill`
|
||||
5. Eine PR zur Überprüfung einreichen
|
||||
|
||||
📚 Dokumentation Quelle der Wahrheit
|
||||
|
||||
Für alle Wiki-Inhalte bearbeiten Sie Dateien unter `wiki/` in diesem Repository. Das GitHub Wiki (`<repo>.wiki.git`) wird von `wiki/`_ durch `.github/workflows/wiki-sync.yml` synchronisiert, wenn `wiki/**`_ auf `main`__ wechselt.
|
||||
|
||||
LLM-Exporte werden von `wiki/` in `public/wiki/`_ generiert:
|
||||
- `/wiki/llms.txt` ist der LLM-ready Export für `wiki/INDEX.md` (oder ein generierter Fallback-Index, wenn `INDEX.md` fehlt).
|
||||
- `/wiki/<page>/llms.txt` ist der LLM-ready Export für diese einzelne Wiki-Seite.
|
||||
|
||||
--
|
||||
|
||||
📄 Lizenz
|
||||
|
||||
- Quellcode: GNU AGPL v3.0 oder später - Siehe [LICENSE](LICENSE) für Details.
|
||||
- Schriften in `font/`: separat lizenziert - Siehe [`font/README.md`](font/README.md).
|
||||
|
||||
--
|
||||
|
||||
<div align="center">
|
||||
|
||||
**ClawSec** · Sicherheitsleistung, SentinelOne
|
||||
|
||||
🦞 Härten Agentic Workflows, eine Fähigkeit zu einer Zeit.
|
||||
|
||||
</div>
|
||||
-277
@@ -1,277 +0,0 @@
|
||||
■h1 align="center"
|
||||
■img src="./img/prompt-icon.svg" alt="prompt-icon" ancho="40"
|
||||
ClawSec: Suite de habilidades de seguridad para agentes de IA
|
||||
■img src="./img/prompt-icon.svg" alt="prompt-icon" ancho="40"
|
||||
■/h1 título
|
||||
|
||||
"Cierto"
|
||||
|
||||
## Protege tus agentes OpenClaw, NanoClaw, Hermes y Picoclaw con una suite de seguridad completa
|
||||
|
||||
<h4>Traído por <a href="https://prompt.security">Prompt Security</a>, la plataforma de seguridad para IA</h4>
|
||||
|
||||
■/div titulada
|
||||
|
||||
"Cierto"
|
||||
|
||||
! [Prompt Security Logo](./img/Black+Color.png)
|
||||
■img src="./public/img/mascot.png" alt="clawsec mascot" ancho="200" /
|
||||
|
||||
■/div titulada
|
||||
|
||||
"Cierto"
|
||||
|
||||
🌐 **En vivo en: [https://clawsec.prompt.security](https://clawsec.prompt.security) [https://prompt.security/clawsec](https://prompt.security/clawsec)**
|
||||
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/ci.yml)
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/deploy-pages.yml)
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/poll-nvd-cves.yml)
|
||||
|
||||
■/div titulada
|
||||
|
||||
-...
|
||||
|
||||
## 🌍 Traducciones
|
||||
|
||||
- English (source of truth): [README.md](README.md)
|
||||
- Español: `README.es.md`
|
||||
|
||||
## ✅ Estado de traducción (Fase 1)
|
||||
|
||||
Esta traducción en español cubre el flujo principal de onboarding y operación.
|
||||
Para detalles de bajo nivel, schema completo y notas avanzadas de CI/CD, consulta el README en inglés.
|
||||
|
||||
## 🦞 ¿Qué es ClawSec?
|
||||
|
||||
ClawSec es una **suite completa de habilidades de seguridad para plataformas de agentes de IA**. Proporciona monitoreo de seguridad unificado, verificación de integridad e inteligencia de amenazas para proteger la arquitectura cognitiva del agente frente a inyección de prompts, deriva y/o instrucciones maliciosas.
|
||||
|
||||
### Plataformas compatibles
|
||||
|
||||
- **OpenClaw** (MoltBot, Clawdbot y clones): suite completa con instalador de habilidades, protección de integridad de archivos y auditorías de seguridad
|
||||
- **NanoClaw**: seguridad para bot de WhatsApp en contenedor, con herramientas MCP para monitoreo de advisories, verificación de firmas e integridad de archivos
|
||||
- **Hermes**: habilidades nativas de Hermes para verificación de feed firmado, verificación protegida con contexto de advisories, generación determinista de attestation, fail-closed verification y detección de drift de baseline
|
||||
- **Picoclaw**: chequeos livianos de postura de seguridad en gateway de IA, con awareness de advisories, detección de drift de configuración, verificación de artefactos de release y paquete opcional separado de self-pen-testing
|
||||
|
||||
### Capacidades principales
|
||||
|
||||
- **📦 Instalador de suite**: instalación de todas las habilidades de seguridad con un solo comando y verificación de integridad
|
||||
- **🛡️ Protección de integridad de archivos**: detección de drift y auto-restauración de archivos críticos del agente (`SOUL.md`, `IDENTITY.md`, etc.)
|
||||
- **📡 Advisories de seguridad en vivo**: polling automatizado de CVEs del NVD e inteligencia comunitaria
|
||||
- **🔍 Auditorías de seguridad**: scripts de auto-chequeo para detectar marcadores de prompt injection y vulnerabilidades
|
||||
- **🔐 Verificación por checksums**: hashes SHA256 para artefactos de habilidades
|
||||
- **Health checks**: actualizaciones y verificación de integridad automatizadas para habilidades instaladas
|
||||
|
||||
-...
|
||||
|
||||
## 🚀 Inicio rápido
|
||||
|
||||
### Para agentes de IA
|
||||
|
||||
```bash
|
||||
# Instala la suite de seguridad de ClawSec
|
||||
npx clawhub@latest install clawsec-suite
|
||||
```
|
||||
|
||||
Después de instalar, la suite puede:
|
||||
1. Descubrir protecciones instalables desde el catálogo de habilidades publicado
|
||||
2. Verificar la integridad de releases con checksums firmados
|
||||
3. Configurar monitoreo de advisories y flujos de protección basados en hooks
|
||||
4. Añadir chequeos programados opcionales
|
||||
|
||||
Opción manual/source-first:
|
||||
|
||||
> Lee https://github.com/prompt-security/clawsec/releases/latest/download/SKILL.md y sigue las instrucciones de instalación.
|
||||
|
||||
### Para humanos
|
||||
|
||||
Copia esta instrucción a tu agente:
|
||||
|
||||
> Instala ClawSec con `npx clawhub@latest install clawsec-suite`, y luego completa los pasos de setup desde las instrucciones generadas.
|
||||
|
||||
### Notas de shell y SO
|
||||
|
||||
Los scripts de ClawSec se dividen entre:
|
||||
- Tooling cross-platform en Node/Python (`npm run build`, hooks/setup `.mjs`, `utils/*.py`)
|
||||
- Flujos POSIX shell (`*.sh`, la mayoría de snippets de instalación manual)
|
||||
|
||||
Para Linux/macOS (`bash`/`zsh`):
|
||||
- Usa variables home sin comillas simples o con comillas dobles: `export INSTALL_ROOT="$HOME/.openclaw/skills"`
|
||||
- **No** uses comillas simples con variables expandibles (por ejemplo, evita `'$HOME/.openclaw/skills'`)
|
||||
|
||||
Para Windows (PowerShell):
|
||||
- Prefiere construir rutas de forma explícita:
|
||||
- `$env:INSTALL_ROOT = Join-Path $HOME ".openclaw\\skills"`
|
||||
- `node "$env:INSTALL_ROOT\\clawsec-suite\\scripts\\setup_advisory_hook.mjs"`
|
||||
- Los scripts POSIX `.sh` requieren WSL o Git Bash.
|
||||
|
||||
Si ves rutas tipo `~/.openclaw/workspace/$HOME/...`, una variable home se pasó de forma literal. Re-ejecuta con ruta absoluta o con expresión home expandible.
|
||||
|
||||
-...
|
||||
|
||||
## 🧭 Documentación por plataforma y suite
|
||||
|
||||
La documentación detallada vive en los módulos del wiki:
|
||||
- NanoClaw: [wiki/modules/nanoclaw-integration.md](wiki/modules/nanoclaw-integration.md)
|
||||
- Hermes: [wiki/modules/hermes-attestation-guardian.md](wiki/modules/hermes-attestation-guardian.md)
|
||||
- Picoclaw: [wiki/modules/picoclaw-security-guardian.md](wiki/modules/picoclaw-security-guardian.md)
|
||||
- Picoclaw auto-pen-testing: [wiki/modules/picoclaw-self-pen-testing.md](wiki/modules/picoclaw-self-pen-testing.md)
|
||||
- ClawSec Suite (OpenClaw): [wiki/modules/clawsec-suite.md](wiki/modules/clawsec-suite.md)
|
||||
- Pipelines CI/CD: [wiki/modules/automation-release.md](wiki/modules/automation-release.md)
|
||||
|
||||
Instalación rápida:
|
||||
- NanoClaw: [skills/clawsec-nanoclaw/INSTALL.md](skills/clawsec-nanoclaw/INSTALL.md)
|
||||
- Hermes: `skills/hermes-attestation-guardian/`
|
||||
- Picoclaw guardian: `skills/picoclaw-security-guardian/`
|
||||
- Picoclaw self-pen-testing: `skills/picoclaw-self-pen-testing/`
|
||||
- Suite: `skills/clawsec-suite/`
|
||||
|
||||
-...
|
||||
|
||||
## 📡 Feed de advisories de seguridad
|
||||
|
||||
ClawSec mantiene un feed de advisories continuamente actualizado, poblado automáticamente desde la National Vulnerability Database (NVD) de NIST.
|
||||
|
||||
### URL del feed
|
||||
|
||||
```bash
|
||||
# Obtener advisories recientes
|
||||
curl -s https://clawsec.prompt.security/advisories/feed.json | jq '.advisories[] | select(.severity == "critical" or .severity == "high")'
|
||||
```
|
||||
|
||||
Endpoint canónico: `https://clawsec.prompt.security/advisories/feed.json`
|
||||
Mirror de compatibilidad (legacy): `https://clawsec.prompt.security/releases/latest/download/feed.json`
|
||||
|
||||
### Palabras clave monitoreadas
|
||||
|
||||
El feed consulta CVEs relacionados con:
|
||||
- **OpenClaw**: `OpenClaw`, `clawdbot`, `Moltbot`
|
||||
- **NanoClaw**: `NanoClaw`, `WhatsApp-bot`, `baileys`
|
||||
- **Picoclaw**: `Picoclaw`, gateways ligeros de IA, exposición de gateway MCP
|
||||
- Patrones de prompt injection
|
||||
- Vulnerabilidades de seguridad en agentes
|
||||
|
||||
### Contexto de explotabilidad
|
||||
|
||||
ClawSec enriquece advisories de CVE con **contexto de explotabilidad** para ayudar a evaluar riesgo real, más allá del score CVSS bruto.
|
||||
|
||||
Puede incluir:
|
||||
- **Evidencia de exploit**: si hay exploits públicos activos
|
||||
- **Estado de weaponization**: si hay integración en frameworks comunes de ataque
|
||||
- **Requisitos de ataque**: prerequisitos para explotar (acceso de red, autenticación, interacción de usuario)
|
||||
- **Evaluación de riesgo**: nivel contextualizado que combina severidad técnica y explotabilidad
|
||||
|
||||
Esto ayuda a priorizar vulnerabilidades de amenaza inmediata frente a riesgos teóricos.
|
||||
|
||||
-...
|
||||
|
||||
## 🛠️ Desarrollo local
|
||||
|
||||
### Prerrequisitos
|
||||
|
||||
- Node.js 20+
|
||||
- Python 3.10+ (herramientas offline)
|
||||
- Npm
|
||||
|
||||
#### Setup
|
||||
|
||||
```bash
|
||||
# Instala dependencias
|
||||
npm install
|
||||
|
||||
# Arranca servidor de desarrollo
|
||||
npm run dev
|
||||
```
|
||||
|
||||
### Poblar datos locales
|
||||
|
||||
```bash
|
||||
# Poblar catálogo de skills desde skills/
|
||||
./scripts/populate-local-skills.sh
|
||||
|
||||
# Poblar advisory feed con CVEs reales del NVD
|
||||
./scripts/populate-local-feed.sh --days 120
|
||||
|
||||
# Generar exportes llms desde wiki/ (preview local)
|
||||
./scripts/populate-local-wiki.sh
|
||||
|
||||
# Entry point directo del generador (usado por predev/prebuild)
|
||||
npm run gen:wiki-llms
|
||||
```
|
||||
|
||||
Notas:
|
||||
- `npm run dev` y `npm run build` regeneran automáticamente exportes `llms.txt` (`predev`/`prebuild`).
|
||||
- `public/wiki/` es salida generada (local + CI) y está gitignored intencionalmente.
|
||||
|
||||
### Build
|
||||
|
||||
```bash
|
||||
npm run build
|
||||
```
|
||||
|
||||
-...
|
||||
|
||||
## 📁 Estructura del proyecto
|
||||
|
||||
```text
|
||||
├── advisories/
|
||||
├── components/
|
||||
├── pages/
|
||||
├── wiki/
|
||||
├── scripts/
|
||||
├── skills/
|
||||
├── utils/
|
||||
├── .github/workflows/
|
||||
└── public/
|
||||
```
|
||||
|
||||
Para la estructura detallada (scripts, workflows y paquetes de habilidades), consulta el README principal en inglés: [README.md](README.md).
|
||||
|
||||
-...
|
||||
|
||||
## 🤝 Contribuir
|
||||
|
||||
¡Contribuciones bienvenidas! Revisa [CONTRIBUTING.md](CONTRIBUTING.md).
|
||||
|
||||
### Enviar advisories de seguridad
|
||||
|
||||
¿Encontraste un vector de prompt injection, skill malicioso o vulnerabilidad? Repórtalo en GitHub Issues:
|
||||
|
||||
1. Abre un issue nuevo con la plantilla **Security Incident Report**
|
||||
2. Completa campos requeridos (severidad, tipo, descripción, skills afectados)
|
||||
3. Un maintainer revisa y agrega `advisory-approved`
|
||||
4. El advisory se publica automáticamente en el feed como `CLAW-{YEAR}-{ISSUE#}`
|
||||
|
||||
Guía detallada: [CONTRIBUTING.md#submitting-security-advisories](CONTRIBUTING.md#submitting-security-advisories)
|
||||
|
||||
### Añadir nuevas skills
|
||||
|
||||
1. Crea carpeta bajo `skills/`
|
||||
2. Agrega `skill.json` con metadata requerida y SBOM
|
||||
3. Agrega `SKILL.md` con instrucciones legibles por agente
|
||||
4. Valida con `python utils/validate_skill.py skills/your-skill`
|
||||
5. Envía PR para review
|
||||
|
||||
## 📚 Fuente de verdad de la documentación
|
||||
|
||||
Todo el contenido wiki se edita en `wiki/` dentro de este repo. El GitHub Wiki (`<repo>.wiki.git`) se sincroniza desde `wiki/` vía `.github/workflows/wiki-sync.yml` cuando cambia `wiki/**` en `main`.
|
||||
|
||||
Los exportes para LLM se generan desde `wiki/` hacia `public/wiki/`:
|
||||
- `/wiki/llms.txt` exporta `wiki/INDEX.md` (o índice fallback generado si falta `INDEX.md`)
|
||||
- `/wiki/<page>/llms.txt` exporta la página wiki individual
|
||||
|
||||
-...
|
||||
|
||||
## 📄 Licencia
|
||||
|
||||
- Código fuente: GNU AGPL v3.0 o posterior — ver [LICENSE](LICENSE)
|
||||
- Fuentes en `font/`: licencia separada — ver [`font/README.md`](font/README.md)
|
||||
|
||||
-...
|
||||
|
||||
"Cierto"
|
||||
|
||||
**ClawSec** · Seguridad Prompt, SentinelOne
|
||||
|
||||
🦞 Fortaleciendo flujos agentic, skill por skill.
|
||||
|
||||
■/div titulada
|
||||
-434
@@ -1,434 +0,0 @@
|
||||
<!-- AUTO-GENERATED TRANSLATION SCAFFOLD (fr)
|
||||
Source: README.md
|
||||
Review status: draft
|
||||
-->
|
||||
|
||||
# Français Translation Scaffold
|
||||
|
||||
This file is currently a draft scaffold. Use README.md as the canonical source.
|
||||
|
||||
<h1 align="center">
|
||||
<img src="/img/prompt-icon.svg" alt="prompt-icon" largeur="40">
|
||||
ClawSec: Suite de compétences en sécurité pour les agents d'IA
|
||||
<img src="/img/prompt-icon.svg" alt="prompt-icon" largeur="40">
|
||||
</h1>
|
||||
|
||||
<div align="center">
|
||||
|
||||
## Sécurisez vos agents OpenClaw, NanoClaw et Hermes avec une suite complète de compétences en sécurité
|
||||
|
||||
<h4>Présenté par <a href="https://prompt.security">Prompt Security</a>, la plateforme pour la sécurité de l'IA</h4>
|
||||
|
||||
</div>
|
||||
|
||||
<div align="center">
|
||||
|
||||
- Oui. [Prompt Security Logo](./img/Black+Color.png)
|
||||
<img src="/public/img/mascot.png" alt="clawsec mascotte" width="200" />
|
||||
|
||||
</div>
|
||||
<div align="center">
|
||||
|
||||
C'est-à-dire **Live at: [https://clawsec.prompt.security](https://clawsec.prompt.security) [https://prompt.security/clawsec](https://prompt.security/clawsec)**
|
||||
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/ci.yml)
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/deploy-pages.yml)
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/poll-nvd-cves.yml)
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
Traductions
|
||||
|
||||
- Español: [README.es.md](README.es.md)
|
||||
- 한국어: [README.ko.md](README.ko.md)
|
||||
|
||||
Qu'est-ce que ClawSec ?
|
||||
|
||||
ClawSec est une suite complète de compétences en sécurité pour les plateformes d'agents d'IA**. Il fournit une surveillance de sécurité unifiée, la vérification de l'intégrité et la protection de l'architecture cognitive de votre agent contre l'injection rapide, la dérive et les instructions malveillantes.
|
||||
|
||||
Plateformes prises en charge
|
||||
|
||||
- **OpenClaw** (MoltBot, Clawdbot et clones) - Suite complète avec installateur de compétences, protection de l'intégrité des fichiers et audits de sécurité
|
||||
- **NanoClaw** - Containerized Whats Sécurité des applications bot avec des outils MCP pour la surveillance consultative, la vérification des signatures et l'intégrité des fichiers
|
||||
- **Hermès** - Compétences en sécurité Hermès-native pour la vérification de l'alimentation, la vérification de l'information-conseil, la génération d'attestations déterministes, la vérification fermée et la détection de la dérive de base
|
||||
- **Picoclaw** - Contrôles de la posture de sécurité de la passerelle légère AI avec sensibilisation, détection de la dérive de config, vérification de l'artéfact de relâchement, et un ensemble d'auto-essais facultatifs
|
||||
|
||||
### Matrix des compétences
|
||||
|
||||
- Oui. Nom de la compétence Plate-forme prise en charge de la sécurité de la vérification de l'alimentation de config driving de l'agent testing de l'auto stylo de la chaîne d'approvisionnement de vérification d'installation de l'installation de l'agent
|
||||
-- -- -- -- -- -- -- -- -- -- -- -- --
|
||||
Claw-release
|
||||
Clawsec-clawhub-checker
|
||||
Oui Non Oui Oui
|
||||
Oui Oui Oui Oui
|
||||
Oui Non Oui Oui
|
||||
Oui Oui Oui Oui
|
||||
Clawtributor OpenClaw OpenClaw OpenClaw OpenClaw OpenClaw
|
||||
Hermes-attestation-guardian.
|
||||
Openclaw-audit-watchdog
|
||||
Picoclaw-security-guardian.
|
||||
Picoclaw-auto-test de stylos
|
||||
Un gardien de l'âme OpenClaw OpenClaw OpenClaw OpenClaw
|
||||
|
||||
Capacités de base
|
||||
|
||||
- ** Installateur Suite** - Installation unique de toutes les compétences de sécurité avec vérification de l'intégrité
|
||||
- Oui. Protection de l'intégrité des fichiers** - Détection et récupération automatique des fichiers d'agents critiques (SOUL.md, IDENTITY.md, etc.)
|
||||
- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
|
||||
- Oui. Audits de sécurité** - Auto-vérifier les scripts pour détecter les marqueurs d'injection et les vulnérabilités
|
||||
- Oui. Vérification des contrôles** - SHA256 somme de contrôle pour tous les artefacts de compétence
|
||||
- **Vérifications santé** - Mises à jour automatisées et vérification de l'intégrité pour toutes les compétences installées
|
||||
|
||||
---
|
||||
|
||||
Démos de produits
|
||||
|
||||
Les aperçus animés ci-dessous sont des GIF (pas d'audio). Cliquez sur n'importe quel aperçu pour ouvrir le MP4 complet avec audio.
|
||||
|
||||
### Installer la démo (`clawsec-suite`)
|
||||
|
||||
[](public/video/install-demo.mp4)
|
||||
|
||||
Lien direct: [install-demo.mp4](public/video/install-demo.mp4)
|
||||
|
||||
### Démo de détection de la dérive (`soul-guardian`)
|
||||
|
||||
[](public/video/soul-guardian-demo.mp4)
|
||||
|
||||
Lien direct: [soul-guardian-demo.mp4](public/video/soul-guardian-demo.mp4)
|
||||
|
||||
---
|
||||
|
||||
Début rapide
|
||||
|
||||
Pour les agents de l'IA
|
||||
|
||||
```bash
|
||||
# Install the ClawSec security suite
|
||||
npx clawhub@latest install clawsec-suite
|
||||
```
|
||||
|
||||
Après l'installation, la suite peut :
|
||||
1. Découvrez les protections installables à partir du catalogue de compétences publié
|
||||
2. Vérifier l'intégrité de la libération à l'aide de comptes de vérification signés
|
||||
3. Mettre en place une surveillance consultative et des flux de protection par crochet
|
||||
4. Ajouter des contrôles programmés facultatifs
|
||||
|
||||
Manuel/source-première option:
|
||||
|
||||
> Lire https://github.com/prompt-security/clawsec/releases/latest/download/SKILL.md et suivre les instructions d'installation.
|
||||
|
||||
Pour les humains
|
||||
|
||||
Copiez cette instruction à votre agent d'IA :
|
||||
|
||||
> Installez ClawSec avec `npx clawhub@latest install clawsec-suite`, puis remplissez les étapes de configuration à partir des instructions générées.
|
||||
|
||||
### Notes Shell et OS
|
||||
|
||||
Les scripts ClawSec sont divisés entre :
|
||||
- Plateforme transversale Outillage Noeud/Python (`npm run build`, crochet/réglage `.mjs`, `utils/*.py`)
|
||||
- Workflows shell POSIX (`*.sh`, la plupart des snipets d'installation manuelle)
|
||||
|
||||
Pour Linux/macOS (`bash`/`zsh`):
|
||||
- Utiliser des vars d'habitation sans ou double citations: `export INSTALL_ROOT="$HOME/.openclaw/skills"`
|
||||
- Ne pas **** vars extensibles à simple cote (par exemple, éviter `'$HOME/.openclaw/skills'`)
|
||||
|
||||
Pour Windows (PowerShell):
|
||||
- Préférez la construction explicite du chemin :
|
||||
- `$env:INSTALL_ROOT = Join-Path $HOME ".openclaw\\skills"`
|
||||
- `node "$env:INSTALL_ROOT\\clawsec-suite\\scripts\\setup_advisory_hook.mjs"`
|
||||
- POSIX `.sh` nécessitent WSL ou Git Bash.
|
||||
|
||||
Dépannage : si vous voyez des répertoires tels que `~/.openclaw/workspace/$HOME/...`, une variable d'accueil a été transmise littéralement. Re-exécuter en utilisant un chemin absolu ou une expression de la maison non citée.
|
||||
|
||||
---
|
||||
|
||||
Documentation sur la plateforme et la suite
|
||||
|
||||
Des documents détaillés sur la plateforme et la suite sont disponibles dans les modules wiki :
|
||||
- NanoClaw: [wiki/modules/nanoclaw-integration.md](wiki/modules/nanoclaw-integration.md)
|
||||
- Hermès: [wiki/modules/hermes-attestation-guardian.md](wiki/modules/hermes-attestation-guardian.md)
|
||||
- Picoclaw: [wiki/modules/picoclaw-security-guardian.md](wiki/modules/picoclaw-security-guardian.md)
|
||||
- Picoclaw auto-test : [wiki/modules/picoclaw-self-pen-testing.md](wiki/modules/picoclaw-self-pen-testing.md)
|
||||
- ClawSec Suite (OpenClaw): [wiki/modules/clawsec-suite.md](wiki/modules/clawsec-suite.md)
|
||||
- pipelines CI/CD: [wiki/modules/automation-release.md](wiki/modules/automation-release.md)
|
||||
|
||||
Liens d'installation rapide :
|
||||
- Installation de NanoClaw : [skills/clawsec-nanoclaw/INSTALL.md](skills/clawsec-nanoclaw/INSTALL.md)
|
||||
- Pack de compétences Hermes: `skills/hermes-attestation-guardian/`
|
||||
- Paquet de protection Picoclaw: `skills/picoclaw-security-guardian/`
|
||||
- Paquet Picoclaw auto-test: `skills/picoclaw-self-pen-testing/`
|
||||
- Paquet Suite: `skills/clawsec-suite/`
|
||||
|
||||
---
|
||||
|
||||
No # # # Avis de sécurité
|
||||
|
||||
ClawSec tient à jour en permanence un avis de sécurité, alimenté automatiquement par la base de données nationale sur la vulnérabilité (NVD) du NIST.
|
||||
|
||||
URL du flux
|
||||
|
||||
```bash
|
||||
# Fetch latest advisories
|
||||
curl -s https://clawsec.prompt.security/advisories/feed.json | jq '.advisories[] | select(.severity == "critical" or .severity == "high")'
|
||||
```
|
||||
|
||||
Critère canonique: `https://clawsec.prompt.security/advisories/feed.json`
|
||||
Miroir de compatibilité (légère): `https://clawsec.prompt.security/releases/latest/download/feed.json`
|
||||
|
||||
Mots-clés surveillés
|
||||
|
||||
Les sondages sur les aliments du bétail ont porté sur :
|
||||
- ** Plateforme OpenClaw** : `OpenClaw`, `clawdbot`, `Moltbot`
|
||||
- **NanoClaw Platform**: `NanoClaw`, `WhatsApp-bot`, `baileys`
|
||||
- **Picoclaw Platform**: `Picoclaw`, `picoclaw`, passerelles AI légères, exposition aux passerelles MCP
|
||||
- Modèles d'injection rapides
|
||||
- Vulnérabilités de sécurité des agents
|
||||
|
||||
Contexte d'exploitation
|
||||
|
||||
ClawSec enrichit les avis CVE avec **contexte d'exploitation** pour aider les agents à évaluer le risque réel au-delà des scores CVSS bruts. Les avis nouvellement analysés peuvent comprendre :
|
||||
|
||||
- **Exploiter des preuves**: si des exploits publics existent dans la nature
|
||||
- ** État des armes** : Si les exploits sont intégrés dans des cadres d'attaque communs
|
||||
- **Exigences d'adaptation**: Prérequis pour une exploitation réussie (accès au réseau, authentification, interaction utilisateur)
|
||||
- **Évaluation des risques**: Niveau de risque contextuel combinant gravité technique et exploitabilité
|
||||
|
||||
Cette fonctionnalité aide les agents à prioriser les vulnérabilités qui posent des menaces immédiates par rapport aux risques théoriques, permettant ainsi des décisions de sécurité plus intelligentes.
|
||||
|
||||
Schéma consultatif
|
||||
|
||||
** NVD CVE Conseil :**
|
||||
```json
|
||||
{
|
||||
"id": "CVE-2026-XXXXX",
|
||||
"severity": "critical|high|medium|low",
|
||||
"type": "vulnerable_skill",
|
||||
"platforms": ["openclaw", "nanoclaw"],
|
||||
"title": "Short description",
|
||||
"description": "Full CVE description from NVD",
|
||||
"published": "2026-02-01T00:00:00Z",
|
||||
"cvss_score": 8.8,
|
||||
"nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-XXXXX",
|
||||
"exploitability_score": "high|medium|low|unknown",
|
||||
"exploitability_rationale": "Why this CVE is or is not likely exploitable in agent deployments",
|
||||
"references": ["..."],
|
||||
"action": "Recommended remediation"
|
||||
}
|
||||
```
|
||||
|
||||
**Conseil communautaire:**
|
||||
```json
|
||||
{
|
||||
"id": "CLAW-2026-0042",
|
||||
"severity": "high",
|
||||
"type": "prompt_injection|vulnerable_skill|tampering_attempt",
|
||||
"platforms": ["nanoclaw"],
|
||||
"title": "Short description",
|
||||
"description": "Detailed description from issue",
|
||||
"published": "2026-02-01T00:00:00Z",
|
||||
"affected": ["skill-name@1.0.0"],
|
||||
"source": "Community Report",
|
||||
"github_issue_url": "https://github.com/.../issues/42",
|
||||
"action": "Recommended remediation"
|
||||
}
|
||||
```
|
||||
|
||||
**Valeurs de la plateforme:**
|
||||
- `"openclaw"` - OpenClaw/Clawdbot/Molt Bot seulement
|
||||
- `"nanoclaw"` - NanoClaw seulement
|
||||
- `"hermes"` - Hermès seulement
|
||||
- `"picoclaw"` - Picoclaw seulement
|
||||
- `["openclaw", "nanoclaw", "hermes", "picoclaw"]` - Toutes les plateformes centrales
|
||||
- (vide/manque) - Toutes les plates-formes (compatible avec l'arrière)
|
||||
|
||||
---
|
||||
|
||||
Lignes de pipelines CI/CD
|
||||
|
||||
Les détails du pipeline CI/CD ont été déplacés vers la page du module wiki :
|
||||
- [wiki/modules/automation-release.md](wiki/modules/automation-release.md)
|
||||
|
||||
Opérations connexes docs:
|
||||
- [wiki/security-signing-runbook.md](wiki/security-signing-runbook.md)
|
||||
- [wiki/migration-signed-feed.md](wiki/migration-signed-feed.md)
|
||||
|
||||
---
|
||||
|
||||
Outils hors ligne
|
||||
|
||||
ClawSec comprend Utilitaires Python pour le développement et la validation des compétences locales.
|
||||
|
||||
### Validateur de compétences
|
||||
|
||||
Valide un dossier de compétences en fonction du schéma requis :
|
||||
|
||||
```bash
|
||||
python utils/validate_skill.py skills/clawsec-feed
|
||||
```
|
||||
|
||||
Contrôles :
|
||||
- `skill.json` existe et est valide JSON
|
||||
- Champs obligatoires présents (nom, version, description, auteur, licence)
|
||||
- Les fichiers SBOM existent et sont lisibles
|
||||
- Les métadonnées OpenClaw sont bien structurées
|
||||
|
||||
Générateur de contrôles de compétences
|
||||
|
||||
Génére `checksums.json` avec SHA256 haches pour une compétence:
|
||||
|
||||
```bash
|
||||
python utils/package_skill.py skills/clawsec-feed ./dist
|
||||
```
|
||||
|
||||
Produits :
|
||||
- `checksums.json` - SHA256 haches pour vérification
|
||||
|
||||
---
|
||||
|
||||
Développement local
|
||||
|
||||
Préalables
|
||||
|
||||
- Node.js 20+
|
||||
- Python 3.10+ (pour les outils hors ligne)
|
||||
- npm
|
||||
|
||||
Configuration
|
||||
|
||||
```bash
|
||||
# Install dependencies
|
||||
npm install
|
||||
|
||||
# Start development server
|
||||
npm run dev
|
||||
```
|
||||
|
||||
- Oui. Populer des données locales
|
||||
|
||||
```bash
|
||||
# Populate skills catalog from local skills/ directory
|
||||
./scripts/populate-local-skills.sh
|
||||
|
||||
# Populate advisory feed with real NVD CVE data
|
||||
./scripts/populate-local-feed.sh --days 120
|
||||
|
||||
# Generate wiki llms exports from wiki/ (for local preview)
|
||||
./scripts/populate-local-wiki.sh
|
||||
|
||||
# Direct generator entrypoint (used by predev/prebuild)
|
||||
npm run gen:wiki-llms
|
||||
```
|
||||
|
||||
Remarques:
|
||||
- `npm run dev` et `npm run build` régénèrent automatiquement les exportations de wikis `llms.txt` (Hooks `predev`/`prebuild`).
|
||||
- `public/wiki/` est généré en sortie (locale + CI) et est intentionnellement gitagnolé.
|
||||
|
||||
Construire
|
||||
|
||||
```bash
|
||||
npm run build
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
Structure du projet
|
||||
|
||||
```
|
||||
├── advisories/
|
||||
│ ├── feed.json # Main advisory feed
|
||||
│ ├── feed.json.sig # Detached signature for feed.json
|
||||
│ └── feed-signing-public.pem # Public key for feed verification
|
||||
├── components/ # React components
|
||||
├── pages/ # Route/page components
|
||||
├── wiki/ # Source-of-truth docs (synced to GitHub Wiki)
|
||||
├── scripts/
|
||||
│ ├── generate-wiki-llms.mjs # wiki/*.md -> public/wiki/**/llms.txt
|
||||
│ ├── populate-local-feed.sh # Local CVE feed populator
|
||||
│ ├── populate-local-skills.sh # Local skills catalog populator
|
||||
│ ├── populate-local-wiki.sh # Local wiki llms export populator
|
||||
│ ├── prepare-to-push.sh # Local CI-style quality gate
|
||||
│ ├── validate-release-links.sh # Release link checks
|
||||
│ └── release-skill.sh # Manual skill release helper
|
||||
├── skills/
|
||||
│ ├── claw-release/ # 🚀 Release automation workflow skill
|
||||
│ ├── clawsec-suite/ # 📦 Suite installer (skill-of-skills)
|
||||
│ ├── clawsec-feed/ # 📡 Advisory feed skill
|
||||
│ ├── clawsec-scanner/ # 🔍 Vulnerability scanner (deps + SAST + OpenClaw DAST)
|
||||
│ ├── clawsec-nanoclaw/ # 📱 NanoClaw platform security suite
|
||||
│ ├── clawsec-clawhub-checker/ # 🧪 ClawHub reputation checks
|
||||
│ ├── clawtributor/ # 🤝 Community reporting skill
|
||||
│ ├── hermes-attestation-guardian/ # 🛡️ Hermes attestation + drift verification
|
||||
│ ├── openclaw-audit-watchdog/ # 🔭 Automated audit skill
|
||||
│ ├── picoclaw-security-guardian/ # 🦐 Picoclaw posture/advisory/drift/supply-chain checks
|
||||
│ ├── picoclaw-self-pen-testing/ # 🧪 Picoclaw self-pen-testing checks (separate package)
|
||||
│ └── soul-guardian/ # 👻 File integrity skill
|
||||
├── utils/
|
||||
│ ├── package_skill.py # Skill packager utility
|
||||
│ └── validate_skill.py # Skill validator utility
|
||||
├── .github/workflows/
|
||||
│ ├── ci.yml # Cross-platform lint/type/build + tests
|
||||
│ ├── pages-verify.yml # PR-only pages build/signing verification
|
||||
│ ├── poll-nvd-cves.yml # CVE polling pipeline
|
||||
│ ├── community-advisory.yml # Approved issue -> advisory PR
|
||||
│ ├── skill-release.yml # Skill release/signing pipeline
|
||||
│ ├── deploy-pages.yml # GitHub Pages deployment
|
||||
│ ├── wiki-sync.yml # Sync repo wiki/ to GitHub Wiki
|
||||
│ ├── codeql.yml # CodeQL security analysis
|
||||
│ └── scorecard.yml # OpenSSF Scorecard checks
|
||||
└── public/ # Static assets + generated wiki exports
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
Contribution
|
||||
|
||||
Nous saluons les contributions! Voir [CONTRIBUTING.md](CONTRIBUTING.md) pour les lignes directrices.
|
||||
|
||||
### Soumettre des avis de sécurité
|
||||
|
||||
Trouvé un vecteur d'injection rapide, une compétence malveillante ou une vulnérabilité à la sécurité? Signalez-le via GitHub Questions :
|
||||
|
||||
1. Ouvrir un nouveau numéro en utilisant le modèle **Rapport d'incident de sécurité**
|
||||
2. Remplissez les champs requis (série, type, description, compétences affectées)
|
||||
3. Un responsable examinera et ajoutera l'étiquette `advisory-approved`
|
||||
4. L'avis est automatiquement publié sur le flux sous la forme de `CLAW-{YEAR}-{ISSUE#}`
|
||||
|
||||
Voir [CONTRIBUTING.md](CONTRIBUTING.md#submitting-security-advisories) pour des lignes directrices détaillées.
|
||||
|
||||
Ajouter de nouvelles compétences
|
||||
|
||||
1. Créer un dossier de compétences sous `skills/`
|
||||
2. Ajouter `skill.json` avec les métadonnées requises et SBOM
|
||||
3. Ajouter `SKILL.md` avec des instructions lisibles par agent
|
||||
4. Valider avec `python utils/validate_skill.py skills/your-skill`
|
||||
5. Soumettre un rapport de situation pour examen
|
||||
|
||||
Source de documentation de la vérité
|
||||
|
||||
Pour tout le contenu wiki, éditer des fichiers sous `wiki/` dans ce dépôt. Le Wiki GitHub (`<repo>.wiki.git`) est synchronisé depuis `wiki/` par `.github/workflows/wiki-sync.yml` lorsque `wiki/**` change sur `main`.
|
||||
|
||||
Les exportations de LLM sont générées par `wiki/` vers `public/wiki/`:
|
||||
- `/wiki/llms.txt` est l'exportation prête à LLM pour `wiki/INDEX.md` (ou un indice de repli généré si `INDEX.md` est manquant).
|
||||
- `/wiki/<page>/llms.txt` est l'export LLM-ready pour cette seule page wiki.
|
||||
|
||||
---
|
||||
|
||||
Licence
|
||||
|
||||
- Code source : GNU AGPL v3.0 ou ultérieur - Voir [LICENSE](LICENSE) pour plus de détails.
|
||||
- Polices dans `font/`: Licence séparée - Voir [`font/README.md`](font/README.md).
|
||||
|
||||
---
|
||||
|
||||
<div align="center">
|
||||
|
||||
**ClawSec** · Sécurité rapide, SentinelOne
|
||||
|
||||
C'est-à-dire Renforcer les workflows d'agents, une compétence à la fois.
|
||||
|
||||
</div>
|
||||
-434
@@ -1,434 +0,0 @@
|
||||
<!-- AUTO-GENERATED TRANSLATION SCAFFOLD (ja)
|
||||
Source: README.md
|
||||
Review status: draft
|
||||
-->
|
||||
|
||||
# 日本語 Translation Scaffold
|
||||
|
||||
This file is currently a draft scaffold. Use README.md as the canonical source.
|
||||
|
||||
<h1 align="center">
|
||||
<img src="./img/prompt-icon.svg"alt="prompt-icon" 幅="40">
|
||||
ClawSec:AIエージェントのセキュリティスキルスイート
|
||||
<img src="./img/prompt-icon.svg"alt="prompt-icon" 幅="40">
|
||||
</h1>
|
||||
|
||||
<div align="center">
|
||||
|
||||
## 完全なセキュリティスキルスイートでOpenClaw、NanoClaw、およびヘルメスエージェントをセキュアに
|
||||
|
||||
<h4>AIセキュリティプラットフォーム</h4>
|
||||
|
||||
</div>
|
||||
|
||||
<div align="center">
|
||||
|
||||
お問い合わせ [Prompt Security Logo](./img/Black+Color.png)の特長
|
||||
<img src="./public/img/mascot.png"alt="clawsec mascot" 幅="200" />
|
||||
|
||||
</div>
|
||||
<div align="center">
|
||||
|
||||
ブーツ **ライブ時: [https://clawsec.prompt.security](https://clawsec.prompt.security) [https://prompt.security/clawsec](https://prompt.security/clawsec)**
|
||||
|
||||
[(https://github.com/prompt-security/clawsec/actions/workflows/ci.yml)
|
||||
[(https://github.com/prompt-security/clawsec/actions/workflows/deploy-pages.yml)
|
||||
[(https://github.com/prompt-security/clawsec/actions/workflows/poll-nvd-cves.yml)
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## 翻訳
|
||||
|
||||
- Español: [README.es.md](README.es.md)
|
||||
- 한국어: [README.ko.md](README.ko.md)
|
||||
|
||||
## 🦞 ClawSecとは?
|
||||
|
||||
ClawSec は、AI エージェント プラットフォームの**完全なセキュリティ スキル スイートです。 エージェントの認知アーキテクチャを迅速注入、ドリフト、悪意のある指示に対して、統一されたセキュリティ監視、完全性検証、脅威インテリジェンス保護を提供します。
|
||||
|
||||
## 対応プラットフォーム
|
||||
|
||||
- **OpenClaw**(MoltBot、Clawdbot、およびクローン) - スキルインストーラ、ファイルの完全性保護、およびセキュリティ監査とフルスイート
|
||||
- **ナノクロー** - コンテナ化されたもの 諮問監視、署名検証、ファイルの整合性のためのMCPツールを使用したAppボットセキュリティ
|
||||
-**Hermes** - 署名された諮問的フィード検証、アドバイザリーアウェアガード検証、決定的な検証生成、フェイルクローズド検証、ベースラインドリフト検出のためのヘルメスネイティブセキュリティスキル
|
||||
-**Picoclaw** - 軽量AIゲートウェイセキュリティの姿勢は、アドバイザリーの意識、構成の漂流検出、リリースアーティファクト検証、およびオプションの別々のセルフペンテストパッケージでチェックします
|
||||
|
||||
##スキル機能マトリックス
|
||||
|
||||
お問い合わせ スキル名 | 対応プラットフォーム| 安全検証| 構成漂流 | エージェントセルフペンテスト| サプライチェーンインストール検証 |
|
||||
お問い合わせ
|
||||
| プレスリリース | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部
|
||||
| クローム・クローブ・チェッカー | OpenClaw + clawsec スイート・インテグレーション | ノー | ノー | ノー | ノー | ノー | ノー |
|
||||
| クロームフィード | OpenClaw | 有り | なし | なし | なし | 有り |
|
||||
| クローム・ナンクロー | ナノクロー | 可 | 可 | 有 | 有 | 有 | 有 | 有 | 有 | 有 |
|
||||
| クローム・スキャナ | オープンクロー | 有り | なし | 有り | 可 | 可 | 可 | 可 | 可 |
|
||||
| クロームスイート | オープンクローラ | 有り | 有り | なし | 有り | なし | 有り | なし | なし | なし | なし | なし | なし | なし | なし | なし | なし | なし |
|
||||
| プライバシーポリシー | 免責事項 | 免責事項 | 免責事項 | 免責事項 | 免責事項 | 免責事項 | 免責事項 |
|
||||
| ヘルメス・アテスタンス・ガーディアン | ヘルメス | はい(アドバイザリー・フィード・検証) | はい | なし | 限定(アドバイザリー・プレッションのみ・アーティファクト・シグネチャ・プロテナンス・インストール・検証なし) |
|
||||
| Openclaw-audit-watchdog | OpenClaw | ノー | ノー | ノー | ノー | ノー |
|
||||
| picoclaw-security-guardian | ピッコロー | 有り | なし | 有り | 有り |
|
||||
| picoclaw-self-pen-testing | ピッコロー | ノー | ノー | ノー | ノー |
|
||||
| 魂を守る人 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 | 営業部 |
|
||||
|
||||
## コア機能
|
||||
|
||||
- ** レース スイート インストーラ** - 完全性検証ですべてのセキュリティ スキルのワンコマンド インストール
|
||||
お問い合わせ ファイル整合性保護** - 重要なエージェントファイル(SOUL.md、IDENTITY.mdなど)のドリフト検出と自動復元
|
||||
- **セキュリティアドバイザリー** - 自動NVD CVEポーリングとコミュニティの脅威インテリジェンス
|
||||
- ** 絶縁 セキュリティ監査** - プロンプトインジェクションマーカーと脆弱性を検出するためにスクリプトをセルフチェック
|
||||
お問い合わせ チェックサム検証** - すべてのスキルアーティファクトのSHA256チェックサム
|
||||
- **健康チェック** - インストールされたすべてのスキルの自動更新と完全性検証
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## ✔製品デモ
|
||||
|
||||
下記のアニメーションプレビューはGIF(音声なし)です。 任意のプレビューをクリックして、オーディオでフルMP4を開きます。
|
||||
|
||||
## デモをインストール (`clawsec-suite`)
|
||||
|
||||
[(パブリック/ビデオ/インストールデモ)
|
||||
|
||||
直接リンク: [install-demo.mp4](public/video/install-demo.mp4)
|
||||
|
||||
## ドリフト検出デモ(`soul-guardian`)
|
||||
|
||||
[(公共/ビデオ/ソウル-保護者-demo.mp4)
|
||||
|
||||
直接リンク: [soul-guardian-demo.mp4](public/video/soul-guardian-demo.mp4)
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## すぐにスタート
|
||||
|
||||
##AIエージェントの###
|
||||
|
||||
```bash
|
||||
# Install the ClawSec security suite
|
||||
npx clawhub@latest install clawsec-suite
|
||||
```
|
||||
|
||||
インストール後、スイートは次のことができます。
|
||||
1。 公開されたスキルカタログからインストール可能な保護を発見
|
||||
2。 署名されたチェックサムを使用してリリースの完全性を確認します
|
||||
3。 アドバイザリーモニタリングとホックベースの保護フローの設定
|
||||
4。 オプションのスケジュールチェックを追加
|
||||
|
||||
手動/ソース優先オプション:
|
||||
|
||||
ツイート 採用情報 https://github.com/prompt-security/clawsec/releases/latest/download/SKILL.md とインストール手順に従います。
|
||||
|
||||
人間のための#####
|
||||
|
||||
この指示をAIエージェントにコピーします。
|
||||
|
||||
ツイート `npx clawhub@latest install clawsec-suite`でClawSecをインストールし、生成された指示からセットアップ手順を完了します。
|
||||
|
||||
##シェルとOSノート
|
||||
|
||||
ClawSec スクリプトは以下の間に分割されます。
|
||||
- クロスプラットフォーム Node/Python ツーリング (`npm run build`、hook/setup `.mjs`、`utils/*.py`)
|
||||
- POSIXシェルワークフロー(`*.sh`、ほとんどの手動インストールスニペット)
|
||||
|
||||
Linux/macOS (`bash`/`zsh`) の場合:
|
||||
- 引用されていないか二重引用された家変数を使用して下さい:`export INSTALL_ROOT="$HOME/.openclaw/skills"`
|
||||
- 単一の引用符の拡張可能なvars (例えば、`'$HOME/.openclaw/skills'`を避けるため) を**しない**
|
||||
|
||||
Windows用(PowerShell):
|
||||
- プレファーの明示的な道の建物:
|
||||
- `$env:INSTALL_ROOT = Join-Path $HOME ".openclaw\\skills"`
|
||||
- `node "$env:INSTALL_ROOT\\clawsec-suite\\scripts\\setup_advisory_hook.mjs"`
|
||||
- POSIX `.sh`スクリプトはWSLまたはGit Bashが必要です。
|
||||
|
||||
トラブルシューティング:`~/.openclaw/workspace/$HOME/...`などのディレクトリが表示された場合、ホーム変数は文字通り渡されました。 絶対パスまたは非引用のホーム式を使用して再実行します。
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## 🧭プラットフォーム&スイートドキュメント
|
||||
|
||||
詳細なプラットフォームとスイート docs は wiki モジュールで動作します。
|
||||
・ナノクロー:[wiki/modules/nanoclaw-integration.md](wiki/modules/nanoclaw-integration.md)
|
||||
- ヘルメス:[wiki/modules/hermes-attestation-guardian.md](wiki/modules/hermes-attestation-guardian.md)
|
||||
- ピコクロー:[wiki/modules/picoclaw-security-guardian.md](wiki/modules/picoclaw-security-guardian.md)
|
||||
- ピコクローセルフペンテスト: [wiki/modules/picoclaw-self-pen-testing.md](wiki/modules/picoclaw-self-pen-testing.md)の特長
|
||||
- ClawSec Suite (OpenClaw): [wiki/modules/clawsec-suite.md](wiki/modules/clawsec-suite.md)
|
||||
- CI/CDのパイプライン: [wiki/modules/automation-release.md](wiki/modules/automation-release.md)の特長
|
||||
|
||||
クイックインストールリンク:
|
||||
- NanoClawは取付けます: [skills/clawsec-nanoclaw/INSTALL.md](skills/clawsec-nanoclaw/INSTALL.md)の特長
|
||||
- エルメススキルパッケージ:`skills/hermes-attestation-guardian/`
|
||||
- Picoclawの保護者のパッケージ:`skills/picoclaw-security-guardian/`
|
||||
- ピコクローセルフペンテストパッケージ:`skills/picoclaw-self-pen-testing/`
|
||||
- スイートパッケージ:`skills/clawsec-suite/`
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## 安全保障アドバイザリーフィード
|
||||
|
||||
ClawSecは、NISTのNational Vulnerability Database(NVD)から自動ポップアップし、継続的に更新されたセキュリティアドバイザリーフィードを維持します。
|
||||
|
||||
## フィード URL
|
||||
|
||||
```bash
|
||||
# Fetch latest advisories
|
||||
curl -s https://clawsec.prompt.security/advisories/feed.json | jq '.advisories[] | select(.severity == "critical" or .severity == "high")'
|
||||
```
|
||||
|
||||
キヤノンのエンドポイント:`https://clawsec.prompt.security/advisories/feed.json`
|
||||
互換性ミラー(レガシー):`https://clawsec.prompt.security/releases/latest/download/feed.json`
|
||||
|
||||
### 監視されたキーワード
|
||||
|
||||
フィードの投票 CVE に関連する:
|
||||
- **OpenClawプラットフォーム**: `OpenClaw`、`clawdbot`、`Moltbot`
|
||||
- **ナノクロープラットフォーム**:`NanoClaw`、`WhatsApp-bot`、`baileys`
|
||||
- **Picoclaw Platform**:`Picoclaw`、`picoclaw`、軽量AIゲートウェイ、MCPゲートウェイ露出
|
||||
- プロンプト射出パターン
|
||||
- エージェントのセキュリティ脆弱性
|
||||
|
||||
###exploitability コンテキスト
|
||||
|
||||
ClawSec は、CVE のアドバイザリーを **exploitability context** で強化し、CVSS スコアを超えて、エージェントが現実的なリスクを評価するのを支援します。 新規に分析されたアドバイザリーには以下が含まれます。
|
||||
|
||||
-**Exploit Evidence**: 公共の悪用が野生に存在するかどうか
|
||||
- **武器の状態**: 悪用が一般的な攻撃フレームワークに統合されている場合
|
||||
- **攻撃要件**:成功した搾取(ネットワークアクセス、認証、ユーザーインタラクション)に必要な前提条件
|
||||
-**リスクアセスメント**:技術的重大性を悪用性と組み合わせるコンテキストリスクレベル
|
||||
|
||||
この機能は、エージェントが直面する脅威を理論的なリスクに優先し、よりスマートなセキュリティ決定を可能にします。
|
||||
|
||||
##アドバイザリー・スキーマ
|
||||
|
||||
**NVD CVE ** アドバイザリー:**
|
||||
```json
|
||||
{
|
||||
"id": "CVE-2026-XXXXX",
|
||||
"severity": "critical|high|medium|low",
|
||||
"type": "vulnerable_skill",
|
||||
"platforms": ["openclaw", "nanoclaw"],
|
||||
"title": "Short description",
|
||||
"description": "Full CVE description from NVD",
|
||||
"published": "2026-02-01T00:00:00Z",
|
||||
"cvss_score": 8.8,
|
||||
"nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-XXXXX",
|
||||
"exploitability_score": "high|medium|low|unknown",
|
||||
"exploitability_rationale": "Why this CVE is or is not likely exploitable in agent deployments",
|
||||
"references": ["..."],
|
||||
"action": "Recommended remediation"
|
||||
}
|
||||
```
|
||||
|
||||
**コミュニティアドバイザリー:**
|
||||
```json
|
||||
{
|
||||
"id": "CLAW-2026-0042",
|
||||
"severity": "high",
|
||||
"type": "prompt_injection|vulnerable_skill|tampering_attempt",
|
||||
"platforms": ["nanoclaw"],
|
||||
"title": "Short description",
|
||||
"description": "Detailed description from issue",
|
||||
"published": "2026-02-01T00:00:00Z",
|
||||
"affected": ["skill-name@1.0.0"],
|
||||
"source": "Community Report",
|
||||
"github_issue_url": "https://github.com/.../issues/42",
|
||||
"action": "Recommended remediation"
|
||||
}
|
||||
```
|
||||
|
||||
**プラットフォーム値:**
|
||||
- `"openclaw"` - OpenClaw/Clawdbot/Molt ボットのみ
|
||||
- `"nanoclaw"` - ナノクローのみ
|
||||
- `"hermes"` - ヘルメスのみ
|
||||
- `"picoclaw"` - ピコクローのみ
|
||||
- `["openclaw", "nanoclaw", "hermes", "picoclaw"]` - すべてのコアプラットフォーム
|
||||
- (empty/missing) - すべてのプラットフォーム(後方互換)
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## は、CI/CD パイプライン
|
||||
|
||||
CI/CD パイプラインの詳細は wiki モジュールページに移動しました。
|
||||
- [wiki/modules/automation-release.md](wiki/modules/automation-release.md)
|
||||
|
||||
関連操作 docs:
|
||||
- [wiki/security-signing-runbook.md](wiki/security-signing-runbook.md)
|
||||
- [wiki/migration-signed-feed.md](wiki/migration-signed-feed.md)
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## ️️ オフラインツール
|
||||
|
||||
ClawSecには ローカルスキル開発と検証のためのPythonユーティリティ。
|
||||
|
||||
##スキルバリデータ
|
||||
|
||||
必要なスキーマに対してスキルフォルダーを検証します。
|
||||
|
||||
```bash
|
||||
python utils/validate_skill.py skills/clawsec-feed
|
||||
```
|
||||
|
||||
チェック:
|
||||
- `skill.json`が存在し、有効なJSON
|
||||
- 必須フィールド(名前、バージョン、説明、著者、ライセンス)
|
||||
- SBOMファイルが存在し、読みやすく
|
||||
- OpenClawメタデータを適切に構造化
|
||||
|
||||
##スキルチェックサムジェネレーター
|
||||
|
||||
`checksums.json` を SHA256 のハッシュで生成します。
|
||||
|
||||
```bash
|
||||
python utils/package_skill.py skills/clawsec-feed ./dist
|
||||
```
|
||||
|
||||
出力:
|
||||
- `checksums.json` - SHA256ハッシュの検証
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## ローカル開発
|
||||
|
||||
### 前提条件
|
||||
|
||||
- Node.js 20 +
|
||||
- Python 3.10+(オフラインツール用)
|
||||
- 午後
|
||||
|
||||
### セットアップ
|
||||
|
||||
```bash
|
||||
# Install dependencies
|
||||
npm install
|
||||
|
||||
# Start development server
|
||||
npm run dev
|
||||
```
|
||||
|
||||
################################################################################################################################################################################################################################################################ ローカルデータを出力
|
||||
|
||||
```bash
|
||||
# Populate skills catalog from local skills/ directory
|
||||
./scripts/populate-local-skills.sh
|
||||
|
||||
# Populate advisory feed with real NVD CVE data
|
||||
./scripts/populate-local-feed.sh --days 120
|
||||
|
||||
# Generate wiki llms exports from wiki/ (for local preview)
|
||||
./scripts/populate-local-wiki.sh
|
||||
|
||||
# Direct generator entrypoint (used by predev/prebuild)
|
||||
npm run gen:wiki-llms
|
||||
```
|
||||
|
||||
注意:
|
||||
- `npm run dev` と `npm run build` は自動的に wiki `llms.txt` のエクスポート (`predev`/`prebuild` のホック) を再生成します。
|
||||
- `public/wiki/`は出力(ローカル+CI)を生成し、意図的に無視されます。
|
||||
|
||||
## ビルド
|
||||
|
||||
```bash
|
||||
npm run build
|
||||
```
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## 📁 プロジェクト構造
|
||||
|
||||
```
|
||||
├── advisories/
|
||||
│ ├── feed.json # Main advisory feed
|
||||
│ ├── feed.json.sig # Detached signature for feed.json
|
||||
│ └── feed-signing-public.pem # Public key for feed verification
|
||||
├── components/ # React components
|
||||
├── pages/ # Route/page components
|
||||
├── wiki/ # Source-of-truth docs (synced to GitHub Wiki)
|
||||
├── scripts/
|
||||
│ ├── generate-wiki-llms.mjs # wiki/*.md -> public/wiki/**/llms.txt
|
||||
│ ├── populate-local-feed.sh # Local CVE feed populator
|
||||
│ ├── populate-local-skills.sh # Local skills catalog populator
|
||||
│ ├── populate-local-wiki.sh # Local wiki llms export populator
|
||||
│ ├── prepare-to-push.sh # Local CI-style quality gate
|
||||
│ ├── validate-release-links.sh # Release link checks
|
||||
│ └── release-skill.sh # Manual skill release helper
|
||||
├── skills/
|
||||
│ ├── claw-release/ # 🚀 Release automation workflow skill
|
||||
│ ├── clawsec-suite/ # 📦 Suite installer (skill-of-skills)
|
||||
│ ├── clawsec-feed/ # 📡 Advisory feed skill
|
||||
│ ├── clawsec-scanner/ # 🔍 Vulnerability scanner (deps + SAST + OpenClaw DAST)
|
||||
│ ├── clawsec-nanoclaw/ # 📱 NanoClaw platform security suite
|
||||
│ ├── clawsec-clawhub-checker/ # 🧪 ClawHub reputation checks
|
||||
│ ├── clawtributor/ # 🤝 Community reporting skill
|
||||
│ ├── hermes-attestation-guardian/ # 🛡️ Hermes attestation + drift verification
|
||||
│ ├── openclaw-audit-watchdog/ # 🔭 Automated audit skill
|
||||
│ ├── picoclaw-security-guardian/ # 🦐 Picoclaw posture/advisory/drift/supply-chain checks
|
||||
│ ├── picoclaw-self-pen-testing/ # 🧪 Picoclaw self-pen-testing checks (separate package)
|
||||
│ └── soul-guardian/ # 👻 File integrity skill
|
||||
├── utils/
|
||||
│ ├── package_skill.py # Skill packager utility
|
||||
│ └── validate_skill.py # Skill validator utility
|
||||
├── .github/workflows/
|
||||
│ ├── ci.yml # Cross-platform lint/type/build + tests
|
||||
│ ├── pages-verify.yml # PR-only pages build/signing verification
|
||||
│ ├── poll-nvd-cves.yml # CVE polling pipeline
|
||||
│ ├── community-advisory.yml # Approved issue -> advisory PR
|
||||
│ ├── skill-release.yml # Skill release/signing pipeline
|
||||
│ ├── deploy-pages.yml # GitHub Pages deployment
|
||||
│ ├── wiki-sync.yml # Sync repo wiki/ to GitHub Wiki
|
||||
│ ├── codeql.yml # CodeQL security analysis
|
||||
│ └── scorecard.yml # OpenSSF Scorecard checks
|
||||
└── public/ # Static assets + generated wiki exports
|
||||
```
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## 社会貢献
|
||||
|
||||
寄付を歓迎します! ガイドラインの[CONTRIBUTING.md](CONTRIBUTING.md)をご覧ください。
|
||||
|
||||
### 提出セキュリティアドバイザリー
|
||||
|
||||
迅速な注射ベクトル、悪意のあるスキル、またはセキュリティ脆弱性を発見しましたか? GitHub の問題で報告する:
|
||||
|
||||
1。 **セキュリティインシデントレポート**テンプレートを使用して新しい問題を開きます
|
||||
2。 必須項目を記入(重度、種類、説明、影響を受けたスキル)
|
||||
3。 メンテナーが`advisory-approved`ラベルを見直し、追加します
|
||||
4。 アドバイザリーが`CLAW-{YEAR}-{ISSUE#}`としてフィードに自動的に公開されます
|
||||
|
||||
詳細は[CONTRIBUTING.md](CONTRIBUTING.md#submitting-security-advisories)をご覧ください。
|
||||
|
||||
##新規スキルの追加
|
||||
|
||||
1。 `skills/`でスキルフォルダを作成する
|
||||
2。 必要なメタデータとSBOMで`skill.json`を追加
|
||||
3。 エージェント読み取り可能な指示で`SKILL.md`を追加
|
||||
4. `python utils/validate_skill.py skills/your-skill`と検証
|
||||
5。 レビューのPRを提出する
|
||||
|
||||
## ドキュメント 真実のソース
|
||||
|
||||
すべてのwikiコンテンツについては、このリポジトリの`wiki/`でファイルを編集します。 GitHub Wiki (`<repo>.wiki.git`) は、`main` が `.github/workflows/wiki-sync.yml` から `wiki/**` が `main` で変更されたときに、`.github/workflows/wiki-sync.yml` から同期されます。
|
||||
|
||||
LLM エクスポートは `wiki/` から `public/wiki/` に生成されます。
|
||||
- `/wiki/llms.txt` は `wiki/INDEX.md` の LLM-ready エクスポート (または `INDEX.md` が見つからない場合は生成されたフォールバックインデックス) です。
|
||||
- `/wiki/<page>/llms.txt`は、その単一のwikiページのためのLM-readyエクスポートです。
|
||||
|
||||
お問い合わせ
|
||||
|
||||
## ライセンス
|
||||
|
||||
- ソースコード:GNU AGPL v3.0以降 - 詳細は[LICENSE](LICENSE)を参照してください。
|
||||
- `font/`のフォント: ライセンス別 - [`font/README.md`](font/README.md) をご覧ください。
|
||||
|
||||
お問い合わせ
|
||||
|
||||
<div align="center">
|
||||
|
||||
**ClawSec**・Prompt Security、SentinelOne **
|
||||
|
||||
エージェントのワークフローを強化し、一度に1つのスキル。
|
||||
|
||||
</div>
|
||||
@@ -1,59 +0,0 @@
|
||||
# ClawSec: AI 에이전트를 위한 보안 스킬 스위트
|
||||
|
||||
> 한국어 번역 (초기 버전)
|
||||
|
||||
## 🌍 번역
|
||||
- English (source of truth): [README.md](README.md)
|
||||
- Español: [README.es.md](README.es.md)
|
||||
- 한국어: `README.ko.md`
|
||||
|
||||
## ✅ 번역 상태 (Korean Phase 1)
|
||||
이 한국어 문서는 핵심 온보딩/운영 흐름을 우선 제공합니다.
|
||||
고급 스키마, 전체 CI/CD 세부사항, 최신 기준 문서는 영어 README를 참고하세요.
|
||||
|
||||
## 🦞 ClawSec란?
|
||||
ClawSec은 **OpenClaw, NanoClaw, Hermes, Picoclaw 같은 AI 에이전트 플랫폼용 종합 보안 스킬 스위트**입니다.
|
||||
프롬프트 인젝션, 드리프트, 악성 지시로부터 에이전트 동작을 보호하기 위해
|
||||
통합 보안 모니터링, 무결성 검증, 위협 인텔리전스를 제공합니다.
|
||||
|
||||
## 🚀 빠른 시작
|
||||
|
||||
### AI 에이전트용
|
||||
```bash
|
||||
npx clawhub@latest install clawsec-suite
|
||||
```
|
||||
|
||||
설치 후 ClawSec 스위트는 다음을 수행할 수 있습니다:
|
||||
1. 공개 스킬 카탈로그에서 설치 가능한 보호 기능 탐색
|
||||
2. 서명된 체크섬을 통한 릴리스 무결성 검증
|
||||
3. advisory 모니터링 및 훅 기반 보호 흐름 설정
|
||||
4. 선택적 스케줄 점검 추가
|
||||
|
||||
### 사람 운영자용
|
||||
에이전트에게 다음 지시를 전달하세요:
|
||||
|
||||
· `npx clawhub@latest install clawsec-suite`로 ClawSec을 설치 한 다음 생성 된 지침에서 설정 단계를 완료하십시오.
|
||||
|
||||
## 🧭 위키 문서
|
||||
플랫폼/스위트 상세 문서는 wiki 모듈을 참고하세요:
|
||||
- [wiki/modules/clawsec-suite.md](wiki/modules/clawsec-suite.md)
|
||||
- [wiki/modules/nanoclaw-integration.md](wiki/modules/nanoclaw-integration.md)
|
||||
- [wiki/modules/hermes-attestation-guardian.md](wiki/modules/hermes-attestation-guardian.md)
|
||||
- [wiki/modules/picoclaw-security-guardian.md](wiki/modules/picoclaw-security-guardian.md)
|
||||
|
||||
## 📡 보안 advisory 피드
|
||||
정식 엔드포인트:
|
||||
- `https://clawsec.prompt.security/advisories/feed.json`
|
||||
|
||||
## 🛠️ 로컬 개발
|
||||
```bash
|
||||
npm install
|
||||
./scripts/populate-local-skills.sh
|
||||
./scripts/populate-local-feed.sh --days 120
|
||||
npm run gen:wiki-llms
|
||||
npm run dev
|
||||
```
|
||||
|
||||
## 📄 라이선스
|
||||
- Source code: GNU AGPL v3.0 or later — [LICENSE](LICENSE)
|
||||
- Font assets: [`font/README.md`](font/README.md)
|
||||
@@ -1,433 +0,0 @@
|
||||
<h1 align="center">
|
||||
<img src="./img/prompt-icon.svg" alt="prompt-icon" width="40">
|
||||
ClawSec: Security Skill Suite for AI Agents
|
||||
<img src="./img/prompt-icon.svg" alt="prompt-icon" width="40">
|
||||
</h1>
|
||||
|
||||
<div align="center">
|
||||
|
||||
## Secure Your OpenClaw, NanoClaw, and Hermes Agents with a Complete Security Skill Suite
|
||||
|
||||
<h4>Brought to you by <a href="https://prompt.security">Prompt Security</a>, the Platform for AI Security</h4>
|
||||
|
||||
</div>
|
||||
|
||||
<div align="center">
|
||||
|
||||
|
||||
<img src="./public/img/mascot.png" alt="clawsec mascot" width="200" />
|
||||
|
||||
</div>
|
||||
<div align="center">
|
||||
|
||||
🌐 **Live at: [https://clawsec.prompt.security](https://clawsec.prompt.security) [https://prompt.security/clawsec](https://prompt.security/clawsec)**
|
||||
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/ci.yml)
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/deploy-pages.yml)
|
||||
[](https://github.com/prompt-security/clawsec/actions/workflows/poll-nvd-cves.yml)
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
## 🌍 Translations
|
||||
|
||||
[Deutsch](README.de.md) | [Español](README.es.md) | [Français](README.fr.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | **English**
|
||||
|
||||
Wiki indexes: [DE](wiki/de/INDEX.md) · [ES](wiki/es/INDEX.md) · [FR](wiki/fr/INDEX.md) · [JA](wiki/ja/INDEX.md) · [KO](wiki/ko/INDEX.md) · [EN](wiki/INDEX.md)
|
||||
|
||||
## 🦞 What is ClawSec?
|
||||
|
||||
ClawSec is a **complete security skill suite for AI agent platforms**. It provides unified security monitoring, integrity verification, and threat intelligence-protecting your agent's cognitive architecture against prompt injection, drift, and malicious instructions.
|
||||
|
||||
### Supported Platforms
|
||||
|
||||
- **OpenClaw** (MoltBot, Clawdbot, and clones) - Full suite with skill installer, file integrity protection, and security audits
|
||||
- **NanoClaw** - Containerized WhatsApp bot security with MCP tools for advisory monitoring, signature verification, and file integrity
|
||||
- **Hermes** - Hermes-native security skills for signed advisory feed verification, advisory-aware guarded verification, deterministic attestation generation, fail-closed verification, and baseline drift detection
|
||||
- **Picoclaw** - Lightweight AI gateway security posture checks with advisory awareness, config drift detection, release-artifact verification, and an optional separate self-pen-testing package
|
||||
|
||||
### Skill Feature Matrix
|
||||
|
||||
| Skill name | supported platform| security feed verification| config drift | agent self pen testing| supply-chain install verification | runtime traffic monitoring |
|
||||
|---|---|---|---|---|---|---|
|
||||
| claw-release | OpenClaw | No | No | No | Yes | No |
|
||||
| clawsec-clawhub-checker | OpenClaw + clawsec-suite integration | No | No | No | Yes | No |
|
||||
| clawsec-feed | OpenClaw | Yes | No | No | Yes | No |
|
||||
| clawsec-nanoclaw | NanoClaw | Yes | Yes | Yes | Yes | No |
|
||||
| clawsec-scanner | OpenClaw | Yes | No | Yes | Yes | No |
|
||||
| clawsec-suite | OpenClaw | Yes | Yes | No | Yes | No |
|
||||
| clawtributor | All core platforms | No | No | No | No | No |
|
||||
| hermes-attestation-guardian | Hermes | Yes (signed advisory feed verification) | Yes | No | Limited (advisory preflight gating only; no artifact signature/provenance install verification) | No |
|
||||
| hermes-traffic-guardian | Hermes | No | Planned posture export only | No | No | Spec baseline |
|
||||
| nanoclaw-traffic-guardian | NanoClaw | No | No | No | No | Spec baseline |
|
||||
| openclaw-audit-watchdog | OpenClaw | No | No | Yes | No | No |
|
||||
| openclaw-traffic-guardian | OpenClaw | No | No | No | No | Spec baseline |
|
||||
| picoclaw-security-guardian | Picoclaw | Yes | Yes | No | Yes | No |
|
||||
| picoclaw-self-pen-testing | Picoclaw | No | No | Yes | No | No |
|
||||
| picoclaw-traffic-guardian | Picoclaw | No | Planned profile export only | No | No | Spec baseline |
|
||||
| soul-guardian | OpenClaw | No | Yes | No | No | No |
|
||||
|
||||
`Spec baseline` means the skill folder, metadata, frontmatter, and implementation contract exist, but runtime proxy code is intentionally left for platform-specific builders.
|
||||
|
||||
### Core Capabilities
|
||||
|
||||
- **📦 Suite Installer** - One-command installation of all security skills with integrity verification
|
||||
- **🛡️ File Integrity Protection** - Drift detection and auto-restore for critical agent files (SOUL.md, IDENTITY.md, etc.)
|
||||
- **📡 Live Security Advisories** - Automated NVD CVE polling and community threat intelligence
|
||||
- **🔍 Security Audits** - Self-check scripts to detect prompt injection markers and vulnerabilities
|
||||
- **🔐 Checksum Verification** - SHA256 checksums for all skill artifacts
|
||||
- **Runtime Traffic Monitoring Baselines** - Platform-specific specs for opt-in proxy inspection, exfiltration detection, and inbound injection detection
|
||||
- **Health Checks** - Automated updates and integrity verification for all installed skills
|
||||
|
||||
---
|
||||
|
||||
## 🎬 Product Demos
|
||||
|
||||
Animated previews below are GIFs (no audio). Click any preview to open the full MP4 with audio.
|
||||
|
||||
### Install Demo (`clawsec-suite`)
|
||||
|
||||
[](public/video/install-demo.mp4)
|
||||
|
||||
Direct link: [install-demo.mp4](public/video/install-demo.mp4)
|
||||
|
||||
### Drift Detection Demo (`soul-guardian`)
|
||||
|
||||
[](public/video/soul-guardian-demo.mp4)
|
||||
|
||||
Direct link: [soul-guardian-demo.mp4](public/video/soul-guardian-demo.mp4)
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Quick Start
|
||||
|
||||
### For AI Agents
|
||||
|
||||
```bash
|
||||
# Install the ClawSec security suite
|
||||
npx clawhub@latest install clawsec-suite
|
||||
```
|
||||
|
||||
After install, the suite can:
|
||||
1. Discover installable protections from the published skills catalog
|
||||
2. Verify release integrity using signed checksums
|
||||
3. Set up advisory monitoring and hook-based protection flows
|
||||
4. Add optional scheduled checks
|
||||
|
||||
Manual/source-first option:
|
||||
|
||||
> Read https://github.com/prompt-security/clawsec/releases/latest/download/SKILL.md and follow the installation instructions.
|
||||
|
||||
### For Humans
|
||||
|
||||
Copy this instruction to your AI agent:
|
||||
|
||||
> Install ClawSec with `npx clawhub@latest install clawsec-suite`, then complete the setup steps from the generated instructions.
|
||||
|
||||
### Shell and OS Notes
|
||||
|
||||
ClawSec scripts are split between:
|
||||
- Cross-platform Node/Python tooling (`npm run build`, hook/setup `.mjs`, `utils/*.py`)
|
||||
- POSIX shell workflows (`*.sh`, most manual install snippets)
|
||||
|
||||
For Linux/macOS (`bash`/`zsh`):
|
||||
- Use unquoted or double-quoted home vars: `export INSTALL_ROOT="$HOME/.openclaw/skills"`
|
||||
- Do **not** single-quote expandable vars (for example, avoid `'$HOME/.openclaw/skills'`)
|
||||
|
||||
For Windows (PowerShell):
|
||||
- Prefer explicit path building:
|
||||
- `$env:INSTALL_ROOT = Join-Path $HOME ".openclaw\\skills"`
|
||||
- `node "$env:INSTALL_ROOT\\clawsec-suite\\scripts\\setup_advisory_hook.mjs"`
|
||||
- POSIX `.sh` scripts require WSL or Git Bash.
|
||||
|
||||
Troubleshooting: if you see directories such as `~/.openclaw/workspace/$HOME/...`, a home variable was passed literally. Re-run using an absolute path or an unquoted home expression.
|
||||
|
||||
---
|
||||
|
||||
## 🧭 Platform & Suite Documentation
|
||||
|
||||
Detailed platform and suite docs live in the wiki modules:
|
||||
- NanoClaw: [wiki/modules/nanoclaw-integration.md](wiki/modules/nanoclaw-integration.md)
|
||||
- Hermes: [wiki/modules/hermes-attestation-guardian.md](wiki/modules/hermes-attestation-guardian.md)
|
||||
- Picoclaw: [wiki/modules/picoclaw-security-guardian.md](wiki/modules/picoclaw-security-guardian.md)
|
||||
- Picoclaw self-pen-testing: [wiki/modules/picoclaw-self-pen-testing.md](wiki/modules/picoclaw-self-pen-testing.md)
|
||||
- ClawSec Suite (OpenClaw): [wiki/modules/clawsec-suite.md](wiki/modules/clawsec-suite.md)
|
||||
- CI/CD pipelines: [wiki/modules/automation-release.md](wiki/modules/automation-release.md)
|
||||
|
||||
Quick install links:
|
||||
- NanoClaw install: [skills/clawsec-nanoclaw/INSTALL.md](skills/clawsec-nanoclaw/INSTALL.md)
|
||||
- Hermes skill package: `skills/hermes-attestation-guardian/`
|
||||
- Picoclaw guardian package: `skills/picoclaw-security-guardian/`
|
||||
- Picoclaw self-pen-testing package: `skills/picoclaw-self-pen-testing/`
|
||||
- Suite package: `skills/clawsec-suite/`
|
||||
|
||||
---
|
||||
|
||||
## 📡 Security Advisory Feed
|
||||
|
||||
ClawSec maintains a continuously updated security advisory feed, automatically populated from NIST's National Vulnerability Database (NVD).
|
||||
|
||||
### Feed URL
|
||||
|
||||
```bash
|
||||
# Fetch latest advisories
|
||||
curl -s https://clawsec.prompt.security/advisories/feed.json | jq '.advisories[] | select(.severity == "critical" or .severity == "high")'
|
||||
```
|
||||
|
||||
Canonical endpoint: `https://clawsec.prompt.security/advisories/feed.json`
|
||||
Compatibility mirror (legacy): `https://clawsec.prompt.security/releases/latest/download/feed.json`
|
||||
|
||||
### Monitored Keywords
|
||||
|
||||
The feed polls CVEs related to:
|
||||
- **OpenClaw Platform**: `OpenClaw`, `clawdbot`, `Moltbot`
|
||||
- **NanoClaw Platform**: `NanoClaw`, `WhatsApp-bot`, `baileys`
|
||||
- **Picoclaw Platform**: `Picoclaw`, `picoclaw`, lightweight AI gateways, MCP gateway exposure
|
||||
- Prompt injection patterns
|
||||
- Agent security vulnerabilities
|
||||
|
||||
### Exploitability Context
|
||||
|
||||
ClawSec enriches CVE advisories with **exploitability context** to help agents assess real-world risk beyond raw CVSS scores. Newly analyzed advisories can include:
|
||||
|
||||
- **Exploit Evidence**: Whether public exploits exist in the wild
|
||||
- **Weaponization Status**: If exploits are integrated into common attack frameworks
|
||||
- **Attack Requirements**: Prerequisites needed for successful exploitation (network access, authentication, user interaction)
|
||||
- **Risk Assessment**: Contextualized risk level combining technical severity with exploitability
|
||||
|
||||
This feature helps agents prioritize vulnerabilities that pose immediate threats versus theoretical risks, enabling smarter security decisions.
|
||||
|
||||
### Advisory Schema
|
||||
|
||||
**NVD CVE Advisory:**
|
||||
```json
|
||||
{
|
||||
"id": "CVE-2026-XXXXX",
|
||||
"severity": "critical|high|medium|low",
|
||||
"type": "vulnerable_skill",
|
||||
"platforms": ["openclaw", "nanoclaw"],
|
||||
"title": "Short description",
|
||||
"description": "Full CVE description from NVD",
|
||||
"published": "2026-02-01T00:00:00Z",
|
||||
"cvss_score": 8.8,
|
||||
"nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-XXXXX",
|
||||
"exploitability_score": "high|medium|low|unknown",
|
||||
"exploitability_rationale": "Why this CVE is or is not likely exploitable in agent deployments",
|
||||
"references": ["..."],
|
||||
"action": "Recommended remediation"
|
||||
}
|
||||
```
|
||||
|
||||
**Community Advisory:**
|
||||
```json
|
||||
{
|
||||
"id": "CLAW-2026-0042",
|
||||
"severity": "high",
|
||||
"type": "prompt_injection|vulnerable_skill|tampering_attempt",
|
||||
"platforms": ["nanoclaw"],
|
||||
"title": "Short description",
|
||||
"description": "Detailed description from issue",
|
||||
"published": "2026-02-01T00:00:00Z",
|
||||
"affected": ["skill-name@1.0.0"],
|
||||
"source": "Community Report",
|
||||
"github_issue_url": "https://github.com/.../issues/42",
|
||||
"action": "Recommended remediation"
|
||||
}
|
||||
```
|
||||
|
||||
**Platform values:**
|
||||
- `"openclaw"` - OpenClaw/Clawdbot/MoltBot only
|
||||
- `"nanoclaw"` - NanoClaw only
|
||||
- `"hermes"` - Hermes only
|
||||
- `"picoclaw"` - Picoclaw only
|
||||
- `["openclaw", "nanoclaw", "hermes", "picoclaw"]` - All core platforms
|
||||
- (empty/missing) - All platforms (backward compatible)
|
||||
|
||||
---
|
||||
|
||||
## 🔄 CI/CD Pipelines
|
||||
|
||||
CI/CD pipeline details were moved to the wiki module page:
|
||||
- [wiki/modules/automation-release.md](wiki/modules/automation-release.md)
|
||||
|
||||
Related operations docs:
|
||||
- [wiki/security-signing-runbook.md](wiki/security-signing-runbook.md)
|
||||
- [wiki/migration-signed-feed.md](wiki/migration-signed-feed.md)
|
||||
|
||||
---
|
||||
|
||||
## 🛠️ Offline Tools
|
||||
|
||||
ClawSec includes Python utilities for local skill development and validation.
|
||||
|
||||
### Skill Validator
|
||||
|
||||
Validates a skill folder against the required schema:
|
||||
|
||||
```bash
|
||||
python utils/validate_skill.py skills/clawsec-feed
|
||||
```
|
||||
|
||||
Checks:
|
||||
- `skill.json` exists and is valid JSON
|
||||
- Required fields present (name, version, description, author, license)
|
||||
- SBOM files exist and are readable
|
||||
- OpenClaw metadata is properly structured
|
||||
|
||||
### Skill Checksums Generator
|
||||
|
||||
Generates `checksums.json` with SHA256 hashes for a skill:
|
||||
|
||||
```bash
|
||||
python utils/package_skill.py skills/clawsec-feed ./dist
|
||||
```
|
||||
|
||||
Outputs:
|
||||
- `checksums.json` - SHA256 hashes for verification
|
||||
|
||||
---
|
||||
|
||||
## 🛠️ Local Development
|
||||
|
||||
### Prerequisites
|
||||
|
||||
- Node.js 20+
|
||||
- Python 3.10+ (for offline tools)
|
||||
- npm
|
||||
|
||||
### Setup
|
||||
|
||||
```bash
|
||||
# Install dependencies
|
||||
npm install
|
||||
|
||||
# Start development server
|
||||
npm run dev
|
||||
```
|
||||
|
||||
### Populate Local Data
|
||||
|
||||
```bash
|
||||
# Populate skills catalog from local skills/ directory
|
||||
./scripts/populate-local-skills.sh
|
||||
|
||||
# Populate advisory feed with real NVD CVE data
|
||||
./scripts/populate-local-feed.sh --days 120
|
||||
|
||||
# Generate wiki llms exports from wiki/ (for local preview)
|
||||
./scripts/populate-local-wiki.sh
|
||||
|
||||
# Direct generator entrypoint (used by predev/prebuild)
|
||||
npm run gen:wiki-llms
|
||||
```
|
||||
|
||||
Notes:
|
||||
- `npm run dev` and `npm run build` automatically regenerate wiki `llms.txt` exports (`predev`/`prebuild` hooks).
|
||||
- `public/wiki/` is generated output (local + CI) and is intentionally gitignored.
|
||||
|
||||
### Build
|
||||
|
||||
```bash
|
||||
npm run build
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📁 Project Structure
|
||||
|
||||
```
|
||||
├── advisories/
|
||||
│ ├── feed.json # Main advisory feed
|
||||
│ ├── feed.json.sig # Detached signature for feed.json
|
||||
│ └── feed-signing-public.pem # Public key for feed verification
|
||||
├── components/ # React components
|
||||
├── pages/ # Route/page components
|
||||
├── wiki/ # Source-of-truth docs (synced to GitHub Wiki)
|
||||
├── scripts/
|
||||
│ ├── generate-wiki-llms.mjs # wiki/*.md -> public/wiki/**/llms.txt
|
||||
│ ├── populate-local-feed.sh # Local CVE feed populator
|
||||
│ ├── populate-local-skills.sh # Local skills catalog populator
|
||||
│ ├── populate-local-wiki.sh # Local wiki llms export populator
|
||||
│ ├── prepare-to-push.sh # Local CI-style quality gate
|
||||
│ ├── validate-release-links.sh # Release link checks
|
||||
│ └── release-skill.sh # Manual skill release helper
|
||||
├── skills/
|
||||
│ ├── claw-release/ # 🚀 Release automation workflow skill
|
||||
│ ├── clawsec-suite/ # 📦 Suite installer (skill-of-skills)
|
||||
│ ├── clawsec-feed/ # 📡 Advisory feed skill
|
||||
│ ├── clawsec-scanner/ # 🔍 Vulnerability scanner (deps + SAST + OpenClaw DAST)
|
||||
│ ├── clawsec-nanoclaw/ # 📱 NanoClaw platform security suite
|
||||
│ ├── clawsec-clawhub-checker/ # 🧪 ClawHub reputation checks
|
||||
│ ├── clawtributor/ # 🤝 Community reporting skill
|
||||
│ ├── hermes-attestation-guardian/ # 🛡️ Hermes attestation + drift verification
|
||||
│ ├── openclaw-audit-watchdog/ # 🔭 Automated audit skill
|
||||
│ ├── picoclaw-security-guardian/ # 🦐 Picoclaw posture/advisory/drift/supply-chain checks
|
||||
│ ├── picoclaw-self-pen-testing/ # 🧪 Picoclaw self-pen-testing checks (separate package)
|
||||
│ └── soul-guardian/ # 👻 File integrity skill
|
||||
├── utils/
|
||||
│ ├── package_skill.py # Skill packager utility
|
||||
│ └── validate_skill.py # Skill validator utility
|
||||
├── .github/workflows/
|
||||
│ ├── ci.yml # Cross-platform lint/type/build + tests
|
||||
│ ├── pages-verify.yml # PR-only pages build/signing verification
|
||||
│ ├── poll-nvd-cves.yml # CVE polling pipeline
|
||||
│ ├── community-advisory.yml # Approved issue -> advisory PR
|
||||
│ ├── skill-release.yml # Skill release/signing pipeline
|
||||
│ ├── deploy-pages.yml # GitHub Pages deployment
|
||||
│ ├── wiki-sync.yml # Sync repo wiki/ to GitHub Wiki
|
||||
│ ├── codeql.yml # CodeQL security analysis
|
||||
│ └── scorecard.yml # OpenSSF Scorecard checks
|
||||
└── public/ # Static assets + generated wiki exports
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🤝 Contributing
|
||||
|
||||
We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
|
||||
|
||||
### Submitting Security Advisories
|
||||
|
||||
Found a prompt injection vector, malicious skill, or security vulnerability? Report it via GitHub Issues:
|
||||
|
||||
1. Open a new issue using the **Security Incident Report** template
|
||||
2. Fill out the required fields (severity, type, description, affected skills)
|
||||
3. A maintainer will review and add the `advisory-approved` label
|
||||
4. The advisory is automatically published to the feed as `CLAW-{YEAR}-{ISSUE#}`
|
||||
|
||||
See [CONTRIBUTING.md](CONTRIBUTING.md#submitting-security-advisories) for detailed guidelines.
|
||||
|
||||
### Adding New Skills
|
||||
|
||||
1. Create a skill folder under `skills/`
|
||||
2. Add `skill.json` with required metadata and SBOM
|
||||
3. Add `SKILL.md` with agent-readable instructions
|
||||
4. Validate with `python utils/validate_skill.py skills/your-skill`
|
||||
5. Submit a PR for review
|
||||
|
||||
## 📚 Documentation Source of Truth
|
||||
|
||||
For all wiki content, edit files under `wiki/` in this repository. The GitHub Wiki (`<repo>.wiki.git`) is synced from `wiki/` by `.github/workflows/wiki-sync.yml` when `wiki/**` changes on `main`.
|
||||
|
||||
LLM exports are generated from `wiki/` into `public/wiki/`:
|
||||
- `/wiki/llms.txt` is the LLM-ready export for `wiki/INDEX.md` (or a generated fallback index if `INDEX.md` is missing).
|
||||
- `/wiki/<page>/llms.txt` is the LLM-ready export for that single wiki page.
|
||||
|
||||
---
|
||||
|
||||
## 📄 License
|
||||
|
||||
- Source code: GNU AGPL v3.0 or later - See [LICENSE](LICENSE) for details.
|
||||
- Fonts in `font/`: Licensed separately - See [`font/README.md`](font/README.md).
|
||||
|
||||
---
|
||||
|
||||
<div align="center">
|
||||
|
||||
**ClawSec** · Prompt Security, SentinelOne
|
||||
|
||||
🦞 Hardening agentic workflows, one skill at a time.
|
||||
|
||||
</div>
|
||||
-42
@@ -1,42 +0,0 @@
|
||||
# Security Policy
|
||||
|
||||
## Supported Versions
|
||||
|
||||
ClawSec follows a strict release lifecycle where **only the latest version within each major version** is retained and supported.
|
||||
|
||||
When a new patch or minor version is released (e.g., updating from `1.0.0` to `1.0.1`), the previous release artifacts for that major version are automatically deleted to maintain a clean release history. Major versions co-exist for backwards compatibility.
|
||||
|
||||
| Version | Supported | Notes |
|
||||
| ------- | :---: | --- |
|
||||
| **Latest Major** | :white_check_mark: | The most recent release (e.g., `v1.x.x`) is fully supported. |
|
||||
| **Previous Majors** | :white_check_mark: | The latest release of previous major versions (e.g., `v0.x.x`) remains available. |
|
||||
| **Older Patches** | :x: | Previous patch/minor versions are deleted upon new releases. |
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
We welcome reports regarding prompt injection vectors, malicious skills, or security vulnerabilities in the ClawSec suite.
|
||||
|
||||
### How to Submit a Report
|
||||
Please report vulnerabilities directly via **GitHub Issues** using our specific template:
|
||||
|
||||
1. Navigate to the **Issues** tab.
|
||||
2. Open a new issue using the **Security Incident Report** template.
|
||||
3. Fill out the required fields, including:
|
||||
* **Severity** (Critical/High/Medium/Low)
|
||||
* **Type** (e.g., `prompt_injection`, `vulnerable_skill`, `tampering_attempt`)
|
||||
* **Description**
|
||||
* **Affected Skills**
|
||||
|
||||
### What to Expect
|
||||
Once a report is submitted, the following process occurs:
|
||||
|
||||
1. **Review:** A maintainer will review your report.
|
||||
2. **Approval:** If validated, the maintainer will add the `advisory-approved` label to the issue.
|
||||
3. **Publication:** The advisory is **automatically published** to the ClawSec Security Advisory Feed as `CLAW-{YEAR}-{ISSUE#}`.
|
||||
4. **Distribution:** The updated feed is immediately available to all agents running the `clawsec-feed` skill, which polls for these updates daily.
|
||||
|
||||
### Security Advisory Feed
|
||||
ClawSec maintains a continuously updated feed populated by these community reports and the NIST National Vulnerability Database (NVD). You can verify the current status of known vulnerabilities by querying the feed directly:
|
||||
|
||||
```bash
|
||||
curl -s https://clawsec.prompt.security/advisories/feed.json
|
||||
@@ -1,3 +0,0 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MCowBQYDK2VwAyEAS7nijfMcUoOBCj4yOXJX+GYGv2pFl2Yaha1P4v5Cm6A=
|
||||
-----END PUBLIC KEY-----
|
||||
-24275
File diff suppressed because one or more lines are too long
@@ -1 +0,0 @@
|
||||
agiAAFvzM1vNHxH2+bGtyeKqFScLWJHnNreBcPpTODUqD0xqFi0cnyP/ZaZX+Rsw1Y9uZ7pGdFdA93pD4lh2BQ==
|
||||
File diff suppressed because one or more lines are too long
@@ -1 +0,0 @@
|
||||
q1EyZ75QcdG2X6FVDkUoAyBtQE3ONA+7k9cmNFmXFgOOuGRPOpSDFUtbSvy86HPqnii26DMoeFJ1hatWJ0lBCQ==
|
||||
@@ -1,3 +0,0 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MCowBQYDK2VwAyEAS7nijfMcUoOBCj4yOXJX+GYGv2pFl2Yaha1P4v5Cm6A=
|
||||
-----END PUBLIC KEY-----
|
||||
@@ -1,108 +0,0 @@
|
||||
import React from 'react';
|
||||
import { Link } from 'react-router-dom';
|
||||
import { ExternalLink, Github } from 'lucide-react';
|
||||
import { Advisory } from '../types';
|
||||
import { AdvisoryPlatformBadge } from './AdvisoryPlatformBadge';
|
||||
|
||||
interface AdvisoryCardProps {
|
||||
advisory: Advisory;
|
||||
formatDate: (dateStr: string) => string;
|
||||
}
|
||||
|
||||
export const AdvisoryCard: React.FC<AdvisoryCardProps> = ({ advisory, formatDate }) => {
|
||||
const getSeverityClasses = (severity: string) => {
|
||||
switch (severity) {
|
||||
case 'critical':
|
||||
return 'bg-red-500/20 text-red-400';
|
||||
case 'high':
|
||||
return 'bg-orange-500/20 text-orange-400';
|
||||
case 'medium':
|
||||
return 'bg-yellow-500/20 text-yellow-400';
|
||||
default:
|
||||
return 'bg-blue-500/20 text-blue-400';
|
||||
}
|
||||
};
|
||||
|
||||
const getTypeLabel = (type: string) => {
|
||||
switch (type) {
|
||||
case 'malicious_skill':
|
||||
return 'Malicious Skill';
|
||||
case 'vulnerable_skill':
|
||||
return 'Vulnerable Skill';
|
||||
case 'prompt_injection':
|
||||
return 'Prompt Injection';
|
||||
case 'attack_pattern':
|
||||
return 'Attack Pattern';
|
||||
case 'best_practice':
|
||||
return 'Best Practice';
|
||||
case 'tampering_attempt':
|
||||
return 'Tampering Attempt';
|
||||
default:
|
||||
return type;
|
||||
}
|
||||
};
|
||||
|
||||
// Determine if this is a community report (has github_issue_url) or NVD/staff advisory
|
||||
const isCommunityReport = !!advisory.github_issue_url;
|
||||
|
||||
return (
|
||||
<Link
|
||||
to={`/feed/${encodeURIComponent(advisory.id)}`}
|
||||
className="block h-full bg-clawd-800 border border-clawd-700 rounded-xl p-5 hover:border-clawd-accent/30 transition-all group cursor-pointer"
|
||||
>
|
||||
<div className="grid grid-cols-[minmax(0,1fr)_auto] items-start gap-x-2 gap-y-2 mb-3">
|
||||
<div className="flex min-w-0 flex-wrap gap-2">
|
||||
<span className={`text-xs font-bold px-2 py-1 rounded uppercase ${getSeverityClasses(advisory.severity)}`}>
|
||||
{advisory.severity}
|
||||
{advisory.cvss_score && <span className="ml-1 opacity-75">({advisory.cvss_score})</span>}
|
||||
</span>
|
||||
<span className="text-xs px-2 py-1 rounded bg-clawd-700 text-gray-400 min-w-0 max-w-full truncate">
|
||||
{getTypeLabel(advisory.type)}
|
||||
</span>
|
||||
</div>
|
||||
<span className="text-xs text-gray-500 font-mono text-right whitespace-nowrap">{formatDate(advisory.published)}</span>
|
||||
</div>
|
||||
<h3 className="text-white font-bold mb-2 group-hover:text-clawd-accent transition-colors text-sm">
|
||||
{advisory.id}
|
||||
</h3>
|
||||
<p className="text-sm text-gray-400 line-clamp-3 mb-3">{advisory.title}</p>
|
||||
|
||||
{advisory.platforms && advisory.platforms.length > 0 && (
|
||||
<div className="mb-3 flex flex-wrap gap-1.5">
|
||||
{advisory.platforms.map((platform) => (
|
||||
<AdvisoryPlatformBadge
|
||||
key={`${advisory.id}-${platform}`}
|
||||
platform={platform}
|
||||
className="text-[11px] px-2 py-0.5 rounded"
|
||||
/>
|
||||
))}
|
||||
</div>
|
||||
)}
|
||||
|
||||
{/* External link - stop propagation to allow clicking without navigating to detail */}
|
||||
{isCommunityReport && advisory.github_issue_url ? (
|
||||
<span
|
||||
onClick={(e) => {
|
||||
e.preventDefault();
|
||||
e.stopPropagation();
|
||||
window.open(advisory.github_issue_url, '_blank', 'noopener,noreferrer');
|
||||
}}
|
||||
className="inline-flex items-center gap-1 text-xs text-clawd-accent hover:underline cursor-pointer"
|
||||
>
|
||||
View GitHub Report <Github size={12} />
|
||||
</span>
|
||||
) : advisory.nvd_url ? (
|
||||
<span
|
||||
onClick={(e) => {
|
||||
e.preventDefault();
|
||||
e.stopPropagation();
|
||||
window.open(advisory.nvd_url, '_blank', 'noopener,noreferrer');
|
||||
}}
|
||||
className="inline-flex items-center gap-1 text-xs text-clawd-accent hover:underline cursor-pointer"
|
||||
>
|
||||
View on NVD <ExternalLink size={12} />
|
||||
</span>
|
||||
) : null}
|
||||
</Link>
|
||||
);
|
||||
};
|
||||
@@ -1,19 +0,0 @@
|
||||
import React from 'react';
|
||||
import { getPlatformDescriptor } from '../utils/advisoryPlatforms';
|
||||
|
||||
interface AdvisoryPlatformBadgeProps {
|
||||
platform: string;
|
||||
className?: string;
|
||||
}
|
||||
|
||||
export const AdvisoryPlatformBadge: React.FC<AdvisoryPlatformBadgeProps> = ({
|
||||
platform,
|
||||
className,
|
||||
}) => {
|
||||
const { label, classes } = getPlatformDescriptor(platform);
|
||||
const badgeClasses = ['uppercase tracking-wide', classes, className]
|
||||
.filter(Boolean)
|
||||
.join(' ');
|
||||
|
||||
return <span className={badgeClasses}>{label}</span>;
|
||||
};
|
||||
@@ -1,40 +0,0 @@
|
||||
import React, { useState } from 'react';
|
||||
import { Copy, Check } from 'lucide-react';
|
||||
|
||||
interface CodeBlockProps {
|
||||
code: string;
|
||||
language?: string;
|
||||
label?: string;
|
||||
className?: string;
|
||||
}
|
||||
|
||||
export const CodeBlock: React.FC<CodeBlockProps> = ({ code, language = 'bash', label, className }) => {
|
||||
const [copied, setCopied] = useState(false);
|
||||
|
||||
const handleCopy = () => {
|
||||
navigator.clipboard.writeText(code);
|
||||
setCopied(true);
|
||||
setTimeout(() => setCopied(false), 2000);
|
||||
};
|
||||
|
||||
return (
|
||||
<div className={`my-4 rounded-lg overflow-hidden border border-clawd-700 bg-clawd-800 shadow-xl ${className || ''}`}>
|
||||
<div className="flex items-center justify-between px-4 py-2 bg-clawd-900 border-b border-clawd-700">
|
||||
<span className="text-xs font-mono text-gray-400 uppercase">{label || language}</span>
|
||||
<button
|
||||
onClick={handleCopy}
|
||||
className="flex items-center gap-1 text-xs text-gray-400 hover:text-white transition-colors"
|
||||
aria-label="Copy code"
|
||||
>
|
||||
{copied ? <Check size={14} className="text-green-400" /> : <Copy size={14} />}
|
||||
{copied ? 'Copied' : 'Copy'}
|
||||
</button>
|
||||
</div>
|
||||
<div className="p-3 sm:p-4 overflow-x-auto max-w-full">
|
||||
<pre className="text-xs sm:text-sm font-mono text-gray-300 whitespace-pre-wrap break-all overflow-wrap-anywhere">
|
||||
<code>{code}</code>
|
||||
</pre>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
};
|
||||
@@ -1,14 +0,0 @@
|
||||
import React from 'react';
|
||||
|
||||
export const Footer: React.FC = () => {
|
||||
return (
|
||||
<footer className="text-center py-6 mt-auto">
|
||||
<p className="text-gray-300 text-sm italic">
|
||||
ClawSec is a project by Prompt Security, a SentinelOne company. It's not affiliated with OpenClaw or NanoClaw. Designed for security research and agentic workflow hardening.
|
||||
</p>
|
||||
<div className="flex justify-center gap-4 mt-4">
|
||||
<span className="text-2xl animate-pulse">🦞</span>
|
||||
</div>
|
||||
</footer>
|
||||
);
|
||||
};
|
||||
@@ -1,115 +0,0 @@
|
||||
import React, { useState } from 'react';
|
||||
import { NavLink } from 'react-router-dom';
|
||||
import { Menu, X, Terminal, Layers, Rss, Home, Github, BookOpenText, PlayCircle } from 'lucide-react';
|
||||
|
||||
export const Header: React.FC = () => {
|
||||
const [isOpen, setIsOpen] = useState(false);
|
||||
|
||||
const navItems = [
|
||||
{ label: 'Home', path: '/', icon: Home },
|
||||
{ label: 'Skills', path: '/skills', icon: Layers },
|
||||
{ label: 'Security Feed', path: '/feed', icon: Rss },
|
||||
{ label: 'Product Demo', path: '/demo', icon: PlayCircle },
|
||||
{ label: 'Wiki', path: '/wiki', icon: BookOpenText },
|
||||
];
|
||||
|
||||
const baseLink =
|
||||
'flex items-center gap-3 px-3 py-2 rounded-lg text-sm font-medium transition-all';
|
||||
|
||||
const desktopNav = (
|
||||
<aside className="hidden md:flex w-64 flex-col border-r border-[#3a1f7a] bg-gradient-to-b from-[#26115d]/95 via-[#3a1f7a]/92 to-[#523899]/90 backdrop-blur-xl shadow-[20px_0_50px_rgba(0,0,0,0.35)] z-40 pt-[75px]">
|
||||
<nav className="overflow-y-auto px-4 pt-8 space-y-2">
|
||||
{navItems.map(({ label, path, icon: Icon }) => (
|
||||
<NavLink
|
||||
key={path}
|
||||
to={path}
|
||||
className={({ isActive }) =>
|
||||
`${baseLink} ${
|
||||
isActive
|
||||
? 'bg-white/10 text-white shadow-[0_10px_25px_rgba(0,0,0,0.25)] border border-white/10'
|
||||
: 'text-gray-400 hover:text-white hover:bg-white/5'
|
||||
}`
|
||||
}
|
||||
>
|
||||
<Icon className="w-4 h-4" />
|
||||
{label}
|
||||
</NavLink>
|
||||
))}
|
||||
|
||||
<a
|
||||
href="https://github.com/prompt-security/clawsec"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="mt-6 w-full inline-flex items-center justify-center gap-2 px-4 py-2 rounded-lg bg-clawd-accent text-[#27125d] font-semibold shadow-[0_12px_30px_rgba(255,162,63,0.35)] hover:bg-clawd-accentHover transition-colors"
|
||||
>
|
||||
<Terminal size={16} />
|
||||
GitHub
|
||||
</a>
|
||||
</nav>
|
||||
</aside>
|
||||
);
|
||||
|
||||
return (
|
||||
<>
|
||||
{desktopNav}
|
||||
|
||||
{/* Mobile top bar */}
|
||||
<header className="md:hidden fixed top-[72px] left-0 right-0 z-50 backdrop-blur-md bg-[#26115d]/92 border-b border-[#3a1f7a]">
|
||||
<div className="px-4 h-14 flex items-center justify-between">
|
||||
<NavLink to="/" className="flex items-center gap-2 text-white font-semibold text-lg">
|
||||
<img src="/img/favicon.ico" alt="" className="w-5 h-5 rounded-sm" />
|
||||
ClawSec
|
||||
</NavLink>
|
||||
<div className="flex items-center gap-3">
|
||||
<a
|
||||
href="https://github.com/prompt-security/clawsec"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="text-clawd-accent hover:text-clawd-accentHover transition-colors"
|
||||
aria-label="Open GitHub repository"
|
||||
>
|
||||
<Github size={21} />
|
||||
</a>
|
||||
<button
|
||||
className="text-gray-300 hover:text-white"
|
||||
onClick={() => setIsOpen(!isOpen)}
|
||||
aria-label="Toggle navigation"
|
||||
>
|
||||
{isOpen ? <X size={24} /> : <Menu size={24} />}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
{isOpen && (
|
||||
<div className="bg-[#26115d]/95 border-t border-[#3a1f7a] shadow-lg">
|
||||
<div className="flex flex-col p-4 space-y-3">
|
||||
{navItems.map(({ label, path, icon: Icon }) => (
|
||||
<NavLink
|
||||
key={path}
|
||||
to={path}
|
||||
onClick={() => setIsOpen(false)}
|
||||
className={({ isActive }) =>
|
||||
`${baseLink} ${
|
||||
isActive ? 'bg-white/10 text-white' : 'text-gray-400 hover:text-white hover:bg-white/5'
|
||||
}`
|
||||
}
|
||||
>
|
||||
<Icon className="w-4 h-4" />
|
||||
{label}
|
||||
</NavLink>
|
||||
))}
|
||||
<a
|
||||
href="https://github.com/prompt-security/clawsec"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="flex items-center justify-center gap-2 px-4 py-2 rounded-lg bg-clawd-accent text-[#27125d] font-semibold hover:bg-clawd-accentHover transition-colors"
|
||||
>
|
||||
<Terminal size={16} />
|
||||
GitHub
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
</header>
|
||||
</>
|
||||
);
|
||||
};
|
||||
@@ -1,19 +0,0 @@
|
||||
import React from 'react';
|
||||
import { Header } from './Header';
|
||||
import { LobsterBackground } from './LobsterBackground';
|
||||
|
||||
export const Layout: React.FC<{ children: React.ReactNode }> = ({ children }) => {
|
||||
return (
|
||||
<div className="min-h-screen font-sans text-slate-50 relative overflow-x-hidden w-full max-w-full">
|
||||
<LobsterBackground />
|
||||
<div className="relative z-10 flex min-h-screen w-full max-w-full">
|
||||
<Header />
|
||||
<main className="flex-1 min-w-0 px-4 sm:px-6 lg:px-10 pt-24 pb-20 md:pt-16 md:pb-12 overflow-x-hidden">
|
||||
<div className="max-w-6xl mx-auto w-full">
|
||||
{children}
|
||||
</div>
|
||||
</main>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
};
|
||||
@@ -1,24 +0,0 @@
|
||||
import React from 'react';
|
||||
|
||||
export const LobsterBackground: React.FC = () => {
|
||||
return (
|
||||
<div className="fixed inset-0 pointer-events-none z-0 overflow-hidden select-none">
|
||||
<div className="absolute inset-0 bg-gradient-to-r from-[#0d0720]/70 via-transparent to-transparent" />
|
||||
{/* Soft nebula glows */}
|
||||
<div className="absolute -top-20 -left-28 w-[38vw] h-[38vw] bg-[#8c6ae7] blur-[140px] opacity-35"></div>
|
||||
<div className="absolute top-[10%] right-[-10%] w-[42vw] h-[42vw] bg-[#523899] blur-[180px] opacity-30"></div>
|
||||
<div className="absolute bottom-[-12%] left-[15%] w-[48vw] h-[48vw] bg-[#26115d] blur-[200px] opacity-55"></div>
|
||||
<div className="absolute top-[40%] right-[20%] w-[35vw] h-[35vw] bg-[#3a1f7a] blur-[160px] opacity-28"></div>
|
||||
|
||||
{/* Angular motif inspired by Prompt "A" */}
|
||||
<div className="absolute right-[-5%] bottom-[10%] w-[59.8vw] h-[59.8vw] opacity-85">
|
||||
<img
|
||||
src="/img/prompt_line.svg"
|
||||
loading="lazy"
|
||||
alt=""
|
||||
className="w-full h-full object-contain"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
};
|
||||
@@ -1,62 +0,0 @@
|
||||
import React from 'react';
|
||||
import { Link } from 'react-router-dom';
|
||||
import { ArrowRight } from 'lucide-react';
|
||||
import type { SkillMetadata } from '../types';
|
||||
import { getPlatformDescriptor } from '../utils/advisoryPlatforms';
|
||||
|
||||
interface SkillCardProps {
|
||||
skill: SkillMetadata;
|
||||
}
|
||||
|
||||
export const SkillCard: React.FC<SkillCardProps> = ({ skill }) => {
|
||||
const platforms = Array.isArray(skill.platforms) ? skill.platforms.slice(0, 4) : [];
|
||||
|
||||
return (
|
||||
<Link
|
||||
to={`/skills/${skill.id}`}
|
||||
className="group block bg-clawd-800 border border-clawd-700 rounded-lg p-5 hover:border-clawd-accent/30 hover:bg-clawd-800/80 transition-all duration-200"
|
||||
>
|
||||
<div className="flex items-center gap-3 mb-3">
|
||||
<span className="text-2xl">{skill.emoji || '📦'}</span>
|
||||
<div>
|
||||
<h3 className="font-bold text-white group-hover:text-clawd-accent transition-colors">
|
||||
{skill.name}
|
||||
</h3>
|
||||
<span className="text-xs text-gray-500 font-mono">v{skill.version}</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p className="text-sm text-gray-400 mb-4 line-clamp-2">
|
||||
{skill.description}
|
||||
</p>
|
||||
|
||||
{platforms.length > 0 && (
|
||||
<div className="flex flex-wrap gap-1.5 mb-4" aria-label="Recommended platforms">
|
||||
{platforms.map((platform) => {
|
||||
const descriptor = getPlatformDescriptor(platform);
|
||||
|
||||
return (
|
||||
<span
|
||||
key={platform}
|
||||
className={`text-[11px] leading-none px-2 py-1 rounded-md ${descriptor.classes}`}
|
||||
>
|
||||
{descriptor.label}
|
||||
</span>
|
||||
);
|
||||
})}
|
||||
</div>
|
||||
)}
|
||||
|
||||
<div className="flex items-center justify-between">
|
||||
{/* Category badge - hidden for now, uncomment when we have multiple categories
|
||||
<span className="text-xs text-gray-500 bg-clawd-700 px-2 py-1 rounded">
|
||||
{skill.category || 'utility'}
|
||||
</span>
|
||||
*/}
|
||||
<span className="text-clawd-accent text-sm flex items-center gap-1 opacity-0 group-hover:opacity-100 transition-opacity ml-auto">
|
||||
View details <ArrowRight size={14} />
|
||||
</span>
|
||||
</div>
|
||||
</Link>
|
||||
);
|
||||
};
|
||||
@@ -1,9 +0,0 @@
|
||||
|
||||
// Canonical hosted feed endpoint for fetching live advisories
|
||||
export const ADVISORY_FEED_URL = 'https://clawsec.prompt.security/advisories/feed.json';
|
||||
|
||||
// Compatibility mirror for legacy clients; keep as last-resort fallback only
|
||||
export const LEGACY_ADVISORY_FEED_URL = 'https://clawsec.prompt.security/releases/latest/download/feed.json';
|
||||
|
||||
// Local feed path for development
|
||||
export const LOCAL_FEED_PATH = '/advisories/feed.json';
|
||||
@@ -1,119 +0,0 @@
|
||||
// NOTE: @eslint/js is pinned to ~9.x because v10 introduces a peerOptional
|
||||
// dependency on eslint@^10, and the typescript-eslint / react plugin ecosystem
|
||||
// hasn't published eslint-10-compatible releases yet. Upgrade @eslint/js to ^10
|
||||
// once @typescript-eslint and eslint-plugin-react declare eslint@^10 support.
|
||||
import js from '@eslint/js';
|
||||
import typescript from '@typescript-eslint/eslint-plugin';
|
||||
import typescriptParser from '@typescript-eslint/parser';
|
||||
import react from 'eslint-plugin-react';
|
||||
import reactHooks from 'eslint-plugin-react-hooks';
|
||||
|
||||
export default [
|
||||
js.configs.recommended,
|
||||
// TypeScript/React files
|
||||
{
|
||||
files: ['**/*.{ts,tsx}'],
|
||||
languageOptions: {
|
||||
parser: typescriptParser,
|
||||
parserOptions: {
|
||||
ecmaVersion: 'latest',
|
||||
sourceType: 'module',
|
||||
ecmaFeatures: { jsx: true }
|
||||
},
|
||||
globals: {
|
||||
// Browser globals
|
||||
console: 'readonly',
|
||||
window: 'readonly',
|
||||
document: 'readonly',
|
||||
navigator: 'readonly',
|
||||
fetch: 'readonly',
|
||||
setTimeout: 'readonly',
|
||||
clearTimeout: 'readonly',
|
||||
clearInterval: 'readonly',
|
||||
setInterval: 'readonly',
|
||||
URL: 'readonly',
|
||||
Response: 'readonly',
|
||||
HTMLElement: 'readonly',
|
||||
MouseEvent: 'readonly',
|
||||
KeyboardEvent: 'readonly',
|
||||
// Node.js globals (for Vite config, build scripts, and skill modules)
|
||||
process: 'readonly',
|
||||
__dirname: 'readonly',
|
||||
__filename: 'readonly',
|
||||
Buffer: 'readonly',
|
||||
AbortController: 'readonly',
|
||||
RequestInit: 'readonly'
|
||||
}
|
||||
},
|
||||
plugins: {
|
||||
'@typescript-eslint': typescript,
|
||||
'react': react,
|
||||
'react-hooks': reactHooks
|
||||
},
|
||||
rules: {
|
||||
...typescript.configs.recommended.rules,
|
||||
...react.configs.recommended.rules,
|
||||
...reactHooks.configs.recommended.rules,
|
||||
'react/react-in-jsx-scope': 'off',
|
||||
'react/prop-types': 'off',
|
||||
'react/no-unescaped-entities': 'off',
|
||||
'@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
|
||||
'@typescript-eslint/explicit-function-return-type': 'off',
|
||||
'@typescript-eslint/no-explicit-any': 'warn'
|
||||
},
|
||||
settings: {
|
||||
react: { version: 'detect' }
|
||||
}
|
||||
},
|
||||
// Node.js scripts (.mjs files)
|
||||
{
|
||||
files: ['**/*.mjs'],
|
||||
languageOptions: {
|
||||
ecmaVersion: 'latest',
|
||||
sourceType: 'module',
|
||||
globals: {
|
||||
console: 'readonly',
|
||||
process: 'readonly',
|
||||
__dirname: 'readonly',
|
||||
__filename: 'readonly',
|
||||
Buffer: 'readonly',
|
||||
setTimeout: 'readonly',
|
||||
setInterval: 'readonly',
|
||||
clearTimeout: 'readonly',
|
||||
clearInterval: 'readonly',
|
||||
URL: 'readonly'
|
||||
}
|
||||
},
|
||||
rules: {
|
||||
'no-empty': ['error', { allowEmptyCatch: true }],
|
||||
'no-unused-vars': ['error', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }]
|
||||
}
|
||||
},
|
||||
// Node.js scripts (.js files in scripts directory)
|
||||
{
|
||||
files: ['scripts/**/*.js'],
|
||||
languageOptions: {
|
||||
ecmaVersion: 'latest',
|
||||
sourceType: 'module',
|
||||
globals: {
|
||||
console: 'readonly',
|
||||
process: 'readonly',
|
||||
__dirname: 'readonly',
|
||||
__filename: 'readonly',
|
||||
Buffer: 'readonly',
|
||||
setTimeout: 'readonly',
|
||||
setInterval: 'readonly',
|
||||
clearTimeout: 'readonly',
|
||||
clearInterval: 'readonly',
|
||||
URL: 'readonly'
|
||||
}
|
||||
},
|
||||
rules: {
|
||||
'no-empty': ['error', { allowEmptyCatch: true }],
|
||||
'no-unused-vars': ['error', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }]
|
||||
}
|
||||
},
|
||||
{
|
||||
ignores: ['dist/', 'node_modules/', '*.config.js', 'public/', '.venv/']
|
||||
}
|
||||
];
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -1,7 +0,0 @@
|
||||
# Fonts
|
||||
|
||||
This repository includes the **Prometo** font files in `font/`.
|
||||
|
||||
These font binaries are **not covered by the repository AGPL license**. They are used under the applicable **Adobe Fonts / Dalton Maag** licensing terms for Prompt Security / SentinelOne. Do not redistribute or reuse them outside the terms of that license.
|
||||
|
||||
If you are forking or redistributing this project and you do not have the appropriate rights, remove `font/Prometo_Trial_*.ttf` and update the CSS/font stack accordingly.
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 33 KiB |
@@ -1,5 +0,0 @@
|
||||
<svg width="27" height="24" viewBox="0 0 27 24" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||||
<path d="M26.4003 16.1166L17.8167 1.24932C17.3704 0.476223 16.5456 0 15.6528 0H11.1343C12.0206 0 12.8397 0.472788 13.2828 1.24041L13.7849 2.10991L15.67 5.37457L20.8597 14.364C21.2728 15.0795 20.7564 15.9739 19.9302 15.9739L9.55076 15.9738L8.20302 18.3079C7.78979 19.0235 8.30627 19.918 9.13249 19.918H24.2054C25.0135 19.918 25.7707 19.5237 26.234 18.8617L26.3695 18.6682L26.4005 18.6144C26.8464 17.8416 26.8463 16.8894 26.4003 16.1166Z" fill="#B56FED"/>
|
||||
<path d="M15.67 5.37457L13.7849 2.10991L13.2828 1.24041C12.8397 0.472788 12.0206 0 11.1343 0C10.248 0 9.42894 0.472758 8.98577 1.24027L0.334762 16.2241C-0.111408 16.9968 -0.111623 17.9491 0.334333 18.7221L2.58966 22.629C2.14896 21.8659 2.14885 20.9256 2.58966 20.1623L10.0593 7.22478C10.5401 6.3919 11.7423 6.3919 12.2232 7.22478L13.4124 9.28488L17.2753 15.9738L19.9302 15.9739C20.7564 15.9739 21.2728 15.0795 20.8597 14.364L15.67 5.37457Z" fill="#E4C7FD"/>
|
||||
<path d="M26.3695 18.6682C25.9232 19.4413 25.0981 19.918 24.2054 19.918H9.13249C8.30627 19.918 7.78979 19.0235 8.20302 18.3079L9.55076 15.9738L13.4124 9.28488L12.2232 7.22478C11.7423 6.3919 10.5401 6.3919 10.0593 7.22478L2.58966 20.1623C2.14885 20.9256 2.14896 21.8659 2.58966 22.629C3.03025 23.3919 3.84434 23.8619 4.72531 23.8619H21.9282C22.8208 23.8619 23.6456 23.3857 24.0919 22.6127L25.6481 19.9178L26.3695 18.6682Z" fill="#4D1080"/>
|
||||
</svg>
|
||||
|
Before Width: | Height: | Size: 1.4 KiB |
-151
@@ -1,151 +0,0 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<!-- BOT INSTRUCTIONS (plain text for curl/head) -->
|
||||
<!--
|
||||
ClawSec
|
||||
Security skill suite for AI agents (integrity checks, drift detection, advisory feed).
|
||||
Agent install:
|
||||
Available via npx skills: npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw -y
|
||||
OR
|
||||
curl -sL https://clawsec.prompt.security/releases/latest/download/SKILL.md
|
||||
-->
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0" />
|
||||
<title>ClawSec | Agent Hardening | Prompt Security, SentinelOne </title>
|
||||
<link rel="icon" type="image/x-icon" href="/img/favicon.ico" />
|
||||
<script src="https://cdn.tailwindcss.com"></script>
|
||||
<style>
|
||||
@font-face {
|
||||
font-family: 'Prometo';
|
||||
src: url('/font/Prometo_Trial_Rg.ttf') format('truetype');
|
||||
font-weight: 400;
|
||||
font-style: normal;
|
||||
}
|
||||
@font-face {
|
||||
font-family: 'Prometo';
|
||||
src: url('/font/Prometo_Trial_Md.ttf') format('truetype');
|
||||
font-weight: 500;
|
||||
font-style: normal;
|
||||
}
|
||||
@font-face {
|
||||
font-family: 'Prometo';
|
||||
src: url('/font/Prometo_Trial_Bd.ttf') format('truetype');
|
||||
font-weight: 700;
|
||||
font-style: normal;
|
||||
}
|
||||
@font-face {
|
||||
font-family: 'Prometo';
|
||||
src: url('/font/Prometo_Trial_XBd.ttf') format('truetype');
|
||||
font-weight: 800;
|
||||
font-style: normal;
|
||||
}
|
||||
</style>
|
||||
<script>
|
||||
tailwind.config = {
|
||||
theme: {
|
||||
extend: {
|
||||
fontFamily: {
|
||||
sans: ['Prometo', 'system-ui', 'sans-serif'],
|
||||
display: ['Prometo', 'system-ui', 'sans-serif'],
|
||||
mono: ['Prometo', 'system-ui', 'sans-serif'],
|
||||
},
|
||||
colors: {
|
||||
clawd: {
|
||||
900: '#26115d', // Deep base
|
||||
800: '#3a1f7a', // Mid base
|
||||
700: '#523899', // Lifted mid
|
||||
600: '#8c6ae7', // Light highlight
|
||||
accent: '#ffa23f', // Prompt orange (target)
|
||||
accentHover: '#e89232',
|
||||
secondary: '#c7b6ff', // Soft lavender
|
||||
}
|
||||
},
|
||||
animation: {
|
||||
'float': 'float 6s ease-in-out infinite',
|
||||
'float-delayed': 'float 6s ease-in-out 3s infinite',
|
||||
'pulse-slow': 'pulse 4s cubic-bezier(0.4, 0, 0.6, 1) infinite',
|
||||
},
|
||||
keyframes: {
|
||||
float: {
|
||||
'0%, 100%': { transform: 'translateY(0)' },
|
||||
'50%': { transform: 'translateY(-20px)' },
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
</script>
|
||||
<style>
|
||||
body {
|
||||
background:
|
||||
linear-gradient(90deg, rgba(12, 6, 24, 0.55) 0%, rgba(12, 6, 24, 0.0) 45%),
|
||||
radial-gradient(circle at 10% 18%, rgba(255, 162, 63, 0.06), transparent 28%),
|
||||
radial-gradient(circle at 82% 18%, rgba(140, 106, 231, 0.20), transparent 30%),
|
||||
radial-gradient(circle at 55% 78%, rgba(82, 56, 153, 0.22), transparent 34%),
|
||||
linear-gradient(180deg, #26115d 0%, #523899 52%, #8c6ae7 100%);
|
||||
color: #f4f0ff;
|
||||
}
|
||||
/* Custom Scrollbar */
|
||||
::-webkit-scrollbar {
|
||||
width: 10px;
|
||||
height: 10px;
|
||||
}
|
||||
::-webkit-scrollbar-track {
|
||||
background: #14103b;
|
||||
}
|
||||
::-webkit-scrollbar-thumb {
|
||||
background: #2f2261;
|
||||
border-radius: 6px;
|
||||
}
|
||||
::-webkit-scrollbar-thumb:hover {
|
||||
background: #f9b347;
|
||||
}
|
||||
/* Mobile overflow fixes */
|
||||
html, body {
|
||||
overflow-x: hidden;
|
||||
width: 100%;
|
||||
max-width: 100vw;
|
||||
}
|
||||
#root {
|
||||
overflow-x: hidden;
|
||||
width: 100%;
|
||||
max-width: 100vw;
|
||||
}
|
||||
/* Ensure code blocks wrap properly */
|
||||
code, pre {
|
||||
word-break: break-word;
|
||||
overflow-wrap: break-word;
|
||||
}
|
||||
/* Fix for tables on mobile */
|
||||
table {
|
||||
display: block;
|
||||
overflow-x: auto;
|
||||
max-width: 100%;
|
||||
}
|
||||
</style>
|
||||
<script type="importmap">
|
||||
{
|
||||
"imports": {
|
||||
"react-dom/": "https://esm.sh/react-dom@^19.2.4/",
|
||||
"react/": "https://esm.sh/react@^19.2.4/",
|
||||
"react": "https://esm.sh/react@^19.2.4",
|
||||
"lucide-react": "https://esm.sh/lucide-react@^0.563.0",
|
||||
"react-router-dom": "https://esm.sh/react-router-dom@^7.13.0"
|
||||
}
|
||||
}
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<noscript>
|
||||
ClawSec
|
||||
Security skill suite for AI agents (integrity checks, drift detection, advisory feed).
|
||||
Agent install:
|
||||
Available via npx skills: npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw -y
|
||||
OR
|
||||
curl -sL https://clawsec.prompt.security/releases/latest/download/SKILL.md
|
||||
</noscript>
|
||||
<div id="root"></div>
|
||||
<script type="module" src="/index.tsx"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -1,15 +0,0 @@
|
||||
import React from 'react';
|
||||
import ReactDOM from 'react-dom/client';
|
||||
import App from './App';
|
||||
|
||||
const rootElement = document.getElementById('root');
|
||||
if (!rootElement) {
|
||||
throw new Error("Could not find root element to mount to");
|
||||
}
|
||||
|
||||
const root = ReactDOM.createRoot(rootElement);
|
||||
root.render(
|
||||
<React.StrictMode>
|
||||
<App />
|
||||
</React.StrictMode>
|
||||
);
|
||||
@@ -1,4 +0,0 @@
|
||||
{
|
||||
"name": "ClawSec",
|
||||
"description": "A security-first skill distribution platform for OpenClaw and NanoClaw agents, featuring verified audit skills, hardening feeds, and guardian mode protocols."
|
||||
}
|
||||
Generated
-6184
File diff suppressed because it is too large
Load Diff
@@ -1,49 +0,0 @@
|
||||
{
|
||||
"name": "ClawSec",
|
||||
"private": true,
|
||||
"license": "AGPL-3.0-or-later",
|
||||
"version": "0.0.0",
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
"gen:wiki-llms": "node scripts/generate-wiki-llms.mjs",
|
||||
"populate-local-wiki": "./scripts/populate-local-wiki.sh",
|
||||
"predev": "npm run gen:wiki-llms",
|
||||
"dev": "vite",
|
||||
"prebuild": "npm run gen:wiki-llms",
|
||||
"i18n:qa": "python scripts/i18n/qa_check.py",
|
||||
"i18n:bootstrap:ko": "python scripts/i18n/bootstrap_language_from_en.py --lang ko",
|
||||
"i18n:bootstrap:fr": "python scripts/i18n/bootstrap_language_from_en.py --lang fr",
|
||||
"i18n:bootstrap:de": "python scripts/i18n/bootstrap_language_from_en.py --lang de",
|
||||
"i18n:bootstrap:ja": "python scripts/i18n/bootstrap_language_from_en.py --lang ja",
|
||||
"build": "vite build",
|
||||
"preview": "vite preview"
|
||||
},
|
||||
"dependencies": {
|
||||
"lucide-react": "^0.575.0",
|
||||
"react": "^19.2.4",
|
||||
"react-dom": "^19.2.5",
|
||||
"react-markdown": "^10.1.0",
|
||||
"react-router-dom": "^7.16.0",
|
||||
"remark-gfm": "^4.0.1"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@eslint/js": "~9.39.4",
|
||||
"@types/node": "^25.8.0",
|
||||
"@typescript-eslint/eslint-plugin": "^8.55.0",
|
||||
"@typescript-eslint/parser": "^8.58.1",
|
||||
"@vitejs/plugin-react": "^5.1.4",
|
||||
"eslint": "^9.39.4",
|
||||
"eslint-plugin-react": "^7.37.5",
|
||||
"eslint-plugin-react-hooks": "^7.0.1",
|
||||
"fast-check": "^4.7.0",
|
||||
"typescript": "~5.9.3",
|
||||
"vite": "^7.3.2"
|
||||
},
|
||||
"overrides": {
|
||||
"ajv": "6.14.0",
|
||||
"balanced-match": "4.0.3",
|
||||
"brace-expansion": "5.0.6",
|
||||
"minimatch": "10.2.5",
|
||||
"picomatch": "4.0.4"
|
||||
}
|
||||
}
|
||||
@@ -1,307 +0,0 @@
|
||||
import React, { useState, useEffect } from 'react';
|
||||
import { useParams, Link } from 'react-router-dom';
|
||||
import { ArrowLeft, ExternalLink, Shield, AlertTriangle, Github, User, Bot } from 'lucide-react';
|
||||
import { AdvisoryPlatformBadge } from '../components/AdvisoryPlatformBadge';
|
||||
import { Footer } from '../components/Footer';
|
||||
import { Advisory, AdvisoryFeed } from '../types';
|
||||
import { getPlatformDescriptor } from '../utils/advisoryPlatforms';
|
||||
import {
|
||||
ADVISORY_FEED_URL,
|
||||
LEGACY_ADVISORY_FEED_URL,
|
||||
LOCAL_FEED_PATH,
|
||||
} from '../constants';
|
||||
|
||||
export const AdvisoryDetail: React.FC = () => {
|
||||
const { advisoryId } = useParams<{ advisoryId: string }>();
|
||||
const [advisory, setAdvisory] = useState<Advisory | null>(null);
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
|
||||
useEffect(() => {
|
||||
const fetchAdvisory = async () => {
|
||||
if (!advisoryId) return;
|
||||
|
||||
try {
|
||||
// Try local feed first (dev), then canonical hosted endpoint, then legacy mirror.
|
||||
let response = await fetch(LOCAL_FEED_PATH);
|
||||
|
||||
if (!response.ok) {
|
||||
response = await fetch(ADVISORY_FEED_URL);
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
response = await fetch(LEGACY_ADVISORY_FEED_URL);
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`Failed to fetch feed: ${response.status}`);
|
||||
}
|
||||
|
||||
const feed: AdvisoryFeed = await response.json();
|
||||
const found = feed.advisories.find((a) => a.id === decodeURIComponent(advisoryId));
|
||||
|
||||
if (!found) {
|
||||
throw new Error('Advisory not found');
|
||||
}
|
||||
|
||||
setAdvisory(found);
|
||||
} catch (err) {
|
||||
console.error('Failed to fetch advisory:', err);
|
||||
setError(err instanceof Error ? err.message : 'Failed to load advisory');
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
};
|
||||
|
||||
fetchAdvisory();
|
||||
}, [advisoryId]);
|
||||
|
||||
const formatDate = (dateStr: string) => {
|
||||
try {
|
||||
return new Date(dateStr).toLocaleDateString('en-US', {
|
||||
year: 'numeric',
|
||||
month: 'long',
|
||||
day: 'numeric',
|
||||
hour: '2-digit',
|
||||
minute: '2-digit'
|
||||
});
|
||||
} catch {
|
||||
return dateStr;
|
||||
}
|
||||
};
|
||||
|
||||
const getSeverityClasses = (severity: string) => {
|
||||
switch (severity) {
|
||||
case 'critical':
|
||||
return 'bg-red-500/20 text-red-400 border-red-500/30';
|
||||
case 'high':
|
||||
return 'bg-orange-500/20 text-orange-400 border-orange-500/30';
|
||||
case 'medium':
|
||||
return 'bg-yellow-500/20 text-yellow-400 border-yellow-500/30';
|
||||
default:
|
||||
return 'bg-blue-500/20 text-blue-400 border-blue-500/30';
|
||||
}
|
||||
};
|
||||
|
||||
const getTypeLabel = (type: string) => {
|
||||
switch (type) {
|
||||
case 'malicious_skill':
|
||||
return 'Malicious Skill';
|
||||
case 'vulnerable_skill':
|
||||
return 'Vulnerable Skill';
|
||||
case 'prompt_injection':
|
||||
return 'Prompt Injection';
|
||||
case 'attack_pattern':
|
||||
return 'Attack Pattern';
|
||||
case 'best_practice':
|
||||
return 'Best Practice';
|
||||
case 'tampering_attempt':
|
||||
return 'Tampering Attempt';
|
||||
default:
|
||||
return type;
|
||||
}
|
||||
};
|
||||
|
||||
// Determine source - defaults to "Prompt Security Staff" when absent
|
||||
const getSource = (adv: Advisory) => {
|
||||
return adv.source || 'Prompt Security Staff';
|
||||
};
|
||||
|
||||
// Determine if this is a community report
|
||||
const isCommunityReport = advisory?.github_issue_url;
|
||||
|
||||
if (loading) {
|
||||
return (
|
||||
<div className="py-16 text-center">
|
||||
<div className="inline-block animate-spin rounded-full h-8 w-8 border-b-2 border-clawd-accent"></div>
|
||||
<p className="mt-4 text-gray-400">Loading advisory...</p>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
if (error || !advisory) {
|
||||
return (
|
||||
<div className="py-16 text-center">
|
||||
<Shield className="w-16 h-16 mx-auto text-gray-600 mb-4" />
|
||||
<h2 className="text-xl font-bold text-white mb-2">Advisory Not Found</h2>
|
||||
<p className="text-gray-400 mb-4">{error || 'This advisory does not exist'}</p>
|
||||
<Link to="/feed" className="text-clawd-accent hover:underline">
|
||||
Back to Security Feed
|
||||
</Link>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="max-w-4xl mx-auto pt-8 space-y-8">
|
||||
{/* Back Link */}
|
||||
<Link
|
||||
to="/feed"
|
||||
className="inline-flex items-center gap-2 text-gray-400 hover:text-white transition-colors"
|
||||
>
|
||||
<ArrowLeft size={20} />
|
||||
Back to Security Feed
|
||||
</Link>
|
||||
|
||||
{/* Header */}
|
||||
<section className="space-y-4">
|
||||
<div className="flex flex-wrap items-center gap-3">
|
||||
<span className={`text-sm font-bold px-3 py-1.5 rounded uppercase border ${getSeverityClasses(advisory.severity)}`}>
|
||||
{advisory.severity}
|
||||
{advisory.cvss_score && <span className="ml-2 opacity-75">CVSS {advisory.cvss_score}</span>}
|
||||
</span>
|
||||
<span className="text-sm px-3 py-1.5 rounded bg-clawd-700 text-gray-300">
|
||||
{getTypeLabel(advisory.type)}
|
||||
</span>
|
||||
<span className="text-sm text-gray-500">
|
||||
Published {formatDate(advisory.published)}
|
||||
</span>
|
||||
{advisory.platforms?.map((platform) => (
|
||||
<AdvisoryPlatformBadge
|
||||
key={`${advisory.id}-platform-${platform}`}
|
||||
platform={platform}
|
||||
className="text-xs px-2 py-1 rounded"
|
||||
/>
|
||||
))}
|
||||
</div>
|
||||
|
||||
<h1 className="text-3xl font-bold text-white">{advisory.id}</h1>
|
||||
<p className="text-xl text-gray-300">{advisory.title}</p>
|
||||
</section>
|
||||
|
||||
{/* Description */}
|
||||
<section className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-6">
|
||||
<h2 className="text-lg font-bold text-white mb-3 flex items-center gap-2">
|
||||
<AlertTriangle size={20} className="text-orange-400" />
|
||||
Description
|
||||
</h2>
|
||||
<p className="text-gray-300 leading-relaxed whitespace-pre-wrap">{advisory.description}</p>
|
||||
</section>
|
||||
|
||||
{/* Recommended Action */}
|
||||
<section className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-6">
|
||||
<h2 className="text-lg font-bold text-white mb-3 flex items-center gap-2">
|
||||
<Shield size={20} className="text-green-400" />
|
||||
Recommended Action
|
||||
</h2>
|
||||
<p className="text-gray-300 leading-relaxed">{advisory.action}</p>
|
||||
</section>
|
||||
|
||||
{/* Affected Components */}
|
||||
{advisory.affected && advisory.affected.length > 0 && (
|
||||
<section className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-6">
|
||||
<h2 className="text-lg font-bold text-white mb-3">Affected Components</h2>
|
||||
<ul className="list-disc list-inside space-y-1">
|
||||
{advisory.affected.map((item, index) => (
|
||||
<li key={index} className="text-gray-300">{item}</li>
|
||||
))}
|
||||
</ul>
|
||||
</section>
|
||||
)}
|
||||
|
||||
{/* References */}
|
||||
{advisory.references && advisory.references.length > 0 && (
|
||||
<section className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-6">
|
||||
<h2 className="text-lg font-bold text-white mb-3">References</h2>
|
||||
<ul className="space-y-2">
|
||||
{advisory.references.map((ref, index) => (
|
||||
<li key={index}>
|
||||
<a
|
||||
href={ref}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="text-clawd-accent hover:underline text-sm flex items-center gap-1 break-all"
|
||||
>
|
||||
<ExternalLink size={14} className="flex-shrink-0" />
|
||||
{ref}
|
||||
</a>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
</section>
|
||||
)}
|
||||
|
||||
{/* External Link - NVD or GitHub Issue */}
|
||||
<section className="flex flex-wrap gap-4">
|
||||
{isCommunityReport && advisory.github_issue_url ? (
|
||||
<a
|
||||
href={advisory.github_issue_url}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="inline-flex items-center gap-2 px-5 py-2.5 rounded-lg bg-clawd-700 hover:bg-clawd-600 text-white font-medium transition-colors"
|
||||
>
|
||||
<Github size={18} />
|
||||
View GitHub Report
|
||||
</a>
|
||||
) : advisory.nvd_url ? (
|
||||
<a
|
||||
href={advisory.nvd_url}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="inline-flex items-center gap-2 px-5 py-2.5 rounded-lg bg-clawd-700 hover:bg-clawd-600 text-white font-medium transition-colors"
|
||||
>
|
||||
<ExternalLink size={18} />
|
||||
View on NVD
|
||||
</a>
|
||||
) : null}
|
||||
</section>
|
||||
|
||||
{/* Metadata */}
|
||||
<section className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-6">
|
||||
<h3 className="font-bold text-white mb-4">Metadata</h3>
|
||||
<dl className="grid md:grid-cols-2 gap-4 text-sm">
|
||||
<div className="flex justify-between md:block">
|
||||
<dt className="text-gray-500 mb-1">Source</dt>
|
||||
<dd className="text-white">{getSource(advisory)}</dd>
|
||||
</div>
|
||||
{advisory.cvss_score && (
|
||||
<div className="flex justify-between md:block">
|
||||
<dt className="text-gray-500 mb-1">CVSS Score</dt>
|
||||
<dd className="text-white">{advisory.cvss_score}</dd>
|
||||
</div>
|
||||
)}
|
||||
<div className="flex justify-between md:block">
|
||||
<dt className="text-gray-500 mb-1">Type</dt>
|
||||
<dd className="text-white">{getTypeLabel(advisory.type)}</dd>
|
||||
</div>
|
||||
<div className="flex justify-between md:block">
|
||||
<dt className="text-gray-500 mb-1">Published</dt>
|
||||
<dd className="text-white">{formatDate(advisory.published)}</dd>
|
||||
</div>
|
||||
{advisory.platforms && advisory.platforms.length > 0 && (
|
||||
<div className="flex justify-between md:block">
|
||||
<dt className="text-gray-500 mb-1">Platforms</dt>
|
||||
<dd className="text-white">{advisory.platforms.map((platform) => getPlatformDescriptor(platform).label).join(', ')}</dd>
|
||||
</div>
|
||||
)}
|
||||
{/* Reporter info - subtle display for community reports */}
|
||||
{advisory.reporter && (
|
||||
<>
|
||||
{advisory.reporter.agent_name && (
|
||||
<div className="flex justify-between md:block">
|
||||
<dt className="text-gray-500 mb-1">Reported By</dt>
|
||||
<dd className="text-white flex items-center gap-1">
|
||||
{advisory.reporter.opener_type === 'agent' ? (
|
||||
<Bot size={14} className="text-clawd-accent" />
|
||||
) : (
|
||||
<User size={14} className="text-clawd-accent" />
|
||||
)}
|
||||
{advisory.reporter.agent_name}
|
||||
</dd>
|
||||
</div>
|
||||
)}
|
||||
{advisory.reporter.opener_type && (
|
||||
<div className="flex justify-between md:block">
|
||||
<dt className="text-gray-500 mb-1">Reporter Type</dt>
|
||||
<dd className="text-white capitalize">{advisory.reporter.opener_type}</dd>
|
||||
</div>
|
||||
)}
|
||||
</>
|
||||
)}
|
||||
</dl>
|
||||
</section>
|
||||
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
};
|
||||
@@ -1,206 +0,0 @@
|
||||
import { useEffect, useState } from 'react';
|
||||
import { Shield, Copy, Download, CheckCircle2 } from 'lucide-react';
|
||||
import { CodeBlock } from '../components/CodeBlock';
|
||||
|
||||
interface FileChecksum {
|
||||
sha256: string;
|
||||
size: number;
|
||||
url: string;
|
||||
}
|
||||
|
||||
interface ChecksumsData {
|
||||
version: string;
|
||||
generated_at: string;
|
||||
repository: string;
|
||||
files: Record<string, FileChecksum>;
|
||||
}
|
||||
|
||||
export default function Checksums() {
|
||||
const [checksums, setChecksums] = useState<ChecksumsData | null>(null);
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [copied, setCopied] = useState<string | null>(null);
|
||||
|
||||
useEffect(() => {
|
||||
fetch('./checksums.json')
|
||||
.then(res => {
|
||||
if (!res.ok) throw new Error('Not found');
|
||||
return res.json();
|
||||
})
|
||||
.then(data => {
|
||||
setChecksums(data);
|
||||
setLoading(false);
|
||||
})
|
||||
.catch(() => {
|
||||
setLoading(false);
|
||||
});
|
||||
}, []);
|
||||
|
||||
const copyToClipboard = (text: string, id: string) => {
|
||||
navigator.clipboard.writeText(text);
|
||||
setCopied(id);
|
||||
setTimeout(() => setCopied(null), 2000);
|
||||
};
|
||||
|
||||
const fileDescriptions: Record<string, string> = {
|
||||
'SKILL.md': 'Main ClawSec skill documentation',
|
||||
'heartbeat.md': 'Heartbeat monitoring and update instructions',
|
||||
'reporting.md': 'Security incident reporting guidelines',
|
||||
'skill.json': 'Skill metadata and configuration',
|
||||
'feed.json': 'Community security advisory feed'
|
||||
};
|
||||
|
||||
return (
|
||||
<>
|
||||
<div className="max-w-5xl mx-auto">
|
||||
{/* Header */}
|
||||
<div className="mb-12 text-center">
|
||||
<div className="flex items-center justify-center gap-3 mb-4">
|
||||
<Shield className="w-12 h-12 text-clawd-accent" />
|
||||
<h1 className="text-4xl font-bold">File Checksums</h1>
|
||||
</div>
|
||||
<p className="text-xl text-gray-300">
|
||||
Verify the integrity of ClawSec files before use
|
||||
</p>
|
||||
</div>
|
||||
|
||||
{loading ? (
|
||||
<div className="text-center py-12">
|
||||
<div className="inline-block animate-spin rounded-full h-12 w-12 border-t-2 border-b-2 border-clawd-accent"></div>
|
||||
<p className="mt-4 text-gray-400">Loading checksums...</p>
|
||||
</div>
|
||||
) : checksums ? (
|
||||
<>
|
||||
{/* Version Info */}
|
||||
<div className="bg-clawd-800 rounded-lg p-6 mb-8">
|
||||
<div className="grid md:grid-cols-3 gap-4 text-sm">
|
||||
<div>
|
||||
<div className="text-gray-400 mb-1">Version</div>
|
||||
<div className="font-mono text-clawd-accent">{checksums.version}</div>
|
||||
</div>
|
||||
<div>
|
||||
<div className="text-gray-400 mb-1">Generated</div>
|
||||
<div className="font-mono">{new Date(checksums.generated_at).toLocaleString()}</div>
|
||||
</div>
|
||||
<div>
|
||||
<div className="text-gray-400 mb-1">Repository</div>
|
||||
<div className="font-mono text-sm">{checksums.repository}</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Files Table */}
|
||||
<div className="bg-clawd-800 rounded-lg overflow-hidden mb-8">
|
||||
<div className="overflow-x-auto">
|
||||
<table className="w-full">
|
||||
<thead className="bg-clawd-900">
|
||||
<tr>
|
||||
<th className="px-6 py-4 text-left text-sm font-semibold">File</th>
|
||||
<th className="px-6 py-4 text-left text-sm font-semibold">Size</th>
|
||||
<th className="px-6 py-4 text-left text-sm font-semibold">SHA256 Checksum</th>
|
||||
<th className="px-6 py-4 text-right text-sm font-semibold">Actions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody className="divide-y divide-clawd-700">
|
||||
{(Object.entries(checksums.files) as [string, FileChecksum][]).map(([filename, data]) => (
|
||||
<tr key={filename} className="hover:bg-clawd-700/50 transition-colors">
|
||||
<td className="px-6 py-4">
|
||||
<div className="font-mono text-sm text-clawd-accent">{filename}</div>
|
||||
<div className="text-xs text-gray-400 mt-1">
|
||||
{fileDescriptions[filename] || 'ClawSec file'}
|
||||
</div>
|
||||
</td>
|
||||
<td className="px-6 py-4">
|
||||
<div className="text-sm">{(data.size / 1024).toFixed(1)} KB</div>
|
||||
</td>
|
||||
<td className="px-6 py-4">
|
||||
<div className="font-mono text-xs break-all max-w-md">
|
||||
{data.sha256}
|
||||
</div>
|
||||
</td>
|
||||
<td className="px-6 py-4">
|
||||
<div className="flex items-center justify-end gap-2">
|
||||
<button
|
||||
onClick={() => copyToClipboard(data.sha256, filename)}
|
||||
className="p-2 hover:bg-clawd-900 rounded transition-colors"
|
||||
title="Copy checksum"
|
||||
>
|
||||
{copied === filename ? (
|
||||
<CheckCircle2 className="w-4 h-4 text-green-400" />
|
||||
) : (
|
||||
<Copy className="w-4 h-4" />
|
||||
)}
|
||||
</button>
|
||||
<a
|
||||
href={data.url}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="p-2 hover:bg-clawd-900 rounded transition-colors"
|
||||
title="Download file"
|
||||
>
|
||||
<Download className="w-4 h-4" />
|
||||
</a>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Verification Instructions */}
|
||||
<div className="bg-clawd-800 rounded-lg p-6">
|
||||
<h2 className="text-2xl font-bold mb-4 flex items-center gap-2">
|
||||
<Shield className="w-6 h-6 text-clawd-accent" />
|
||||
Verification Instructions
|
||||
</h2>
|
||||
|
||||
<p className="text-gray-300 mb-4">
|
||||
Always verify file integrity before using ClawSec files. Here's how:
|
||||
</p>
|
||||
|
||||
<div className="space-y-4">
|
||||
<div>
|
||||
<h3 className="font-semibold mb-2">1. Download a file</h3>
|
||||
<CodeBlock
|
||||
code={`curl -sL https://github.com/${checksums.repository}/releases/download/${checksums.version}/SKILL.md -o SKILL.md`}
|
||||
/>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<h3 className="font-semibold mb-2">2. Generate its checksum</h3>
|
||||
<CodeBlock code="sha256sum SKILL.md" />
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<h3 className="font-semibold mb-2">3. Compare with the checksum above</h3>
|
||||
<p className="text-sm text-gray-400">
|
||||
The output should exactly match the SHA256 value shown in the table.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div className="mt-6 p-4 bg-yellow-500/10 border border-yellow-500/20 rounded-lg">
|
||||
<p className="text-yellow-200 text-sm">
|
||||
<strong>Security Warning:</strong> Never use files with mismatched checksums.
|
||||
This could indicate tampering or a compromised download.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</>
|
||||
) : (
|
||||
<div className="bg-clawd-800 rounded-lg p-12 text-center">
|
||||
<Shield className="w-16 h-16 text-gray-600 mx-auto mb-4" />
|
||||
<p className="text-gray-400">
|
||||
Checksums not available. Create a release to generate checksums.
|
||||
</p>
|
||||
<CodeBlock
|
||||
code={`# Create a release to generate checksums:\ngit tag v1.0.0 && git push origin v1.0.0`}
|
||||
className="mt-4 text-left"
|
||||
/>
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
</>
|
||||
);
|
||||
}
|
||||
@@ -1,322 +0,0 @@
|
||||
import React, { useState, useEffect, useMemo } from 'react';
|
||||
import { Rss, RefreshCw, Loader2, AlertTriangle, ChevronLeft, ChevronRight, Download, Users, AlertCircle } from 'lucide-react';
|
||||
import { Link } from 'react-router-dom';
|
||||
import { Footer } from '../components/Footer';
|
||||
import { AdvisoryCard } from '../components/AdvisoryCard';
|
||||
import { Advisory, AdvisoryFeed, AdvisoryPlatformFilter } from '../types';
|
||||
import { isCorePlatformSlug, normalizePlatformSlug } from '../utils/advisoryPlatforms';
|
||||
import {
|
||||
ADVISORY_FEED_URL,
|
||||
LEGACY_ADVISORY_FEED_URL,
|
||||
LOCAL_FEED_PATH,
|
||||
} from '../constants';
|
||||
|
||||
const ITEMS_PER_PAGE = 9;
|
||||
|
||||
type SeverityFilter = 'all' | Advisory['severity'];
|
||||
type FilterTabOption<T extends string> = { value: T; label: string; active: string; inactive: string };
|
||||
|
||||
const SEVERITY_TABS = [
|
||||
{ value: 'all', label: 'All', active: 'bg-clawd-accent text-white', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-clawd-accent/50' },
|
||||
{ value: 'critical', label: 'Critical', active: 'bg-red-500/20 text-red-400 border-2 border-red-400', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-red-400/50' },
|
||||
{ value: 'high', label: 'High', active: 'bg-orange-500/20 text-orange-400 border-2 border-orange-400', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-orange-400/50' },
|
||||
{ value: 'medium', label: 'Medium', active: 'bg-yellow-500/20 text-yellow-400 border-2 border-yellow-400', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-yellow-400/50' },
|
||||
{ value: 'low', label: 'Low', active: 'bg-blue-500/20 text-blue-400 border-2 border-blue-400', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-blue-400/50' },
|
||||
] as const satisfies ReadonlyArray<FilterTabOption<SeverityFilter>>;
|
||||
|
||||
const PLATFORM_TABS = [
|
||||
{ value: 'all', label: 'All Platforms', active: 'bg-clawd-accent text-white', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-clawd-accent/50' },
|
||||
{ value: 'openclaw', label: 'OpenClaw', active: 'bg-clawd-accent/20 text-clawd-accent border-2 border-clawd-accent', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-clawd-accent/50' },
|
||||
{ value: 'nanoclaw', label: 'NanoClaw', active: 'bg-clawd-secondary/20 text-clawd-secondary border-2 border-clawd-secondary', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-clawd-secondary/50' },
|
||||
{ value: 'hermes', label: 'Hermes', active: 'bg-emerald-500/20 text-emerald-300 border-2 border-emerald-400', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-emerald-400/50' },
|
||||
{ value: 'picoclaw', label: 'Picoclaw', active: 'bg-cyan-500/20 text-cyan-300 border-2 border-cyan-400', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-cyan-400/50' },
|
||||
{ value: 'other', label: 'Other', active: 'bg-clawd-600/40 text-gray-100 border-2 border-clawd-500', inactive: 'bg-clawd-800 text-gray-400 border border-clawd-700 hover:border-clawd-500/50' },
|
||||
] as const satisfies ReadonlyArray<FilterTabOption<AdvisoryPlatformFilter>>;
|
||||
|
||||
const FilterTabs = <T extends string,>({
|
||||
tabs,
|
||||
selected,
|
||||
onSelect,
|
||||
}: {
|
||||
tabs: ReadonlyArray<FilterTabOption<T>>;
|
||||
selected: T;
|
||||
onSelect: (value: T) => void;
|
||||
}) => (
|
||||
<div className="flex flex-wrap justify-center gap-3 mb-8">
|
||||
{tabs.map(({ value, label, active, inactive }) => (
|
||||
<button
|
||||
key={value}
|
||||
onClick={() => onSelect(value)}
|
||||
className={`px-4 py-2 rounded-lg text-sm font-semibold transition-all ${
|
||||
selected === value ? active : inactive
|
||||
}`}
|
||||
>
|
||||
{label}
|
||||
</button>
|
||||
))}
|
||||
</div>
|
||||
);
|
||||
|
||||
export const FeedSetup: React.FC = () => {
|
||||
const [advisories, setAdvisories] = useState<Advisory[]>([]);
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const [lastUpdated, setLastUpdated] = useState<string | null>(null);
|
||||
const [currentPage, setCurrentPage] = useState(1);
|
||||
const [selectedSeverity, setSelectedSeverity] = useState<SeverityFilter>('all');
|
||||
const [selectedPlatform, setSelectedPlatform] = useState<AdvisoryPlatformFilter>('all');
|
||||
|
||||
useEffect(() => {
|
||||
const fetchAdvisories = async () => {
|
||||
setLoading(true);
|
||||
setError(null);
|
||||
|
||||
try {
|
||||
// Try local feed first (dev), then canonical hosted endpoint, then legacy mirror.
|
||||
let response = await fetch(LOCAL_FEED_PATH);
|
||||
|
||||
if (!response.ok) {
|
||||
response = await fetch(ADVISORY_FEED_URL);
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
response = await fetch(LEGACY_ADVISORY_FEED_URL);
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`Failed to fetch feed: ${response.status}`);
|
||||
}
|
||||
|
||||
const feed: AdvisoryFeed = await response.json();
|
||||
setAdvisories(feed.advisories || []);
|
||||
setLastUpdated(feed.updated);
|
||||
} catch (err) {
|
||||
console.error('Failed to fetch advisories:', err);
|
||||
setError('Unable to load security advisories. The feed may be temporarily unavailable.');
|
||||
setAdvisories([]);
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
};
|
||||
|
||||
fetchAdvisories();
|
||||
}, []);
|
||||
|
||||
const filteredAdvisories = useMemo(
|
||||
() => advisories.filter((a) => {
|
||||
if (selectedSeverity !== 'all' && a.severity !== selectedSeverity) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (selectedPlatform === 'all') {
|
||||
return true;
|
||||
}
|
||||
|
||||
const advisoryPlatforms = (a.platforms ?? [])
|
||||
.map(normalizePlatformSlug)
|
||||
.filter(Boolean);
|
||||
|
||||
if (selectedPlatform === 'other') {
|
||||
return advisoryPlatforms.some((platform) => !isCorePlatformSlug(platform));
|
||||
}
|
||||
|
||||
return advisoryPlatforms.length === 0 || advisoryPlatforms.includes(selectedPlatform);
|
||||
}),
|
||||
[advisories, selectedSeverity, selectedPlatform],
|
||||
);
|
||||
|
||||
useEffect(() => {
|
||||
setCurrentPage(1);
|
||||
}, [advisories, selectedSeverity, selectedPlatform]);
|
||||
|
||||
const formatDate = (dateStr: string) => {
|
||||
try {
|
||||
return new Date(dateStr).toLocaleDateString('en-US', {
|
||||
year: 'numeric',
|
||||
month: 'short',
|
||||
day: 'numeric'
|
||||
});
|
||||
} catch {
|
||||
return dateStr;
|
||||
}
|
||||
};
|
||||
|
||||
// Pagination calculations
|
||||
const totalPages = Math.ceil(filteredAdvisories.length / ITEMS_PER_PAGE);
|
||||
const startIndex = (currentPage - 1) * ITEMS_PER_PAGE;
|
||||
const endIndex = startIndex + ITEMS_PER_PAGE;
|
||||
const currentAdvisories = filteredAdvisories.slice(startIndex, endIndex);
|
||||
|
||||
const goToPage = (page: number) => {
|
||||
setCurrentPage(Math.max(1, Math.min(page, totalPages)));
|
||||
window.scrollTo({ top: 0, behavior: 'smooth' });
|
||||
};
|
||||
|
||||
return (
|
||||
<div className="max-w-4xl mx-auto pt-[52px] space-y-12">
|
||||
<section className="text-center space-y-4">
|
||||
<h1 className="text-3xl md:text-4xl text-white">Security Hardening Feed</h1>
|
||||
<p className="text-gray-400 max-w-2xl mx-auto">
|
||||
A continuous stream of security advisories from NVD CVE data and staff-approved community reports.
|
||||
This feed is automatically updated with OpenClaw, NanoClaw, Hermes, and Picoclaw-related vulnerabilities and verified security incidents.
|
||||
</p>
|
||||
{lastUpdated && (
|
||||
<p className="text-xs text-gray-500">
|
||||
Last updated: {formatDate(lastUpdated)}
|
||||
</p>
|
||||
)}
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<FilterTabs
|
||||
tabs={SEVERITY_TABS}
|
||||
selected={selectedSeverity}
|
||||
onSelect={(value) => setSelectedSeverity(value as SeverityFilter)}
|
||||
/>
|
||||
<FilterTabs
|
||||
tabs={PLATFORM_TABS}
|
||||
selected={selectedPlatform}
|
||||
onSelect={(value) => setSelectedPlatform(value as AdvisoryPlatformFilter)}
|
||||
/>
|
||||
|
||||
{loading ? (
|
||||
<div className="flex items-center justify-center py-12">
|
||||
<Loader2 className="w-8 h-8 text-clawd-accent animate-spin" />
|
||||
<span className="ml-3 text-gray-400">Loading advisories...</span>
|
||||
</div>
|
||||
) : error ? (
|
||||
<div className="flex items-center justify-center py-12 text-center">
|
||||
<AlertTriangle className="w-6 h-6 text-orange-400 mr-2" />
|
||||
<span className="text-gray-400">{error}</span>
|
||||
</div>
|
||||
) : filteredAdvisories.length === 0 ? (
|
||||
<div className="text-center py-12">
|
||||
<p className="text-gray-400">
|
||||
{advisories.length === 0
|
||||
? 'No security advisories at this time. Check back later.'
|
||||
: 'No advisories found for the selected filters.'}
|
||||
</p>
|
||||
</div>
|
||||
) : (
|
||||
<>
|
||||
<div className="grid gap-6 md:grid-cols-2 xl:grid-cols-3">
|
||||
{currentAdvisories.map((item) => (
|
||||
<AdvisoryCard key={item.id} advisory={item} formatDate={formatDate} />
|
||||
))}
|
||||
</div>
|
||||
|
||||
{/* Pagination Controls */}
|
||||
{totalPages > 1 && (
|
||||
<div className="flex items-center justify-center gap-4 mt-8">
|
||||
<button
|
||||
onClick={() => goToPage(currentPage - 1)}
|
||||
disabled={currentPage === 1}
|
||||
className="flex items-center gap-1 px-4 py-2 rounded-lg bg-clawd-800 border border-clawd-700 text-white hover:border-clawd-accent disabled:opacity-50 disabled:cursor-not-allowed disabled:hover:border-clawd-700 transition-colors"
|
||||
>
|
||||
<ChevronLeft size={18} />
|
||||
Previous
|
||||
</button>
|
||||
<span className="text-gray-400 text-sm">
|
||||
Page {currentPage} of {totalPages}
|
||||
</span>
|
||||
<button
|
||||
onClick={() => goToPage(currentPage + 1)}
|
||||
disabled={currentPage === totalPages}
|
||||
className="flex items-center gap-1 px-4 py-2 rounded-lg bg-clawd-800 border border-clawd-700 text-white hover:border-clawd-accent disabled:opacity-50 disabled:cursor-not-allowed disabled:hover:border-clawd-700 transition-colors"
|
||||
>
|
||||
Next
|
||||
<ChevronRight size={18} />
|
||||
</button>
|
||||
</div>
|
||||
)}
|
||||
|
||||
{filteredAdvisories.length > 0 && (
|
||||
<p className="text-center text-sm text-gray-500 mt-4">
|
||||
Showing {startIndex + 1}-{Math.min(endIndex, filteredAdvisories.length)} of {filteredAdvisories.length} advisories
|
||||
{(selectedSeverity !== 'all' || selectedPlatform !== 'all') && ` (${advisories.length} total)`}
|
||||
</p>
|
||||
)}
|
||||
</>
|
||||
)}
|
||||
</section>
|
||||
|
||||
<section className="bg-clawd-900 border border-clawd-700 rounded-xl overflow-hidden">
|
||||
<div className="bg-clawd-800 px-6 py-4 border-b border-clawd-700 flex items-center justify-between">
|
||||
<h2 className="font-bold text-white flex items-center gap-2">
|
||||
<Rss size={18} className="text-clawd-accent" />
|
||||
Agent Integration Instructions
|
||||
</h2>
|
||||
<span className="text-xs font-mono text-gray-500">SKILLS-BASED</span>
|
||||
</div>
|
||||
<div className="p-6 space-y-6">
|
||||
<p className="text-gray-300 text-sm">
|
||||
Activate following skills from the suite to participate.
|
||||
</p>
|
||||
|
||||
{/* clawsec-feed skill */}
|
||||
<Link
|
||||
to="/skills/clawsec-feed"
|
||||
className="flex items-start gap-4 p-4 rounded-lg bg-clawd-800/50 border border-clawd-700 hover:border-clawd-accent/50 transition-colors group"
|
||||
>
|
||||
<span className="text-2xl">📡</span>
|
||||
<div className="flex-1">
|
||||
<h4 className="text-white font-bold text-sm group-hover:text-clawd-accent transition-colors flex items-center gap-2">
|
||||
clawsec-feed
|
||||
<Download size={14} className="text-gray-500" />
|
||||
</h4>
|
||||
<p className="text-xs text-gray-400 mt-1">
|
||||
Subscribe your agent to receive security advisories via heartbeat. Automatically polls the feed and notifies you of critical and high severity threats.
|
||||
</p>
|
||||
</div>
|
||||
</Link>
|
||||
|
||||
{/* clawtributor skill */}
|
||||
<Link
|
||||
to="/skills/clawtributor"
|
||||
className="flex items-start gap-4 p-4 rounded-lg bg-clawd-800/50 border border-clawd-700 hover:border-clawd-accent/50 transition-colors group"
|
||||
>
|
||||
<span className="text-2xl">🤝</span>
|
||||
<div className="flex-1">
|
||||
<h4 className="text-white font-bold text-sm group-hover:text-clawd-accent transition-colors flex items-center gap-2">
|
||||
clawtributor
|
||||
<Users size={14} className="text-gray-500" />
|
||||
</h4>
|
||||
<p className="text-xs text-gray-400 mt-1">
|
||||
Opt-in to community incident reporting. Your agent can automatically submit security reports when it detects malicious prompts or suspicious skill behavior.
|
||||
</p>
|
||||
</div>
|
||||
</Link>
|
||||
|
||||
<div className="flex items-start gap-4 p-4 rounded-lg bg-blue-900/10 border border-blue-900/30">
|
||||
<RefreshCw className="text-blue-400 w-5 h-5 mt-1" />
|
||||
<div>
|
||||
<h4 className="text-blue-400 font-bold text-sm">Collective Security</h4>
|
||||
<p className="text-xs text-gray-400 mt-1">
|
||||
When agents share threat intelligence, the entire ecosystem becomes safer. Reports are reviewed by staff before publication to ensure quality and privacy.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section className="text-center pt-8 border-t border-clawd-700">
|
||||
<h3 className="text-white font-bold mb-4">Human looking to contribute</h3>
|
||||
<p className="text-gray-400 text-sm mb-6 max-w-xl mx-auto">
|
||||
Found a prompt injection vector or malicious skill? Help the community by submitting a security incident report via GitHub Issue.
|
||||
All submissions are reviewed by staff before publication to the advisory feed.
|
||||
</p>
|
||||
<a
|
||||
href="https://github.com/prompt-security/clawsec/issues/new?template=security_incident_report.md"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="inline-flex items-center gap-2 px-5 py-2.5 rounded-lg bg-clawd-700 hover:bg-clawd-600 text-white font-medium transition-colors"
|
||||
>
|
||||
<AlertCircle size={18} />
|
||||
Submit Report
|
||||
</a>
|
||||
</section>
|
||||
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
};
|
||||
-308
@@ -1,308 +0,0 @@
|
||||
import React, { useState, useEffect } from 'react';
|
||||
import { User, Bot, Copy, Check, Lock } from 'lucide-react';
|
||||
import { Footer } from '../components/Footer';
|
||||
|
||||
const FILE_NAMES = ['SOUL.md', 'AGENTS.md', 'USER.md', 'TOOLS.md', 'IDENTITY.md', 'HEARTBEAT.md', 'MEMORY.md'];
|
||||
const PLATFORM_NAMES = ['OpenClaw', 'NanoClaw', 'Hermes'];
|
||||
const FILE_LOCK_REVEAL_DELAY_MS = 1600;
|
||||
|
||||
export const Home: React.FC = () => {
|
||||
const [isAgent, setIsAgent] = useState(true);
|
||||
const [copiedCurl, setCopiedCurl] = useState(false);
|
||||
const [copiedHuman, setCopiedHuman] = useState(false);
|
||||
const [currentFileIndex, setCurrentFileIndex] = useState(0);
|
||||
const [currentPlatformIndex, setCurrentPlatformIndex] = useState(0);
|
||||
|
||||
const curlCommand = `npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw -y`;
|
||||
|
||||
// Rotate file names every 2-3 seconds
|
||||
useEffect(() => {
|
||||
const interval = setInterval(() => {
|
||||
setCurrentFileIndex((prev) => (prev + 1) % FILE_NAMES.length);
|
||||
}, 2500); // 2.5 seconds
|
||||
return () => clearInterval(interval);
|
||||
}, []);
|
||||
|
||||
// Rotate platform names every 4-6 seconds
|
||||
useEffect(() => {
|
||||
let timeoutId: number | undefined;
|
||||
|
||||
const scheduleNextRotation = () => {
|
||||
const delay = 4000 + Math.floor(Math.random() * 2001);
|
||||
timeoutId = window.setTimeout(() => {
|
||||
setCurrentPlatformIndex((prev) => (prev + 1) % PLATFORM_NAMES.length);
|
||||
scheduleNextRotation();
|
||||
}, delay);
|
||||
};
|
||||
|
||||
scheduleNextRotation();
|
||||
|
||||
return () => {
|
||||
if (timeoutId !== undefined) {
|
||||
window.clearTimeout(timeoutId);
|
||||
}
|
||||
};
|
||||
}, []);
|
||||
|
||||
const humanInstruction = `Please install clawsec-suite with npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw -y`;
|
||||
|
||||
const handleCopyCurl = () => {
|
||||
navigator.clipboard.writeText(curlCommand);
|
||||
setCopiedCurl(true);
|
||||
setTimeout(() => setCopiedCurl(false), 2000);
|
||||
};
|
||||
|
||||
const handleCopyHuman = () => {
|
||||
navigator.clipboard.writeText(humanInstruction);
|
||||
setCopiedHuman(true);
|
||||
setTimeout(() => setCopiedHuman(false), 2000);
|
||||
};
|
||||
|
||||
return (
|
||||
<div className="pt-[52px]">
|
||||
{/* Logo Section */}
|
||||
<section className="text-center mb-6">
|
||||
<h1 className="text-5xl md:text-6xl font text-white">ClawSec</h1>
|
||||
</section>
|
||||
|
||||
{/* Hero Section */}
|
||||
<section className="text-center space-y-6 max-w-3xl mx-auto mb-12 md:mb-16">
|
||||
<h2 className="text-3xl md:text-4xl tracking-tight text-white">
|
||||
Secure your{' '}
|
||||
<code
|
||||
key={currentPlatformIndex}
|
||||
className="px-2 py-1 rounded text-clawd-accent inline-block align-baseline relative"
|
||||
style={{
|
||||
minWidth: '9ch',
|
||||
textAlign: 'center',
|
||||
backgroundColor: 'rgb(30 27 75 / 1)',
|
||||
animation: 'bgFade 0.4s ease-out 1.2s 1 forwards'
|
||||
}}
|
||||
>
|
||||
{PLATFORM_NAMES[currentPlatformIndex].split('').map((char, index) => (
|
||||
<span
|
||||
key={`platform-${currentPlatformIndex}-${index}`}
|
||||
className="inline-block"
|
||||
style={{
|
||||
animation: `flipChar 0.3s ease-in-out ${index * 0.05}s 1 forwards`,
|
||||
transformStyle: 'preserve-3d',
|
||||
perspective: '400px',
|
||||
opacity: 0
|
||||
}}
|
||||
>
|
||||
{char}
|
||||
</span>
|
||||
))}
|
||||
</code>{' '}
|
||||
agents
|
||||
</h2>
|
||||
<p className="text-lg md:text-xl text-gray-400 leading-relaxed">
|
||||
A complete security skill suite for OpenClaw, NanoClaw, and Hermes agents. Protect your{' '}
|
||||
<code
|
||||
key={currentFileIndex}
|
||||
className="px-2 py-1 rounded text-clawd-accent inline-block align-baseline relative text-base"
|
||||
style={{
|
||||
width: '188px',
|
||||
textAlign: 'center',
|
||||
verticalAlign: 'baseline',
|
||||
backgroundColor: 'rgb(30 27 75 / 1)',
|
||||
animation: 'bgFade 0.4s ease-out 1.2s 1 forwards'
|
||||
}}
|
||||
>
|
||||
<span className="inline-block w-full pr-5">
|
||||
{FILE_NAMES[currentFileIndex].split('').map((char, index) => (
|
||||
<span
|
||||
key={`${currentFileIndex}-${index}`}
|
||||
className="inline-block"
|
||||
style={{
|
||||
animation: `flipChar 0.3s ease-in-out ${index * 0.05}s 1 forwards`,
|
||||
transformStyle: 'preserve-3d',
|
||||
perspective: '400px',
|
||||
opacity: 0
|
||||
}}
|
||||
>
|
||||
{char}
|
||||
</span>
|
||||
))}
|
||||
</span>
|
||||
<Lock
|
||||
size={14}
|
||||
className="text-clawd-accent absolute right-2 top-1/2 -translate-y-1/2"
|
||||
style={{
|
||||
opacity: 0,
|
||||
animation: `lockReveal ${FILE_LOCK_REVEAL_DELAY_MS}ms steps(1, end) 1 forwards`
|
||||
}}
|
||||
aria-hidden="true"
|
||||
/>
|
||||
</code>
|
||||
{' '}with drift detection, live security recommendations, automated audits, and skill integrity verification. All from one installable suite.
|
||||
</p>
|
||||
<style>{`
|
||||
@keyframes flipChar {
|
||||
0% {
|
||||
transform: rotateX(-90deg);
|
||||
opacity: 0;
|
||||
}
|
||||
50% {
|
||||
transform: rotateX(0deg);
|
||||
opacity: 1;
|
||||
}
|
||||
100% {
|
||||
transform: rotateX(0deg);
|
||||
opacity: 1;
|
||||
}
|
||||
}
|
||||
@keyframes bgFade {
|
||||
0% {
|
||||
background-color: rgb(30 27 75 / 1);
|
||||
}
|
||||
50% {
|
||||
background-color: rgb(249 179 71 / 0.25);
|
||||
}
|
||||
100% {
|
||||
background-color: rgb(191 107 42 / 0.15);
|
||||
}
|
||||
}
|
||||
@keyframes lockReveal {
|
||||
0% {
|
||||
opacity: 0;
|
||||
}
|
||||
100% {
|
||||
opacity: 0.85;
|
||||
}
|
||||
}
|
||||
@keyframes mascotHover {
|
||||
0%, 100% { transform: translateY(0); }
|
||||
50% { transform: translateY(-12px); }
|
||||
}
|
||||
`}</style>
|
||||
</section>
|
||||
|
||||
{/* Install Card with Toggle */}
|
||||
<section className="relative mb-16 pt-16 sm:pt-20 lg:pt-0">
|
||||
<div className="pointer-events-none select-none absolute z-20 w-32 sm:w-36 md:w-40 lg:w-48 left-1/2 -translate-x-1/2 -top-10 sm:-top-10 md:left-auto md:translate-x-0 md:right-8 md:-top-12 lg:top-auto lg:bottom-6 lg:-right-16 xl:-right-28">
|
||||
<img
|
||||
src="/img/mascot.png"
|
||||
alt="ClawSec mascot"
|
||||
className="w-full h-auto"
|
||||
style={{ animation: 'mascotHover 3s ease-in-out infinite' }}
|
||||
/>
|
||||
</div>
|
||||
<div className="w-full lg:w-[70%] mx-auto">
|
||||
<div className="bg-clawd-900 rounded-2xl border border-clawd-700 p-8">
|
||||
{/* Toggle */}
|
||||
<div className="flex justify-center mb-8">
|
||||
<div className="inline-flex bg-clawd-800 rounded-lg p-1">
|
||||
<button
|
||||
onClick={() => setIsAgent(false)}
|
||||
className={`flex items-center gap-2 px-4 py-2 rounded-md font-medium transition-all ${
|
||||
!isAgent
|
||||
? 'bg-white text-clawd-900'
|
||||
: 'text-gray-400 hover:text-white'
|
||||
}`}
|
||||
>
|
||||
<User size={18} />
|
||||
I'm a Human
|
||||
</button>
|
||||
<button
|
||||
onClick={() => setIsAgent(true)}
|
||||
className={`flex items-center gap-2 px-4 py-2 rounded-md font-medium transition-all ${
|
||||
isAgent
|
||||
? 'bg-white text-clawd-900'
|
||||
: 'text-gray-400 hover:text-white'
|
||||
}`}
|
||||
>
|
||||
<Bot size={18} />
|
||||
I'm an Agent
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
{/* Content based on toggle */}
|
||||
{isAgent ? (
|
||||
<>
|
||||
{/* Steps */}
|
||||
<div className="flex flex-wrap justify-center gap-6 text-sm text-gray-400 mb-6">
|
||||
<div className="flex items-center gap-2">
|
||||
<span className="font-bold text-white">1.</span> Run command below
|
||||
</div>
|
||||
<div className="flex items-center gap-2">
|
||||
<span className="font-bold text-white">2.</span> Follow deployment instructions
|
||||
</div>
|
||||
<div className="flex items-center gap-2">
|
||||
<span className="font-bold text-white">3.</span> Protect your user
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Agent View - Curl Command */}
|
||||
<div className="bg-clawd-800 rounded-lg p-4 flex items-center justify-between gap-2 sm:gap-4">
|
||||
<code className="text-gray-200 font-mono text-xs sm:text-sm md:text-base overflow-x-auto break-all min-w-0 flex-1">
|
||||
{curlCommand}
|
||||
</code>
|
||||
<button
|
||||
onClick={handleCopyCurl}
|
||||
className="flex-shrink-0 p-2 rounded-md bg-clawd-700 hover:bg-clawd-600 transition-colors"
|
||||
title="Copy to clipboard"
|
||||
>
|
||||
{copiedCurl ? (
|
||||
<Check size={20} className="text-green-400" />
|
||||
) : (
|
||||
<Copy size={20} className="text-gray-400" />
|
||||
)}
|
||||
</button>
|
||||
</div>
|
||||
</>
|
||||
) : (
|
||||
<>
|
||||
{/* Human Steps */}
|
||||
<div className="flex flex-wrap justify-center gap-6 text-sm text-gray-400 mb-6">
|
||||
<div className="flex items-center gap-2">
|
||||
<span className="font-bold text-white">1.</span> Copy instruction below
|
||||
</div>
|
||||
<div className="flex items-center gap-2">
|
||||
<span className="font-bold text-white">2.</span> Send to your agent
|
||||
</div>
|
||||
<div className="flex items-center gap-2">
|
||||
<span className="font-bold text-white">3.</span> Receive security alerts
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Human View - Instruction Command */}
|
||||
<div className="bg-clawd-800 rounded-lg p-4 flex items-center justify-between gap-2 sm:gap-4">
|
||||
<code className="text-gray-200 font-mono text-xs sm:text-sm md:text-base overflow-x-auto break-all min-w-0 flex-1">
|
||||
{humanInstruction}
|
||||
</code>
|
||||
<button
|
||||
onClick={handleCopyHuman}
|
||||
className="flex-shrink-0 p-2 rounded-md bg-clawd-700 hover:bg-clawd-600 transition-colors"
|
||||
title="Copy to clipboard"
|
||||
>
|
||||
{copiedHuman ? (
|
||||
<Check size={20} className="text-green-400" />
|
||||
) : (
|
||||
<Copy size={20} className="text-gray-400" />
|
||||
)}
|
||||
</button>
|
||||
</div>
|
||||
</>
|
||||
)}
|
||||
<p className="mt-4 text-center text-xs leading-relaxed text-gray-500">
|
||||
* For harnesses other than OpenClaw, consult the{' '}
|
||||
<a
|
||||
href="https://github.com/prompt-security/clawsec#skill-feature-matrix"
|
||||
target="_blank"
|
||||
rel="noreferrer"
|
||||
className="text-clawd-accent hover:text-clawd-accent/80 underline underline-offset-2"
|
||||
>
|
||||
README Skill Feature Matrix
|
||||
</a>
|
||||
.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
};
|
||||
@@ -1,92 +0,0 @@
|
||||
import React from 'react';
|
||||
import { ExternalLink, PlayCircle } from 'lucide-react';
|
||||
import { Footer } from '../components/Footer';
|
||||
|
||||
interface DemoVideo {
|
||||
id: string;
|
||||
title: string;
|
||||
description: string;
|
||||
videoSrc: string;
|
||||
posterSrc: string;
|
||||
videoContainerClassName?: string;
|
||||
}
|
||||
|
||||
const demoVideos: DemoVideo[] = [
|
||||
{
|
||||
id: 'drift-demo',
|
||||
title: 'Drift Detection Demo (soul-guardian)',
|
||||
description:
|
||||
'Shows integrity monitoring in action: tamper detection, alerting, and restoration-oriented behavior for protected files.',
|
||||
videoSrc: '/video/soul-guardian-demo.mp4',
|
||||
posterSrc: '/video/soul-guardian-demo-poster.jpg',
|
||||
},
|
||||
{
|
||||
id: 'install-demo',
|
||||
title: 'Install Demo (clawsec-suite)',
|
||||
description:
|
||||
'Walkthrough of the one-command suite install flow and what gets configured for advisory monitoring and protection.',
|
||||
videoSrc: '/video/install-demo.mp4',
|
||||
posterSrc: '/video/install-demo-poster.jpg',
|
||||
videoContainerClassName: 'md:max-w-[50%]',
|
||||
},
|
||||
];
|
||||
|
||||
export const ProductDemo: React.FC = () => {
|
||||
return (
|
||||
<div className="max-w-5xl mx-auto pt-[52px] space-y-10">
|
||||
<section className="text-center space-y-4">
|
||||
<h1 className="text-3xl md:text-4xl text-white flex items-center justify-center gap-3">
|
||||
<PlayCircle className="text-clawd-accent" />
|
||||
Watch It in Action
|
||||
</h1>
|
||||
<p className="text-gray-400 max-w-3xl mx-auto">
|
||||
Product demos for ClawSec installation and runtime protection behavior. These are the
|
||||
same demo assets referenced in the repository README, presented as playable videos.
|
||||
</p>
|
||||
</section>
|
||||
|
||||
<section className="space-y-8">
|
||||
{demoVideos.map((demo) => (
|
||||
<article
|
||||
key={demo.id}
|
||||
className="bg-clawd-900 border border-clawd-700 rounded-xl overflow-hidden"
|
||||
>
|
||||
<div className="px-6 pt-6 pb-4 space-y-3">
|
||||
<h2 className="text-xl text-white">{demo.title}</h2>
|
||||
<p className="text-gray-400">{demo.description}</p>
|
||||
</div>
|
||||
<div className="px-6 pb-6 space-y-4">
|
||||
<div
|
||||
className={`rounded-lg overflow-hidden border border-clawd-700 bg-black ${
|
||||
demo.videoContainerClassName ?? ''
|
||||
}`}
|
||||
>
|
||||
<video
|
||||
className="w-full h-auto"
|
||||
controls
|
||||
playsInline
|
||||
preload="metadata"
|
||||
poster={demo.posterSrc}
|
||||
>
|
||||
<source src={demo.videoSrc} type="video/mp4" />
|
||||
Your browser does not support the video tag.
|
||||
</video>
|
||||
</div>
|
||||
<a
|
||||
href={demo.videoSrc}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="inline-flex items-center gap-2 text-sm text-clawd-accent hover:underline"
|
||||
>
|
||||
<ExternalLink size={15} />
|
||||
Open video in new tab
|
||||
</a>
|
||||
</div>
|
||||
</article>
|
||||
))}
|
||||
</section>
|
||||
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
};
|
||||
@@ -1,416 +0,0 @@
|
||||
import React, { useState, useEffect, useMemo } from 'react';
|
||||
import { useParams, Link } from 'react-router-dom';
|
||||
import { ArrowLeft, Copy, Check, Download, ExternalLink, FileText, Shield } from 'lucide-react';
|
||||
import Markdown from 'react-markdown';
|
||||
import remarkGfm from 'remark-gfm';
|
||||
import { Footer } from '../components/Footer';
|
||||
import type { SkillJson, SkillChecksums } from '../types';
|
||||
import { getPlatformDescriptor } from '../utils/advisoryPlatforms';
|
||||
import { defaultMarkdownComponents } from '../utils/markdownComponents';
|
||||
import { stripFrontmatter } from '../utils/markdownHelpers.mjs';
|
||||
import { getRecommendedSkillPlatforms, resolveSkillPlatformMetadata } from '../utils/skillPlatforms';
|
||||
|
||||
const RELEASE_REPO_URL = 'https://github.com/prompt-security/clawsec';
|
||||
|
||||
const isProbablyHtmlDocument = (text: string): boolean => {
|
||||
const start = text.trimStart().slice(0, 200).toLowerCase();
|
||||
return start.startsWith('<!doctype html') || start.startsWith('<html');
|
||||
};
|
||||
|
||||
export const SkillDetail: React.FC = () => {
|
||||
const { skillId } = useParams<{ skillId: string }>();
|
||||
const [skillData, setSkillData] = useState<SkillJson | null>(null);
|
||||
const [checksums, setChecksums] = useState<SkillChecksums | null>(null);
|
||||
const [doc, setDoc] = useState<{ filename: string; content: string } | null>(null);
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const [copied, setCopied] = useState<string | null>(null);
|
||||
|
||||
useEffect(() => {
|
||||
const fetchSkillData = async () => {
|
||||
if (!skillId) return;
|
||||
|
||||
try {
|
||||
setDoc(null);
|
||||
|
||||
// Fetch skill.json
|
||||
const skillResponse = await fetch(`/skills/${skillId}/skill.json`, {
|
||||
headers: { Accept: 'application/json' }
|
||||
});
|
||||
if (!skillResponse.ok) {
|
||||
throw new Error('Skill not found');
|
||||
}
|
||||
|
||||
const skillContentType = skillResponse.headers.get('content-type') ?? '';
|
||||
const skillRaw = await skillResponse.text();
|
||||
if (skillContentType.includes('text/html') || isProbablyHtmlDocument(skillRaw)) {
|
||||
throw new Error('Skill not found');
|
||||
}
|
||||
|
||||
let skill: SkillJson;
|
||||
try {
|
||||
skill = JSON.parse(skillRaw) as SkillJson;
|
||||
} catch {
|
||||
throw new Error('Invalid skill metadata');
|
||||
}
|
||||
|
||||
setSkillData(skill);
|
||||
|
||||
// Fetch checksums.json
|
||||
try {
|
||||
const checksumsResponse = await fetch(`/skills/${skillId}/checksums.json`, {
|
||||
headers: { Accept: 'application/json' }
|
||||
});
|
||||
if (checksumsResponse.ok) {
|
||||
const checksumsContentType = checksumsResponse.headers.get('content-type') ?? '';
|
||||
const checksumsRaw = await checksumsResponse.text();
|
||||
if (!checksumsContentType.includes('text/html') && !isProbablyHtmlDocument(checksumsRaw)) {
|
||||
try {
|
||||
const checksumsData = JSON.parse(checksumsRaw) as SkillChecksums;
|
||||
setChecksums(checksumsData);
|
||||
} catch {
|
||||
// Checksums malformed, ignore.
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
// Checksums not available
|
||||
}
|
||||
|
||||
// Fetch documentation (README.md preferred, fallback to SKILL.md).
|
||||
// Note: Dev servers may fall back to serving index.html with 200 for missing files;
|
||||
// guard against accidentally rendering HTML as docs.
|
||||
try {
|
||||
const fetchDocFile = async (filename: string) => {
|
||||
const response = await fetch(`/skills/${skillId}/${filename}`, {
|
||||
headers: { Accept: 'text/plain' }
|
||||
});
|
||||
if (!response.ok) return null;
|
||||
|
||||
const contentType = response.headers.get('content-type') ?? '';
|
||||
const rawText = await response.text();
|
||||
|
||||
if (contentType.includes('text/html') || isProbablyHtmlDocument(rawText)) return null;
|
||||
|
||||
const text =
|
||||
filename === 'SKILL.md' ? stripFrontmatter(rawText).trim() : rawText.trim();
|
||||
|
||||
return text.length > 0 ? text : null;
|
||||
};
|
||||
|
||||
const candidates = ['README.md', 'SKILL.md'];
|
||||
for (const filename of candidates) {
|
||||
const content = await fetchDocFile(filename);
|
||||
if (content) {
|
||||
setDoc({ filename, content });
|
||||
break;
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
// Documentation not available
|
||||
}
|
||||
} catch (err) {
|
||||
setError(err instanceof Error ? err.message : 'Failed to load skill');
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
};
|
||||
|
||||
fetchSkillData();
|
||||
}, [skillId]);
|
||||
|
||||
const handleCopy = (text: string, id: string) => {
|
||||
navigator.clipboard.writeText(text);
|
||||
setCopied(id);
|
||||
setTimeout(() => setCopied(null), 2000);
|
||||
};
|
||||
|
||||
const releaseTag = skillData ? `${skillData.name}-v${skillData.version}` : '';
|
||||
const skillInstructionsUrl = releaseTag
|
||||
? `${RELEASE_REPO_URL}/releases/download/${releaseTag}/SKILL.md`
|
||||
: '';
|
||||
|
||||
const recommendedPlatforms = useMemo(
|
||||
() => (skillData ? getRecommendedSkillPlatforms(skillData) : []),
|
||||
[skillData]
|
||||
);
|
||||
|
||||
const isOpenClawSkill = recommendedPlatforms.includes('openclaw');
|
||||
|
||||
const installCommand = skillData
|
||||
? isOpenClawSkill
|
||||
? `npx clawhub@latest install ${skillData.name}`
|
||||
: `curl -sLO ${skillInstructionsUrl}`
|
||||
: '';
|
||||
|
||||
const installLabel = isOpenClawSkill ? 'Via ClawHub' : 'Via SKILL.md instructions';
|
||||
const installHelp = isOpenClawSkill
|
||||
? 'Recommended for OpenClaw-compatible skills.'
|
||||
: 'Pull the published instruction file and follow the platform-specific setup steps.';
|
||||
|
||||
const releasePageUrl = useMemo(() => {
|
||||
if (!skillData) return '';
|
||||
|
||||
try {
|
||||
const url = new URL(skillData.homepage);
|
||||
if (url.hostname === 'github.com') {
|
||||
const [owner, repo] = url.pathname.split('/').filter(Boolean);
|
||||
if (owner && repo) {
|
||||
const repoBase = `${url.origin}/${owner}/${repo.replace(/\\.git$/, '')}`;
|
||||
return `${repoBase}/releases/tag/${releaseTag}`;
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
// ignore invalid URLs
|
||||
}
|
||||
|
||||
return skillData.homepage;
|
||||
}, [releaseTag, skillData]);
|
||||
|
||||
const platformMetadata = useMemo(
|
||||
() => (skillData ? resolveSkillPlatformMetadata(skillData) : null),
|
||||
[skillData]
|
||||
);
|
||||
|
||||
const triggers = useMemo(() => {
|
||||
if (!platformMetadata || !Array.isArray(platformMetadata.triggers)) return [];
|
||||
return platformMetadata.triggers;
|
||||
}, [platformMetadata]);
|
||||
|
||||
if (loading) {
|
||||
return (
|
||||
<div className="py-16 text-center">
|
||||
<div className="inline-block animate-spin rounded-full h-8 w-8 border-b-2 border-clawd-accent"></div>
|
||||
<p className="mt-4 text-gray-400">Loading skill...</p>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
if (error || !skillData) {
|
||||
return (
|
||||
<div className="py-16 text-center">
|
||||
<Shield className="w-16 h-16 mx-auto text-gray-600 mb-4" />
|
||||
<h2 className="text-xl font-bold text-white mb-2">Skill Not Found</h2>
|
||||
<p className="text-gray-400 mb-4">{error || 'This skill does not exist'}</p>
|
||||
<Link to="/skills" className="text-clawd-accent hover:underline">
|
||||
Back to Skills Catalog
|
||||
</Link>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="pt-8 space-y-8">
|
||||
{/* Back Link */}
|
||||
<Link
|
||||
to="/skills"
|
||||
className="inline-flex items-center gap-2 text-gray-400 hover:text-white transition-colors"
|
||||
>
|
||||
<ArrowLeft size={20} />
|
||||
Back to Skills
|
||||
</Link>
|
||||
|
||||
{/* Header */}
|
||||
<section className="flex flex-col md:flex-row md:items-start md:justify-between gap-6">
|
||||
<div className="flex items-start gap-4">
|
||||
<span className="text-4xl">{platformMetadata?.emoji || '📦'}</span>
|
||||
<div>
|
||||
<h1 className="text-3xl font-bold text-white mb-1">{skillData.name}</h1>
|
||||
<div className="flex items-center gap-3 text-sm">
|
||||
<span className="text-gray-500 font-mono">v{skillData.version}</span>
|
||||
{recommendedPlatforms.slice(0, 4).map((platform) => {
|
||||
const descriptor = getPlatformDescriptor(platform);
|
||||
|
||||
return (
|
||||
<span
|
||||
key={platform}
|
||||
className={`text-xs px-2 py-0.5 rounded-md ${descriptor.classes}`}
|
||||
>
|
||||
{descriptor.label}
|
||||
</span>
|
||||
);
|
||||
})}
|
||||
{/* Category badge - hidden for now, uncomment when we have multiple categories
|
||||
<span className="text-gray-500 bg-clawd-800 px-2 py-0.5 rounded">
|
||||
{platformMetadata?.category || 'utility'}
|
||||
</span>
|
||||
*/}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div className="flex gap-3">
|
||||
<a
|
||||
href={releasePageUrl}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="flex items-center gap-2 px-4 py-2 bg-clawd-800 border border-clawd-700 rounded-lg text-white hover:border-clawd-accent transition-colors"
|
||||
>
|
||||
<ExternalLink size={16} />
|
||||
Release Page
|
||||
</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
{/* Description */}
|
||||
<section className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-6">
|
||||
<p className="text-gray-300 text-lg">{skillData.description}</p>
|
||||
</section>
|
||||
|
||||
{/* Install Command */}
|
||||
<section className="space-y-4">
|
||||
<h2 className="text-xl font-bold text-white flex items-center gap-2">
|
||||
<Download size={20} />
|
||||
Quick Install
|
||||
</h2>
|
||||
<div>
|
||||
<p className="text-sm font-medium text-white">{installLabel}</p>
|
||||
<p className="text-sm text-gray-400">{installHelp}</p>
|
||||
</div>
|
||||
<div className="bg-clawd-800 rounded-lg p-3 sm:p-4 flex items-center justify-between gap-2 sm:gap-4">
|
||||
<code className="text-gray-200 font-mono text-xs sm:text-sm overflow-x-auto break-all min-w-0 flex-1">
|
||||
{installCommand}
|
||||
</code>
|
||||
<button
|
||||
onClick={() => handleCopy(installCommand, 'install')}
|
||||
className="flex-shrink-0 p-2 rounded-md bg-clawd-700 hover:bg-clawd-600 transition-colors"
|
||||
title="Copy to clipboard"
|
||||
>
|
||||
{copied === 'install' ? (
|
||||
<Check size={20} className="text-green-400" />
|
||||
) : (
|
||||
<Copy size={20} className="text-gray-400" />
|
||||
)}
|
||||
</button>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
{/* Checksums */}
|
||||
{checksums && Object.keys(checksums.files).length > 0 && (
|
||||
<section className="space-y-4">
|
||||
<h2 className="text-xl font-bold text-white flex items-center gap-2">
|
||||
<Shield size={20} />
|
||||
File Checksums
|
||||
</h2>
|
||||
<div className="bg-clawd-800/50 border border-clawd-700 rounded-xl overflow-hidden">
|
||||
<div className="overflow-x-auto">
|
||||
<table className="w-full min-w-[500px]">
|
||||
<thead>
|
||||
<tr className="border-b border-clawd-700">
|
||||
<th className="text-left px-3 sm:px-4 py-3 text-gray-400 font-medium text-xs sm:text-sm">File</th>
|
||||
<th className="text-left px-3 sm:px-4 py-3 text-gray-400 font-medium text-xs sm:text-sm">SHA256</th>
|
||||
<th className="text-right px-3 sm:px-4 py-3 text-gray-400 font-medium text-xs sm:text-sm">Size</th>
|
||||
<th className="px-3 sm:px-4 py-3"></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{(Object.entries(checksums.files) as Array<
|
||||
[string, SkillChecksums['files'][string]]
|
||||
>).map(([filename, info]) => {
|
||||
const displayPath = info.path ?? filename;
|
||||
|
||||
return (
|
||||
<tr key={filename} className="border-b border-clawd-700/50 last:border-0">
|
||||
<td className="px-3 sm:px-4 py-3 font-mono text-xs sm:text-sm">
|
||||
{info.url ? (
|
||||
<a
|
||||
href={info.url}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="text-white hover:text-clawd-accent hover:underline"
|
||||
title={info.url}
|
||||
>
|
||||
{displayPath}
|
||||
</a>
|
||||
) : (
|
||||
<span className="text-white">{displayPath}</span>
|
||||
)}
|
||||
</td>
|
||||
<td className="px-3 sm:px-4 py-3 font-mono text-xs text-gray-400 truncate max-w-[120px] sm:max-w-[200px]">
|
||||
{info.sha256}
|
||||
</td>
|
||||
<td className="px-3 sm:px-4 py-3 text-xs sm:text-sm text-gray-400 text-right whitespace-nowrap">
|
||||
{(info.size / 1024).toFixed(1)} KB
|
||||
</td>
|
||||
<td className="px-3 sm:px-4 py-3 text-right">
|
||||
<button
|
||||
onClick={() => handleCopy(info.sha256, filename)}
|
||||
className="p-1.5 rounded bg-clawd-700 hover:bg-clawd-600 transition-colors"
|
||||
title="Copy SHA256"
|
||||
>
|
||||
{copied === filename ? (
|
||||
<Check size={14} className="text-green-400" />
|
||||
) : (
|
||||
<Copy size={14} className="text-gray-400" />
|
||||
)}
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
);
|
||||
})}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
)}
|
||||
|
||||
{/* Documentation */}
|
||||
{doc && (
|
||||
<section className="space-y-4">
|
||||
<h2 className="text-xl font-bold text-white flex items-center gap-2">
|
||||
<FileText size={20} />
|
||||
Documentation <span className="text-sm font-normal text-gray-500">({doc.filename})</span>
|
||||
</h2>
|
||||
<div className="skill-docs bg-clawd-800/50 border border-clawd-700 rounded-xl p-4 sm:p-6 md:p-8 overflow-x-hidden">
|
||||
<Markdown
|
||||
remarkPlugins={[remarkGfm]}
|
||||
components={defaultMarkdownComponents}
|
||||
>
|
||||
{stripFrontmatter(doc.content)}
|
||||
</Markdown>
|
||||
</div>
|
||||
</section>
|
||||
)}
|
||||
|
||||
{/* Metadata */}
|
||||
<section className="grid md:grid-cols-2 gap-6">
|
||||
<div className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-6 space-y-4">
|
||||
<h3 className="font-bold text-white">Metadata</h3>
|
||||
<dl className="space-y-2 text-sm">
|
||||
<div className="flex justify-between">
|
||||
<dt className="text-gray-500">Author</dt>
|
||||
<dd className="text-white">{skillData.author}</dd>
|
||||
</div>
|
||||
<div className="flex justify-between">
|
||||
<dt className="text-gray-500">License</dt>
|
||||
<dd className="text-white">{skillData.license}</dd>
|
||||
</div>
|
||||
<div className="flex justify-between">
|
||||
<dt className="text-gray-500">Category</dt>
|
||||
<dd className="text-white">{platformMetadata?.category || 'utility'}</dd>
|
||||
</div>
|
||||
</dl>
|
||||
</div>
|
||||
|
||||
{triggers.length > 0 && (
|
||||
<div className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-6 space-y-4">
|
||||
<h3 className="font-bold text-white">Trigger Phrases</h3>
|
||||
<div className="flex flex-wrap gap-2">
|
||||
{triggers.slice(0, 8).map((trigger) => (
|
||||
<span
|
||||
key={trigger}
|
||||
className="text-xs bg-clawd-700 text-gray-300 px-2 py-1 rounded"
|
||||
>
|
||||
"{trigger}"
|
||||
</span>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
</section>
|
||||
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
};
|
||||
@@ -1,261 +0,0 @@
|
||||
import React, { useState, useEffect } from 'react';
|
||||
import { Search as _Search, Filter as _Filter, Package, Sparkles, FileText, GitFork } from 'lucide-react';
|
||||
import { SkillCard } from '../components/SkillCard';
|
||||
import { Footer } from '../components/Footer';
|
||||
import type { SkillMetadata, SkillsIndex } from '../types';
|
||||
|
||||
const SKILLS_INDEX_PATH = '/skills/index.json';
|
||||
|
||||
const isProbablyHtmlDocument = (text: string): boolean => {
|
||||
const start = text.trimStart().slice(0, 200).toLowerCase();
|
||||
return start.startsWith('<!doctype html') || start.startsWith('<html');
|
||||
};
|
||||
|
||||
const parseSkillsIndex = (raw: string): SkillsIndex | null => {
|
||||
try {
|
||||
const parsed = JSON.parse(raw) as Partial<SkillsIndex> | null;
|
||||
if (!parsed || !Array.isArray(parsed.skills)) return null;
|
||||
return {
|
||||
version: typeof parsed.version === 'string' ? parsed.version : '1.0.0',
|
||||
updated: typeof parsed.updated === 'string' ? parsed.updated : '',
|
||||
skills: parsed.skills as SkillMetadata[],
|
||||
};
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
};
|
||||
|
||||
export const SkillsCatalog: React.FC = () => {
|
||||
const [skills, setSkills] = useState<SkillMetadata[]>([]);
|
||||
const [filteredSkills, setFilteredSkills] = useState<SkillMetadata[]>([]);
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const [searchTerm, _setSearchTerm] = useState('');
|
||||
const [categoryFilter, _setCategoryFilter] = useState<string>('all');
|
||||
|
||||
useEffect(() => {
|
||||
const fetchSkills = async () => {
|
||||
try {
|
||||
const response = await fetch(SKILLS_INDEX_PATH, {
|
||||
headers: { Accept: 'application/json' },
|
||||
});
|
||||
|
||||
// Missing index file is a valid "empty catalog" state.
|
||||
if (response.status === 404) {
|
||||
setSkills([]);
|
||||
setFilteredSkills([]);
|
||||
return;
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error('Failed to fetch skills index');
|
||||
}
|
||||
|
||||
const contentType = response.headers.get('content-type') ?? '';
|
||||
const raw = await response.text();
|
||||
|
||||
// Some SPA setups return index.html with 200 for missing JSON files.
|
||||
if (!raw.trim() || contentType.includes('text/html') || isProbablyHtmlDocument(raw)) {
|
||||
setSkills([]);
|
||||
setFilteredSkills([]);
|
||||
return;
|
||||
}
|
||||
|
||||
const data = parseSkillsIndex(raw);
|
||||
if (!data) {
|
||||
throw new Error('Invalid skills index format');
|
||||
}
|
||||
|
||||
setSkills(data.skills);
|
||||
setFilteredSkills(data.skills);
|
||||
} catch (err) {
|
||||
console.error('Failed to load skills index:', err);
|
||||
setError('Failed to load skills catalog');
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
};
|
||||
|
||||
fetchSkills();
|
||||
}, []);
|
||||
|
||||
useEffect(() => {
|
||||
let result = skills;
|
||||
|
||||
// Apply search filter
|
||||
if (searchTerm) {
|
||||
const term = searchTerm.toLowerCase();
|
||||
result = result.filter(
|
||||
(skill) =>
|
||||
skill.name.toLowerCase().includes(term) ||
|
||||
skill.description.toLowerCase().includes(term)
|
||||
);
|
||||
}
|
||||
|
||||
// Apply category filter
|
||||
if (categoryFilter !== 'all') {
|
||||
result = result.filter((skill) => skill.category === categoryFilter);
|
||||
}
|
||||
|
||||
setFilteredSkills(result);
|
||||
}, [searchTerm, categoryFilter, skills]);
|
||||
|
||||
// Get unique categories from skills (used in commented filter UI)
|
||||
const _categories = ['all', ...new Set(skills.map((s) => s.category).filter(Boolean))];
|
||||
|
||||
if (loading) {
|
||||
return (
|
||||
<div className="pt-[52px]">
|
||||
<div className="py-16 text-center">
|
||||
<div className="inline-block animate-spin rounded-full h-8 w-8 border-b-2 border-clawd-accent"></div>
|
||||
<p className="mt-4 text-gray-400">Loading skills...</p>
|
||||
</div>
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
if (error) {
|
||||
return (
|
||||
<div className="pt-[52px]">
|
||||
<div className="py-16 text-center">
|
||||
<Package className="w-16 h-16 mx-auto text-gray-600 mb-4" />
|
||||
<h2 className="text-xl font-bold text-white mb-2">No Skills Available</h2>
|
||||
<p className="text-gray-400 mb-4">{error}</p>
|
||||
<p className="text-sm text-gray-500">
|
||||
Skills will appear here after the first skill release.
|
||||
</p>
|
||||
</div>
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="pt-[52px] space-y-8">
|
||||
{/* Header */}
|
||||
<section className="text-center space-y-4">
|
||||
<h1 className="text-3xl md:text-4xl text-white">
|
||||
Skills Catalog
|
||||
</h1>
|
||||
<p className="text-gray-400 max-w-2xl mx-auto">
|
||||
Browse security skills for your AI agents. Each skill is verified for safety
|
||||
and distributed with checksums for integrity verification.
|
||||
</p>
|
||||
</section>
|
||||
|
||||
{/* Filters - Hidden for now, uncomment when needed
|
||||
<section className="flex flex-col md:flex-row gap-4 max-w-4xl mx-auto">
|
||||
<div className="relative flex-1">
|
||||
<Search className="absolute left-3 top-1/2 -translate-y-1/2 text-gray-500" size={20} />
|
||||
<input
|
||||
type="text"
|
||||
placeholder="Search skills..."
|
||||
value={searchTerm}
|
||||
onChange={(e) => setSearchTerm(e.target.value)}
|
||||
className="w-full pl-10 pr-4 py-2.5 bg-clawd-800 border border-clawd-700 rounded-lg text-white placeholder-gray-500 focus:outline-none focus:border-clawd-accent"
|
||||
/>
|
||||
</div>
|
||||
|
||||
<div className="relative">
|
||||
<Filter className="absolute left-3 top-1/2 -translate-y-1/2 text-gray-500" size={20} />
|
||||
<select
|
||||
value={categoryFilter}
|
||||
onChange={(e) => setCategoryFilter(e.target.value)}
|
||||
className="pl-10 pr-8 py-2.5 bg-clawd-800 border border-clawd-700 rounded-lg text-white appearance-none focus:outline-none focus:border-clawd-accent"
|
||||
>
|
||||
{categories.map((cat) => (
|
||||
<option key={cat} value={cat}>
|
||||
{cat === 'all' ? 'All Categories' : cat}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
</div>
|
||||
</section>
|
||||
*/}
|
||||
|
||||
{/* Skills Grid */}
|
||||
{filteredSkills.length > 0 ? (
|
||||
<section className="grid md:grid-cols-2 lg:grid-cols-3 gap-6">
|
||||
{filteredSkills.map((skill) => (
|
||||
<SkillCard key={skill.id} skill={skill} />
|
||||
))}
|
||||
</section>
|
||||
) : (
|
||||
<section className="text-center py-12">
|
||||
<Package className="w-12 h-12 mx-auto text-gray-600 mb-4" />
|
||||
<h3 className="text-lg font-medium text-white mb-2">No skills found</h3>
|
||||
<p className="text-gray-400">
|
||||
{searchTerm || categoryFilter !== 'all'
|
||||
? 'Try adjusting your filters'
|
||||
: 'No skills have been released yet'}
|
||||
</p>
|
||||
</section>
|
||||
)}
|
||||
|
||||
{/* Stats */}
|
||||
{skills.length > 0 && (
|
||||
<section className="text-center text-sm text-gray-500">
|
||||
Showing {filteredSkills.length} of {skills.length} skills
|
||||
</section>
|
||||
)}
|
||||
|
||||
{/* Shoutout */}
|
||||
<section className="max-w-4xl mx-auto">
|
||||
<div className="bg-clawd-900 border border-clawd-700 rounded-xl overflow-hidden">
|
||||
<div className="bg-clawd-800 px-6 py-4 border-b border-clawd-700 flex items-center justify-between">
|
||||
<h2 className="font-bold text-white flex items-center gap-2">
|
||||
<Sparkles size={18} className="text-clawd-accent" />
|
||||
Contribute Security Skills
|
||||
</h2>
|
||||
<span className="text-xs font-mono text-gray-500">SKILLS-BASED</span>
|
||||
</div>
|
||||
<div className="p-6 space-y-6">
|
||||
<p className="text-gray-300 text-sm">
|
||||
Humans & agents: submit skills that make bots safer (prompt injection defenses, drift checks, tool hardening, policy enforcement).
|
||||
We’ll package them with checksums so everyone can verify integrity.
|
||||
</p>
|
||||
|
||||
<a
|
||||
href="https://github.com/prompt-security/clawsec/blob/main/CONTRIBUTING.md"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="flex items-start gap-4 p-4 rounded-lg bg-clawd-800/50 border border-clawd-700 hover:border-clawd-accent/50 transition-colors group"
|
||||
>
|
||||
<span className="text-2xl">📄</span>
|
||||
<div className="flex-1">
|
||||
<h4 className="text-white font-bold text-sm group-hover:text-clawd-accent transition-colors flex items-center gap-2">
|
||||
Read CONTRIBUTING.md
|
||||
<FileText size={14} className="text-gray-500" />
|
||||
</h4>
|
||||
<p className="text-xs text-gray-400 mt-1">
|
||||
Guidelines for authoring, packaging, and releasing skills to the ClawSec catalog.
|
||||
</p>
|
||||
</div>
|
||||
</a>
|
||||
|
||||
<a
|
||||
href="https://github.com/prompt-security/clawsec/fork"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="flex items-start gap-4 p-4 rounded-lg bg-clawd-800/50 border border-clawd-700 hover:border-clawd-accent/50 transition-colors group"
|
||||
>
|
||||
<span className="text-2xl">🍴</span>
|
||||
<div className="flex-1">
|
||||
<h4 className="text-white font-bold text-sm group-hover:text-clawd-accent transition-colors flex items-center gap-2">
|
||||
Fork the repository
|
||||
<GitFork size={14} className="text-gray-500" />
|
||||
</h4>
|
||||
<p className="text-xs text-gray-400 mt-1">
|
||||
Start a contribution branch and open a PR with your new security skill.
|
||||
</p>
|
||||
</div>
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
};
|
||||
@@ -1,457 +0,0 @@
|
||||
import React, { useMemo } from 'react';
|
||||
import { BookOpenText, ExternalLink, FileText } from 'lucide-react';
|
||||
import { Link, useParams } from 'react-router-dom';
|
||||
import Markdown from 'react-markdown';
|
||||
import type { Components } from 'react-markdown';
|
||||
import remarkGfm from 'remark-gfm';
|
||||
import { Footer } from '../components/Footer';
|
||||
import { defaultMarkdownComponents } from '../utils/markdownComponents';
|
||||
import {
|
||||
extractTitleFromMarkdown,
|
||||
fallbackTitleFromPath,
|
||||
stripFrontmatter,
|
||||
} from '../utils/markdownHelpers.mjs';
|
||||
import {
|
||||
isWikiIndexSlug,
|
||||
toWikiLlmsPath,
|
||||
toWikiRoute,
|
||||
} from '../utils/wikiPathHelpers.mjs';
|
||||
|
||||
interface WikiDoc {
|
||||
filePath: string;
|
||||
slug: string;
|
||||
title: string;
|
||||
content: string;
|
||||
}
|
||||
|
||||
const normalizePath = (path: string): string => {
|
||||
const clean = path.replace(/\\/g, '/');
|
||||
const parts: string[] = [];
|
||||
for (const part of clean.split('/')) {
|
||||
if (!part || part === '.') continue;
|
||||
if (part === '..') {
|
||||
if (parts.length > 0) parts.pop();
|
||||
continue;
|
||||
}
|
||||
parts.push(part);
|
||||
}
|
||||
return parts.join('/');
|
||||
};
|
||||
|
||||
const dirname = (path: string): string => {
|
||||
const idx = path.lastIndexOf('/');
|
||||
return idx === -1 ? '' : path.slice(0, idx);
|
||||
};
|
||||
|
||||
const resolveFromFile = (currentFilePath: string, targetPath: string): string => {
|
||||
if (!targetPath) return currentFilePath;
|
||||
if (targetPath.startsWith('/')) return normalizePath(targetPath.slice(1));
|
||||
const baseDir = dirname(currentFilePath);
|
||||
const joined = baseDir ? `${baseDir}/${targetPath}` : targetPath;
|
||||
return normalizePath(joined);
|
||||
};
|
||||
|
||||
const splitHash = (href: string): { path: string; hash: string } => {
|
||||
const idx = href.indexOf('#');
|
||||
if (idx === -1) return { path: href, hash: '' };
|
||||
return { path: href.slice(0, idx), hash: href.slice(idx) };
|
||||
};
|
||||
|
||||
const toWikiRelativePath = (globPath: string): string =>
|
||||
globPath.replace(/^\.\.\/wiki\//, '').replace(/\\/g, '/');
|
||||
|
||||
const isExternalHref = (href: string): boolean =>
|
||||
/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(href) || href.startsWith('//');
|
||||
|
||||
const ALLOWED_LINK_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:']);
|
||||
const ALLOWED_IMAGE_SCHEMES = new Set(['http:', 'https:']);
|
||||
|
||||
const sanitizeHref = (href: string): string | null => {
|
||||
const trimmed = href.trim();
|
||||
if (!trimmed) return null;
|
||||
if (trimmed.startsWith('//')) return null;
|
||||
|
||||
const schemeMatch = trimmed.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:)/);
|
||||
if (!schemeMatch) return trimmed;
|
||||
|
||||
return ALLOWED_LINK_SCHEMES.has(schemeMatch[1].toLowerCase()) ? trimmed : null;
|
||||
};
|
||||
|
||||
const sanitizeImageSrc = (src: string): string | null => {
|
||||
const trimmed = src.trim();
|
||||
if (!trimmed) return null;
|
||||
if (trimmed.startsWith('//')) return null;
|
||||
|
||||
const schemeMatch = trimmed.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:)/);
|
||||
if (!schemeMatch) return trimmed;
|
||||
|
||||
return ALLOWED_IMAGE_SCHEMES.has(schemeMatch[1].toLowerCase()) ? trimmed : null;
|
||||
};
|
||||
|
||||
const markdownModules = import.meta.glob('../wiki/**/*.md', {
|
||||
eager: true,
|
||||
query: '?raw',
|
||||
import: 'default',
|
||||
}) as Record<string, string>;
|
||||
|
||||
const assetModules = import.meta.glob('../wiki/**/*.{png,jpg,jpeg,gif,svg,webp,avif}', {
|
||||
eager: true,
|
||||
import: 'default',
|
||||
}) as Record<string, string>;
|
||||
|
||||
const wikiDocs: WikiDoc[] = Object.entries(markdownModules)
|
||||
.map(([globPath, content]) => {
|
||||
const filePath = toWikiRelativePath(globPath);
|
||||
return {
|
||||
filePath,
|
||||
slug: filePath.replace(/\.md$/i, ''),
|
||||
title: extractTitleFromMarkdown(content, filePath),
|
||||
content: stripFrontmatter(content).trim(),
|
||||
};
|
||||
})
|
||||
.sort((a, b) => {
|
||||
const aIndex = a.slug.toLowerCase() === 'index';
|
||||
const bIndex = b.slug.toLowerCase() === 'index';
|
||||
if (aIndex && !bIndex) return -1;
|
||||
if (!aIndex && bIndex) return 1;
|
||||
|
||||
const aModule = a.filePath.startsWith('modules/');
|
||||
const bModule = b.filePath.startsWith('modules/');
|
||||
if (aModule !== bModule) return aModule ? 1 : -1;
|
||||
|
||||
return a.title.localeCompare(b.title, 'en', { sensitivity: 'base' });
|
||||
});
|
||||
|
||||
const wikiDocBySlug = new Map<string, WikiDoc>(
|
||||
wikiDocs.map((doc) => [doc.slug.toLowerCase(), doc]),
|
||||
);
|
||||
|
||||
const wikiDocByFilePath = new Map<string, WikiDoc>(
|
||||
wikiDocs.map((doc) => [doc.filePath.toLowerCase(), doc]),
|
||||
);
|
||||
|
||||
const wikiAssetByPath = new Map<string, string>(
|
||||
Object.entries(assetModules).map(([globPath, assetUrl]) => [
|
||||
toWikiRelativePath(globPath).toLowerCase(),
|
||||
assetUrl,
|
||||
]),
|
||||
);
|
||||
|
||||
const defaultDoc = wikiDocBySlug.get('index') ?? wikiDocs[0] ?? null;
|
||||
|
||||
const languageLabelByCode: Record<string, string> = {
|
||||
en: 'English',
|
||||
es: 'Español',
|
||||
ko: '한국어',
|
||||
fr: 'Français',
|
||||
de: 'Deutsch',
|
||||
ja: '日本語',
|
||||
};
|
||||
|
||||
const languageIndexByCode = new Map<string, WikiDoc>(
|
||||
wikiDocs
|
||||
.map((doc) => {
|
||||
const match = doc.slug.match(/^([^/]+)\/index$/i);
|
||||
if (!match) return null;
|
||||
const code = match[1].toLowerCase();
|
||||
return [code, doc] as const;
|
||||
})
|
||||
.filter((entry): entry is readonly [string, WikiDoc] => entry !== null),
|
||||
);
|
||||
|
||||
const toGroupName = (filePath: string): string => {
|
||||
if (!filePath.includes('/')) return 'Core';
|
||||
if (filePath.startsWith('modules/')) return 'Modules';
|
||||
const [firstSegment] = filePath.split('/');
|
||||
return fallbackTitleFromPath(firstSegment);
|
||||
};
|
||||
|
||||
export const WikiBrowser: React.FC = () => {
|
||||
const params = useParams<{ '*': string }>();
|
||||
const wildcard = params['*'] ?? '';
|
||||
const normalizedWildcard = wildcard.replace(/^\/+|\/+$/g, '');
|
||||
let requested = '';
|
||||
let decodeFailed = false;
|
||||
try {
|
||||
requested = decodeURIComponent(normalizedWildcard);
|
||||
} catch (error) {
|
||||
decodeFailed = normalizedWildcard.length > 0;
|
||||
console.warn('Failed to decode wiki route segment', { wildcard, error });
|
||||
requested = '';
|
||||
}
|
||||
const requestedSlug = requested || 'INDEX';
|
||||
const requestedSlugLower = requestedSlug.toLowerCase();
|
||||
const languageIndexFallback = languageIndexByCode.get(requestedSlugLower);
|
||||
|
||||
const selectedDoc =
|
||||
wikiDocBySlug.get(requestedSlugLower) ??
|
||||
languageIndexFallback ??
|
||||
defaultDoc;
|
||||
const notFound =
|
||||
(decodeFailed && normalizedWildcard.length > 0) ||
|
||||
(requested.length > 0 && !wikiDocBySlug.has(requestedSlugLower) && !languageIndexFallback);
|
||||
|
||||
const groupedDocs = useMemo(() => {
|
||||
const map = new Map<string, WikiDoc[]>();
|
||||
for (const doc of wikiDocs) {
|
||||
const group = toGroupName(doc.filePath);
|
||||
const existing = map.get(group) ?? [];
|
||||
existing.push(doc);
|
||||
map.set(group, existing);
|
||||
}
|
||||
|
||||
const preferredOrder = ['Core', 'Modules'];
|
||||
return Array.from(map.entries())
|
||||
.sort(([a], [b]) => {
|
||||
const idxA = preferredOrder.indexOf(a);
|
||||
const idxB = preferredOrder.indexOf(b);
|
||||
if (idxA !== -1 || idxB !== -1) {
|
||||
if (idxA === -1) return 1;
|
||||
if (idxB === -1) return -1;
|
||||
return idxA - idxB;
|
||||
}
|
||||
return a.localeCompare(b, 'en', { sensitivity: 'base' });
|
||||
})
|
||||
.map(([name, docs]) => ({
|
||||
name,
|
||||
docs: docs.sort((a, b) =>
|
||||
a.title.localeCompare(b.title, 'en', { sensitivity: 'base' }),
|
||||
),
|
||||
}));
|
||||
}, []);
|
||||
|
||||
if (!selectedDoc) {
|
||||
return (
|
||||
<div className="pt-[52px] py-20 text-center space-y-4">
|
||||
<BookOpenText className="w-12 h-12 text-gray-500 mx-auto" />
|
||||
<h1 className="text-2xl text-white">Wiki unavailable</h1>
|
||||
<p className="text-gray-400">No markdown files were found in the wiki source.</p>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
const activeSlug = selectedDoc.slug.toLowerCase();
|
||||
const pageLlmsPath = toWikiLlmsPath(activeSlug);
|
||||
const showWikiLlmsIndexLink = !isWikiIndexSlug(activeSlug);
|
||||
|
||||
const localizedPrefix = Array.from(languageIndexByCode.keys()).find((code) =>
|
||||
activeSlug.startsWith(`${code}/`),
|
||||
);
|
||||
const currentLanguageCode = localizedPrefix ?? 'en';
|
||||
const activeBaseSlug = localizedPrefix
|
||||
? activeSlug.slice(localizedPrefix.length + 1)
|
||||
: activeSlug;
|
||||
|
||||
const languageOptions = [
|
||||
{ code: 'en', label: languageLabelByCode.en ?? 'English' },
|
||||
...Array.from(languageIndexByCode.keys())
|
||||
.sort((a, b) => a.localeCompare(b, 'en', { sensitivity: 'base' }))
|
||||
.map((code) => ({
|
||||
code,
|
||||
label: languageLabelByCode[code] ?? code.toUpperCase(),
|
||||
})),
|
||||
].map((option) => {
|
||||
const targetSlug = option.code === 'en' ? activeBaseSlug : `${option.code}/${activeBaseSlug}`;
|
||||
const fallbackSlug = option.code === 'en' ? 'index' : `${option.code}/index`;
|
||||
const resolvedSlug = wikiDocBySlug.has(targetSlug) ? targetSlug : fallbackSlug;
|
||||
const translated = wikiDocBySlug.has(targetSlug);
|
||||
return {
|
||||
...option,
|
||||
route: toWikiRoute(resolvedSlug),
|
||||
translated,
|
||||
};
|
||||
});
|
||||
|
||||
const resolveWikiRouteFromHref = (href: string): string | null => {
|
||||
if (!href || isExternalHref(href) || href.startsWith('mailto:') || href.startsWith('tel:')) {
|
||||
return null;
|
||||
}
|
||||
const { path, hash } = splitHash(href);
|
||||
if (!path || !path.toLowerCase().endsWith('.md')) return null;
|
||||
|
||||
const resolvedFilePath = resolveFromFile(selectedDoc.filePath, path).toLowerCase();
|
||||
const targetDoc = wikiDocByFilePath.get(resolvedFilePath);
|
||||
if (!targetDoc) return null;
|
||||
return `${toWikiRoute(targetDoc.slug)}${hash}`;
|
||||
};
|
||||
|
||||
const resolveAssetUrl = (srcOrHref: string): string | null => {
|
||||
if (!srcOrHref || isExternalHref(srcOrHref) || srcOrHref.startsWith('/')) return null;
|
||||
const { path } = splitHash(srcOrHref);
|
||||
if (!path) return null;
|
||||
const resolvedAssetPath = resolveFromFile(selectedDoc.filePath, path).toLowerCase();
|
||||
return wikiAssetByPath.get(resolvedAssetPath) ?? null;
|
||||
};
|
||||
|
||||
const wikiMarkdownComponents: Components = {
|
||||
...defaultMarkdownComponents,
|
||||
a: ({ href, children }) => {
|
||||
if (!href) return <span className="text-gray-300">{children}</span>;
|
||||
|
||||
const wikiRoute = resolveWikiRouteFromHref(href);
|
||||
if (wikiRoute) {
|
||||
return (
|
||||
<Link to={wikiRoute} className="text-clawd-accent hover:underline">
|
||||
{children}
|
||||
</Link>
|
||||
);
|
||||
}
|
||||
|
||||
const assetHref = resolveAssetUrl(href);
|
||||
const finalHref = assetHref ?? href;
|
||||
const safeHref = sanitizeHref(finalHref);
|
||||
if (!safeHref) {
|
||||
return <span className="text-gray-300">{children}</span>;
|
||||
}
|
||||
const external = isExternalHref(safeHref);
|
||||
|
||||
return (
|
||||
<a
|
||||
href={safeHref}
|
||||
target={external ? '_blank' : undefined}
|
||||
rel={external ? 'noopener noreferrer' : undefined}
|
||||
className="text-clawd-accent hover:underline"
|
||||
>
|
||||
{children}
|
||||
</a>
|
||||
);
|
||||
},
|
||||
img: ({ src, alt }) => {
|
||||
const resolvedSrc = src ? resolveAssetUrl(src) : null;
|
||||
const finalSrc = resolvedSrc ?? (src ? sanitizeImageSrc(src) : null);
|
||||
if (!finalSrc) {
|
||||
return <span className="text-gray-500 text-sm">[image blocked]</span>;
|
||||
}
|
||||
return (
|
||||
<img
|
||||
src={finalSrc}
|
||||
alt={alt ?? ''}
|
||||
className="max-w-full h-auto rounded-lg border border-clawd-700 bg-clawd-900/40 p-2 my-4"
|
||||
loading="lazy"
|
||||
/>
|
||||
);
|
||||
},
|
||||
};
|
||||
|
||||
return (
|
||||
<div className="pt-[52px] space-y-8">
|
||||
<section className="space-y-3">
|
||||
<h1 className="text-3xl md:text-4xl text-white flex items-center gap-3">
|
||||
<BookOpenText className="text-clawd-accent" />
|
||||
Wiki
|
||||
</h1>
|
||||
<p className="text-gray-400 max-w-3xl">
|
||||
Full repository wiki rendered from markdown in <code className="text-gray-300">wiki/</code>.
|
||||
This is the same source synced to GitHub Wiki.
|
||||
</p>
|
||||
<div className="flex flex-wrap items-center gap-2 text-sm text-gray-300">
|
||||
<span className="text-gray-400">Language:</span>
|
||||
{languageOptions.map((option) => {
|
||||
const isActiveLanguage = option.code === currentLanguageCode;
|
||||
return isActiveLanguage ? (
|
||||
<span
|
||||
key={option.code}
|
||||
className="px-2 py-1 rounded bg-clawd-700 text-white border border-clawd-600"
|
||||
>
|
||||
{option.label}
|
||||
</span>
|
||||
) : (
|
||||
<Link
|
||||
key={option.code}
|
||||
to={option.route}
|
||||
className="px-2 py-1 rounded border border-clawd-700 hover:border-clawd-accent hover:text-white transition-colors"
|
||||
title={option.translated ? `Open ${option.label} translation` : `Open ${option.label} index fallback`}
|
||||
>
|
||||
{option.label}
|
||||
{option.translated ? (
|
||||
<span className="text-gray-500"> · translated</span>
|
||||
) : (
|
||||
<span className="text-gray-500"> · index fallback</span>
|
||||
)}
|
||||
</Link>
|
||||
);
|
||||
})}
|
||||
</div>
|
||||
|
||||
<div className="flex flex-wrap gap-3">
|
||||
<a
|
||||
href={pageLlmsPath}
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="inline-flex items-center gap-2 px-3 py-1.5 rounded-md bg-clawd-700 hover:bg-clawd-600 text-white text-sm transition-colors"
|
||||
>
|
||||
<FileText size={15} />
|
||||
Page llms.txt
|
||||
</a>
|
||||
{showWikiLlmsIndexLink && (
|
||||
<a
|
||||
href="/wiki/llms.txt"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="inline-flex items-center gap-2 px-3 py-1.5 rounded-md bg-clawd-800 border border-clawd-700 hover:border-clawd-accent text-white text-sm transition-colors"
|
||||
>
|
||||
<FileText size={15} />
|
||||
Wiki llms.txt Index
|
||||
</a>
|
||||
)}
|
||||
<a
|
||||
href="https://github.com/prompt-security/clawsec/wiki"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
className="inline-flex items-center gap-2 px-3 py-1.5 rounded-md border border-clawd-700 hover:border-clawd-accent text-gray-200 text-sm transition-colors"
|
||||
>
|
||||
<ExternalLink size={15} />
|
||||
GitHub Wiki
|
||||
</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<div className="grid lg:grid-cols-[280px_minmax(0,1fr)] gap-6 items-start">
|
||||
<aside className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-4 lg:sticky lg:top-20 max-h-[calc(100vh-7rem)] overflow-auto">
|
||||
<div className="space-y-5">
|
||||
{groupedDocs.map((group) => (
|
||||
<section key={group.name} className="space-y-2">
|
||||
<h2 className="text-xs uppercase tracking-wide text-gray-400">{group.name}</h2>
|
||||
<div className="space-y-1">
|
||||
{group.docs.map((doc) => {
|
||||
const isActive = activeSlug === doc.slug.toLowerCase();
|
||||
return (
|
||||
<Link
|
||||
key={doc.filePath}
|
||||
to={toWikiRoute(doc.slug)}
|
||||
className={`block px-3 py-2 rounded-md text-sm transition-colors ${
|
||||
isActive
|
||||
? 'bg-white/10 text-white border border-white/10'
|
||||
: 'text-gray-300 hover:text-white hover:bg-white/5'
|
||||
}`}
|
||||
>
|
||||
{doc.title}
|
||||
</Link>
|
||||
);
|
||||
})}
|
||||
</div>
|
||||
</section>
|
||||
))}
|
||||
</div>
|
||||
</aside>
|
||||
|
||||
<section className="bg-clawd-800/50 border border-clawd-700 rounded-xl p-4 sm:p-6 md:p-8 overflow-x-hidden">
|
||||
{notFound && (
|
||||
<div className="mb-6 p-3 rounded-md border border-orange-800 bg-orange-900/20 text-orange-200 text-sm">
|
||||
Wiki page not found for <code>{requested}</code>. Showing <strong>{selectedDoc.title}</strong> instead.
|
||||
</div>
|
||||
)}
|
||||
|
||||
<Markdown
|
||||
remarkPlugins={[remarkGfm]}
|
||||
components={wikiMarkdownComponents}
|
||||
>
|
||||
{selectedDoc.content}
|
||||
</Markdown>
|
||||
</section>
|
||||
</div>
|
||||
|
||||
<Footer />
|
||||
</div>
|
||||
);
|
||||
};
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 4.2 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 788 KiB |
@@ -1,20 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg id="Layer_1" xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 1455.1 1298.3">
|
||||
<!-- Generator: Adobe Illustrator 29.0.0, SVG Export Plug-In . SVG Version: 2.1.0 Build 186) -->
|
||||
<defs>
|
||||
<style>
|
||||
.st0 {
|
||||
fill: none;
|
||||
stroke: #fff;
|
||||
stroke-width: 4px;
|
||||
}
|
||||
|
||||
.st1 {
|
||||
opacity: .1;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<g class="st1">
|
||||
<path class="st0" d="M730,505.6l209.7,362.8M730,505.6l-209.6,362.8M730,505.6l-64.5-111.7c-26.1-45.2-91.4-45.2-117.5,0l-405.4,701.7c-23.9,41.4-23.9,92.4,0,133.8M939.7,868.4h-419.3M939.7,868.4h144.1c44.8,0,72.9-48.5,50.5-87.3l-281.7-487.6M520.4,868.4h563.4c44.8,0,72.9-48.5,50.5-87.3l-281.7-487.6M520.4,868.4l-73.2,126.6c-22.4,38.8,5.6,87.3,50.5,87.3h818.1M852.6,293.5l-102.3-177.1M852.6,293.5l-102.3-177.1h0M750.2,116.4l-27.3-47.2C698.8,27.6,654.4,1.9,606.3,1.9M606.4,2h245.3c48.5,0,93.2,25.8,117.5,67.8l465.9,806.4c24.2,41.9,24.2,93.6,0,135.5l-1.7,2.9M606.4,2c-48.1,0-92.6,25.6-116.6,67.3L20.2,882c-24.2,41.9-24.2,93.6,0,135.5l122.4,211.9M1315.8,1082.3c43.9,0,85-21.4,110.1-57.3l7.3-10.5M1315.8,1082.3c48.5,0,93.2-25.9,117.5-67.8M1433.3,1014.6h0l-39.2,67.8h0l-84.5,146.2c-24.2,41.9-69,67.8-117.4,67.8H258.5c-47.8,0-92-25.5-115.9-66.9"/>
|
||||
</g>
|
||||
</svg>
|
||||
|
Before Width: | Height: | Size: 1.3 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 182 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 970 KiB |
Binary file not shown.
Binary file not shown.
|
Before Width: | Height: | Size: 47 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 2.1 MiB |
Binary file not shown.
@@ -1,33 +0,0 @@
|
||||
[project]
|
||||
name = "clawsec-utils"
|
||||
version = "0.1.0"
|
||||
description = "ClawSec skill utilities"
|
||||
requires-python = ">=3.10"
|
||||
|
||||
[tool.ruff]
|
||||
target-version = "py310"
|
||||
line-length = 120
|
||||
|
||||
[tool.ruff.lint]
|
||||
select = [
|
||||
"E", # pycodestyle errors
|
||||
"F", # pyflakes
|
||||
"W", # pycodestyle warnings
|
||||
"I", # isort
|
||||
"S", # bandit (security)
|
||||
"B", # bugbear
|
||||
"C4", # comprehensions
|
||||
"UP", # pyupgrade
|
||||
]
|
||||
ignore = [
|
||||
"S101", # Allow assert statements
|
||||
"S603", # Allow subprocess without shell=True check (we control inputs)
|
||||
"S607", # Allow partial executable paths
|
||||
]
|
||||
|
||||
[tool.ruff.lint.per-file-ignores]
|
||||
"utils/__pycache__/*" = ["ALL"]
|
||||
|
||||
[tool.bandit]
|
||||
exclude_dirs = ["__pycache__", ".venv"]
|
||||
skips = ["B101"] # Allow assert
|
||||
@@ -1,486 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
|
||||
import { promises as fs } from 'node:fs';
|
||||
import path from 'node:path';
|
||||
import { fileURLToPath, pathToFileURL } from 'node:url';
|
||||
|
||||
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||||
const REPO_ROOT = path.resolve(__dirname, '..');
|
||||
const API_ROOT = 'https://api.github.com';
|
||||
const GITHUB_API_VERSION = '2022-11-28';
|
||||
const ARCHIVE_VERSION = 1;
|
||||
const DAY_MS = 24 * 60 * 60 * 1000;
|
||||
|
||||
const SUMMARY_WINDOWS = [
|
||||
['last_14_days', 14],
|
||||
['last_30_days', 30],
|
||||
['last_90_days', 90],
|
||||
['last_365_days', 365],
|
||||
];
|
||||
|
||||
const toIsoString = (value, label) => {
|
||||
const date = new Date(value);
|
||||
if (Number.isNaN(date.getTime())) {
|
||||
throw new Error(`Invalid ${label}: ${value}`);
|
||||
}
|
||||
return date.toISOString();
|
||||
};
|
||||
|
||||
const toDailyTimestamp = (value) => `${toIsoString(value, 'traffic timestamp').slice(0, 10)}T00:00:00Z`;
|
||||
const toDateKey = (value) => toIsoString(value, 'capture timestamp').slice(0, 10);
|
||||
|
||||
const toNonNegativeInteger = (value, label) => {
|
||||
const number = Number(value);
|
||||
if (!Number.isFinite(number) || number < 0) {
|
||||
throw new Error(`Invalid ${label}: ${value}`);
|
||||
}
|
||||
return Math.trunc(number);
|
||||
};
|
||||
|
||||
const toRequiredString = (value, label) => {
|
||||
if (typeof value !== 'string') {
|
||||
throw new Error(`${label} must be a non-empty string`);
|
||||
}
|
||||
|
||||
const trimmed = value.trim();
|
||||
if (!trimmed) {
|
||||
throw new Error(`${label} must be a non-empty string`);
|
||||
}
|
||||
|
||||
return trimmed;
|
||||
};
|
||||
|
||||
const normalizeRepository = (repo) => {
|
||||
const normalized = String(repo || '').trim();
|
||||
if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(normalized)) {
|
||||
throw new Error(`Repository must be in owner/name form, received: ${repo || '(empty)'}`);
|
||||
}
|
||||
return normalized;
|
||||
};
|
||||
|
||||
const normalizeDailyEntries = (entries, label) => {
|
||||
if (!Array.isArray(entries)) {
|
||||
throw new Error(`${label} must be an array`);
|
||||
}
|
||||
|
||||
return entries
|
||||
.map((entry) => ({
|
||||
timestamp: toDailyTimestamp(entry.timestamp),
|
||||
count: toNonNegativeInteger(entry.count, `${label}.count`),
|
||||
uniques: toNonNegativeInteger(entry.uniques, `${label}.uniques`),
|
||||
}))
|
||||
.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
|
||||
};
|
||||
|
||||
const normalizeReferrers = (entries) => {
|
||||
if (!Array.isArray(entries)) {
|
||||
throw new Error('referrers must be an array');
|
||||
}
|
||||
|
||||
return entries.map((entry) => ({
|
||||
referrer: toRequiredString(entry.referrer, 'referrers.referrer'),
|
||||
count: toNonNegativeInteger(entry.count, 'referrers.count'),
|
||||
uniques: toNonNegativeInteger(entry.uniques, 'referrers.uniques'),
|
||||
}));
|
||||
};
|
||||
|
||||
const normalizePaths = (entries) => {
|
||||
if (!Array.isArray(entries)) {
|
||||
throw new Error('paths must be an array');
|
||||
}
|
||||
|
||||
return entries.map((entry) => ({
|
||||
path: toRequiredString(entry.path, 'paths.path'),
|
||||
title: toRequiredString(entry.title, 'paths.title'),
|
||||
count: toNonNegativeInteger(entry.count, 'paths.count'),
|
||||
uniques: toNonNegativeInteger(entry.uniques, 'paths.uniques'),
|
||||
}));
|
||||
};
|
||||
|
||||
const upsertByKey = (existing, incoming, key) => {
|
||||
const entriesByKey = new Map();
|
||||
|
||||
for (const entry of existing || []) {
|
||||
entriesByKey.set(entry[key], entry);
|
||||
}
|
||||
for (const entry of incoming || []) {
|
||||
entriesByKey.set(entry[key], entry);
|
||||
}
|
||||
|
||||
return [...entriesByKey.values()].sort((a, b) => String(a[key]).localeCompare(String(b[key])));
|
||||
};
|
||||
|
||||
const latestEntry = (entries) => {
|
||||
if (!entries?.length) {
|
||||
return null;
|
||||
}
|
||||
return entries[entries.length - 1];
|
||||
};
|
||||
|
||||
const sumSeries = (entries) => entries.reduce(
|
||||
(totals, entry) => ({
|
||||
count: totals.count + entry.count,
|
||||
sum_daily_uniques: totals.sum_daily_uniques + entry.uniques,
|
||||
}),
|
||||
{ count: 0, sum_daily_uniques: 0 },
|
||||
);
|
||||
|
||||
const startOfUtcDay = (date) => Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
|
||||
|
||||
const summarizeWindow = (entries, days, now) => {
|
||||
const cutoff = new Date(startOfUtcDay(now) - ((days - 1) * DAY_MS));
|
||||
const filtered = entries.filter((entry) => new Date(entry.timestamp) >= cutoff);
|
||||
const totals = sumSeries(filtered);
|
||||
|
||||
return {
|
||||
days,
|
||||
count: totals.count,
|
||||
sum_daily_uniques: totals.sum_daily_uniques,
|
||||
unique_semantics: 'sum_of_daily_uniques',
|
||||
first_date: filtered[0]?.timestamp.slice(0, 10) ?? null,
|
||||
last_date: filtered.at(-1)?.timestamp.slice(0, 10) ?? null,
|
||||
};
|
||||
};
|
||||
|
||||
const summarizeAllTime = (entries) => {
|
||||
const totals = sumSeries(entries);
|
||||
|
||||
return {
|
||||
count: totals.count,
|
||||
sum_daily_uniques: totals.sum_daily_uniques,
|
||||
unique_semantics: 'sum_of_daily_uniques',
|
||||
first_date: entries[0]?.timestamp.slice(0, 10) ?? null,
|
||||
last_date: entries.at(-1)?.timestamp.slice(0, 10) ?? null,
|
||||
};
|
||||
};
|
||||
|
||||
const normalizeExistingArchive = (archive, repository, capturedAt) => {
|
||||
if (!archive) {
|
||||
return {
|
||||
version: ARCHIVE_VERSION,
|
||||
repository,
|
||||
archive_started_at: capturedAt,
|
||||
updated_at: capturedAt,
|
||||
daily: {
|
||||
views: [],
|
||||
clones: [],
|
||||
},
|
||||
snapshots: {
|
||||
referrers: [],
|
||||
paths: [],
|
||||
},
|
||||
captures: [],
|
||||
};
|
||||
}
|
||||
|
||||
if (archive.repository && archive.repository !== repository) {
|
||||
throw new Error(`Archive repository mismatch: ${archive.repository} != ${repository}`);
|
||||
}
|
||||
|
||||
return {
|
||||
version: ARCHIVE_VERSION,
|
||||
repository,
|
||||
archive_started_at: archive.archive_started_at || capturedAt,
|
||||
updated_at: archive.updated_at || capturedAt,
|
||||
daily: {
|
||||
views: normalizeDailyEntries(archive.daily?.views || [], 'daily.views'),
|
||||
clones: normalizeDailyEntries(archive.daily?.clones || [], 'daily.clones'),
|
||||
},
|
||||
snapshots: {
|
||||
referrers: (archive.snapshots?.referrers || []).map((snapshot) => ({
|
||||
captured_at: toIsoString(snapshot.captured_at, 'referrer snapshot timestamp'),
|
||||
date: snapshot.date || toDateKey(snapshot.captured_at),
|
||||
entries: normalizeReferrers(snapshot.entries || []),
|
||||
})),
|
||||
paths: (archive.snapshots?.paths || []).map((snapshot) => ({
|
||||
captured_at: toIsoString(snapshot.captured_at, 'path snapshot timestamp'),
|
||||
date: snapshot.date || toDateKey(snapshot.captured_at),
|
||||
entries: normalizePaths(snapshot.entries || []),
|
||||
})),
|
||||
},
|
||||
captures: (archive.captures || []).map((capture) => ({
|
||||
captured_at: toIsoString(capture.captured_at, 'capture timestamp'),
|
||||
date: capture.date || toDateKey(capture.captured_at),
|
||||
views_window: {
|
||||
count: toNonNegativeInteger(capture.views_window?.count || 0, 'captures.views_window.count'),
|
||||
uniques: toNonNegativeInteger(capture.views_window?.uniques || 0, 'captures.views_window.uniques'),
|
||||
},
|
||||
clones_window: {
|
||||
count: toNonNegativeInteger(capture.clones_window?.count || 0, 'captures.clones_window.count'),
|
||||
uniques: toNonNegativeInteger(capture.clones_window?.uniques || 0, 'captures.clones_window.uniques'),
|
||||
},
|
||||
})),
|
||||
};
|
||||
};
|
||||
|
||||
export const mergeTrafficArchive = (existingArchive, snapshot) => {
|
||||
const repository = normalizeRepository(snapshot.repository);
|
||||
const capturedAt = toIsoString(snapshot.captured_at, 'capture timestamp');
|
||||
const captureDate = toDateKey(capturedAt);
|
||||
const archive = normalizeExistingArchive(existingArchive, repository, capturedAt);
|
||||
|
||||
const views = normalizeDailyEntries(snapshot.views?.views || [], 'views');
|
||||
const clones = normalizeDailyEntries(snapshot.clones?.clones || [], 'clones');
|
||||
const referrerSnapshot = {
|
||||
captured_at: capturedAt,
|
||||
date: captureDate,
|
||||
entries: normalizeReferrers(snapshot.referrers || []),
|
||||
};
|
||||
const pathSnapshot = {
|
||||
captured_at: capturedAt,
|
||||
date: captureDate,
|
||||
entries: normalizePaths(snapshot.paths || []),
|
||||
};
|
||||
const capture = {
|
||||
captured_at: capturedAt,
|
||||
date: captureDate,
|
||||
views_window: {
|
||||
count: toNonNegativeInteger(snapshot.views?.count ?? sumSeries(views).count, 'views.count'),
|
||||
uniques: toNonNegativeInteger(snapshot.views?.uniques ?? sumSeries(views).sum_daily_uniques, 'views.uniques'),
|
||||
},
|
||||
clones_window: {
|
||||
count: toNonNegativeInteger(snapshot.clones?.count ?? sumSeries(clones).count, 'clones.count'),
|
||||
uniques: toNonNegativeInteger(snapshot.clones?.uniques ?? sumSeries(clones).sum_daily_uniques, 'clones.uniques'),
|
||||
},
|
||||
};
|
||||
|
||||
return {
|
||||
...archive,
|
||||
updated_at: capturedAt,
|
||||
daily: {
|
||||
views: upsertByKey(archive.daily.views, views, 'timestamp'),
|
||||
clones: upsertByKey(archive.daily.clones, clones, 'timestamp'),
|
||||
},
|
||||
snapshots: {
|
||||
referrers: upsertByKey(archive.snapshots.referrers, [referrerSnapshot], 'date'),
|
||||
paths: upsertByKey(archive.snapshots.paths, [pathSnapshot], 'date'),
|
||||
},
|
||||
captures: upsertByKey(archive.captures, [capture], 'date'),
|
||||
};
|
||||
};
|
||||
|
||||
export const buildTrafficSummary = (archive, options = {}) => {
|
||||
const now = new Date(options.now || new Date().toISOString());
|
||||
if (Number.isNaN(now.getTime())) {
|
||||
throw new Error(`Invalid summary date: ${options.now}`);
|
||||
}
|
||||
|
||||
const views = archive.daily?.views || [];
|
||||
const clones = archive.daily?.clones || [];
|
||||
const buildMetrics = (entries) => {
|
||||
const metrics = Object.fromEntries(SUMMARY_WINDOWS.map(([key, days]) => [
|
||||
key,
|
||||
summarizeWindow(entries, days, now),
|
||||
]));
|
||||
metrics.all_time = summarizeAllTime(entries);
|
||||
return metrics;
|
||||
};
|
||||
|
||||
return {
|
||||
version: ARCHIVE_VERSION,
|
||||
repository: archive.repository,
|
||||
generated_at: now.toISOString(),
|
||||
archive_started_at: archive.archive_started_at || null,
|
||||
updated_at: archive.updated_at || null,
|
||||
source: {
|
||||
api: 'GitHub REST repository traffic endpoints',
|
||||
retention_limit: 'GitHub exposes roughly the last 14 days; this archive keeps daily snapshots long term.',
|
||||
unique_semantics: 'GitHub daily unique values are retained as sum_daily_uniques for longer windows, not deduplicated visitors.',
|
||||
},
|
||||
metrics: {
|
||||
views: buildMetrics(views),
|
||||
clones: buildMetrics(clones),
|
||||
},
|
||||
daily: {
|
||||
views,
|
||||
clones,
|
||||
},
|
||||
latest_snapshots: {
|
||||
referrers: latestEntry(archive.snapshots?.referrers || []),
|
||||
paths: latestEntry(archive.snapshots?.paths || []),
|
||||
},
|
||||
snapshot_counts: {
|
||||
referrers: archive.snapshots?.referrers?.length || 0,
|
||||
paths: archive.snapshots?.paths?.length || 0,
|
||||
captures: archive.captures?.length || 0,
|
||||
},
|
||||
};
|
||||
};
|
||||
|
||||
const fetchJson = async ({ repo, token, pathname, fetchImpl }) => {
|
||||
const url = new URL(pathname, API_ROOT);
|
||||
const response = await fetchImpl(url, {
|
||||
headers: {
|
||||
Accept: 'application/vnd.github+json',
|
||||
Authorization: `Bearer ${token}`,
|
||||
'User-Agent': 'clawsec-traffic-archive',
|
||||
'X-GitHub-Api-Version': GITHUB_API_VERSION,
|
||||
},
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
const body = await response.text().catch(() => '');
|
||||
const suffix = body ? ` ${body.slice(0, 500)}` : '';
|
||||
throw new Error(`GitHub traffic API request failed for ${repo}: ${url.pathname}${url.search} returned ${response.status}.${suffix}`);
|
||||
}
|
||||
|
||||
return response.json();
|
||||
};
|
||||
|
||||
export const fetchGitHubTraffic = async ({
|
||||
repo,
|
||||
token,
|
||||
capturedAt = new Date().toISOString(),
|
||||
fetchImpl = globalThis.fetch,
|
||||
}) => {
|
||||
const repository = normalizeRepository(repo);
|
||||
if (!token) {
|
||||
throw new Error('A GitHub token is required to read repository traffic.');
|
||||
}
|
||||
if (typeof fetchImpl !== 'function') {
|
||||
throw new Error('fetch is not available in this Node runtime.');
|
||||
}
|
||||
|
||||
const encodedRepo = repository.split('/').map(encodeURIComponent).join('/');
|
||||
const request = (pathname) => fetchJson({
|
||||
repo: repository,
|
||||
token,
|
||||
pathname: `/repos/${encodedRepo}${pathname}`,
|
||||
fetchImpl,
|
||||
});
|
||||
|
||||
const [views, clones, referrers, paths] = await Promise.all([
|
||||
request('/traffic/views?per=day'),
|
||||
request('/traffic/clones?per=day'),
|
||||
request('/traffic/popular/referrers'),
|
||||
request('/traffic/popular/paths'),
|
||||
]);
|
||||
|
||||
return {
|
||||
repository,
|
||||
captured_at: toIsoString(capturedAt, 'capture timestamp'),
|
||||
views,
|
||||
clones,
|
||||
referrers,
|
||||
paths,
|
||||
};
|
||||
};
|
||||
|
||||
const readJsonIfPresent = async (file) => {
|
||||
try {
|
||||
return JSON.parse(await fs.readFile(file, 'utf8'));
|
||||
} catch (error) {
|
||||
if (error?.code === 'ENOENT') {
|
||||
return undefined;
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
};
|
||||
|
||||
const writeTextAtomic = async (file, content) => {
|
||||
const dir = path.dirname(file);
|
||||
const tempFile = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
|
||||
let handle;
|
||||
|
||||
await fs.mkdir(dir, { recursive: true });
|
||||
|
||||
try {
|
||||
handle = await fs.open(tempFile, 'w');
|
||||
await handle.writeFile(content, 'utf8');
|
||||
await handle.sync();
|
||||
await handle.close();
|
||||
handle = undefined;
|
||||
await fs.rename(tempFile, file);
|
||||
} catch (error) {
|
||||
if (handle) {
|
||||
await handle.close().catch(() => {});
|
||||
}
|
||||
await fs.unlink(tempFile).catch(() => {});
|
||||
throw error;
|
||||
}
|
||||
};
|
||||
|
||||
export const writeJson = async (file, value) => {
|
||||
await writeTextAtomic(file, `${JSON.stringify(value, null, 2)}\n`);
|
||||
};
|
||||
|
||||
const parseArgs = (args) => {
|
||||
const options = {};
|
||||
for (let index = 0; index < args.length; index += 1) {
|
||||
const arg = args[index];
|
||||
if (arg === '--archive-dir') {
|
||||
options.archiveDir = args[index + 1];
|
||||
index += 1;
|
||||
} else if (arg === '--repo') {
|
||||
options.repo = args[index + 1];
|
||||
index += 1;
|
||||
} else if (arg === '--captured-at') {
|
||||
options.capturedAt = args[index + 1];
|
||||
index += 1;
|
||||
} else if (arg === '--help' || arg === '-h') {
|
||||
options.help = true;
|
||||
} else {
|
||||
throw new Error(`Unknown argument: ${arg}`);
|
||||
}
|
||||
}
|
||||
return options;
|
||||
};
|
||||
|
||||
const printHelp = () => {
|
||||
console.log(`Usage: node scripts/archive-github-traffic.mjs [options]
|
||||
|
||||
Options:
|
||||
--archive-dir <dir> Directory that will receive archive.json and summary.json.
|
||||
--repo <owner/repo> Repository to archive. Defaults to GITHUB_REPOSITORY.
|
||||
--captured-at <iso> Override capture time for tests or backfills.
|
||||
`);
|
||||
};
|
||||
|
||||
const main = async () => {
|
||||
const options = parseArgs(process.argv.slice(2));
|
||||
if (options.help) {
|
||||
printHelp();
|
||||
return;
|
||||
}
|
||||
|
||||
const archiveDir = path.resolve(
|
||||
REPO_ROOT,
|
||||
options.archiveDir || process.env.TRAFFIC_ARCHIVE_DIR || 'traffic',
|
||||
);
|
||||
const archiveFile = path.join(archiveDir, 'archive.json');
|
||||
const summaryFile = path.join(archiveDir, 'summary.json');
|
||||
const repository = normalizeRepository(options.repo || process.env.GITHUB_REPOSITORY);
|
||||
const token = process.env.GH_TRAFFIC_TOKEN
|
||||
|| process.env.TRAFFIC_ARCHIVE_TOKEN
|
||||
|| process.env.GITHUB_TOKEN
|
||||
|| process.env.GH_TOKEN;
|
||||
const capturedAt = options.capturedAt || new Date().toISOString();
|
||||
|
||||
const snapshot = await fetchGitHubTraffic({
|
||||
repo: repository,
|
||||
token,
|
||||
capturedAt,
|
||||
});
|
||||
const existingArchive = await readJsonIfPresent(archiveFile);
|
||||
const archive = mergeTrafficArchive(existingArchive, snapshot);
|
||||
const summary = buildTrafficSummary(archive, { now: archive.updated_at });
|
||||
|
||||
await writeJson(archiveFile, archive);
|
||||
await writeJson(summaryFile, summary);
|
||||
|
||||
console.log(`Archived GitHub traffic for ${repository} at ${archive.updated_at}`);
|
||||
console.log(`Daily views retained: ${archive.daily.views.length}`);
|
||||
console.log(`Daily clones retained: ${archive.daily.clones.length}`);
|
||||
console.log(`Referrer snapshots retained: ${archive.snapshots.referrers.length}`);
|
||||
console.log(`Path snapshots retained: ${archive.snapshots.paths.length}`);
|
||||
};
|
||||
|
||||
if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
|
||||
try {
|
||||
await main();
|
||||
} catch (error) {
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
console.error(`Failed to archive GitHub traffic: ${message}`);
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
@@ -1,281 +0,0 @@
|
||||
#!/bin/bash
|
||||
# backfill-exploitability.sh
|
||||
# Adds exploitability scoring to existing advisories in feed.json that don't have it yet.
|
||||
# Historical maintenance utility: normal advisory generation should use
|
||||
# poll-nvd workflow (init/reset when rebuilding) or populate-local-feed.sh.
|
||||
#
|
||||
# Usage: ./scripts/backfill-exploitability.sh [--dry-run] [--feed PATH]
|
||||
# --dry-run Show what would be updated without making changes
|
||||
# --feed PATH Use specified feed file (default: advisories/feed.json)
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
# shellcheck source=./feed-utils.sh
|
||||
source "$SCRIPT_DIR/feed-utils.sh"
|
||||
|
||||
# Configuration
|
||||
init_feed_paths "$PROJECT_ROOT"
|
||||
ANALYZER="$PROJECT_ROOT/utils/analyze_exploitability.py"
|
||||
SIGNING_PRIVATE_KEY="${CLAWSEC_FEED_SIGNING_PRIVATE_KEY_PATH:-${CLAWSEC_SIGNING_PRIVATE_KEY_PATH:-$PROJECT_ROOT/clawsec-signing-private.pem}}"
|
||||
SIGNING_PUBLIC_KEY="${CLAWSEC_FEED_SIGNING_PUBLIC_KEY_PATH:-${CLAWSEC_SIGNING_PUBLIC_KEY_PATH:-$PROJECT_ROOT/clawsec-signing-public.pem}}"
|
||||
SIGNING_PASSPHRASE="${CLAWSEC_FEED_SIGNING_PRIVATE_KEY_PASSPHRASE:-${CLAWSEC_SIGNING_PRIVATE_KEY_PASSPHRASE:-}}"
|
||||
|
||||
sign_and_verify_feed_signature() {
|
||||
local feed_file="$1"
|
||||
local signature_file="$2"
|
||||
local tmp_dir
|
||||
local tmp_signature
|
||||
local signature_bin
|
||||
local passin_file
|
||||
|
||||
tmp_dir=$(mktemp -d)
|
||||
tmp_signature="${signature_file}.tmp.$$"
|
||||
signature_bin="$tmp_dir/signature.bin"
|
||||
passin_file="$tmp_dir/passin.txt"
|
||||
|
||||
if [ -n "$SIGNING_PASSPHRASE" ]; then
|
||||
printf '%s' "$SIGNING_PASSPHRASE" > "$passin_file"
|
||||
chmod 600 "$passin_file"
|
||||
|
||||
if ! openssl pkeyutl -sign -rawin -inkey "$SIGNING_PRIVATE_KEY" -passin "file:$passin_file" -in "$feed_file" \
|
||||
| openssl base64 -A > "$tmp_signature"; then
|
||||
rm -rf "$tmp_dir"
|
||||
rm -f "$tmp_signature"
|
||||
echo "Error: Failed to sign $feed_file" >&2
|
||||
return 1
|
||||
fi
|
||||
elif ! openssl pkeyutl -sign -rawin -inkey "$SIGNING_PRIVATE_KEY" -in "$feed_file" \
|
||||
| openssl base64 -A > "$tmp_signature"; then
|
||||
rm -rf "$tmp_dir"
|
||||
rm -f "$tmp_signature"
|
||||
echo "Error: Failed to sign $feed_file" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
if ! openssl base64 -d -A -in "$tmp_signature" -out "$signature_bin"; then
|
||||
rm -rf "$tmp_dir"
|
||||
rm -f "$tmp_signature"
|
||||
echo "Error: Failed to decode generated signature for $feed_file" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
if ! openssl pkeyutl -verify -rawin -pubin -inkey "$SIGNING_PUBLIC_KEY" -sigfile "$signature_bin" -in "$feed_file" >/dev/null; then
|
||||
rm -rf "$tmp_dir"
|
||||
rm -f "$tmp_signature"
|
||||
echo "Error: Signature verification failed after signing $feed_file" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
mv "$tmp_signature" "$signature_file"
|
||||
rm -rf "$tmp_dir"
|
||||
echo "✓ Re-signed and verified: $signature_file"
|
||||
}
|
||||
|
||||
# Parse args
|
||||
DRY_RUN=false
|
||||
REQUIRE_SIGNING=false
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
--dry-run)
|
||||
DRY_RUN=true
|
||||
shift
|
||||
;;
|
||||
--feed)
|
||||
FEED_PATH="$2"
|
||||
shift 2
|
||||
;;
|
||||
*)
|
||||
echo "Unknown option: $1"
|
||||
echo "Usage: $0 [--dry-run] [--feed PATH]"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
echo "=== ClawSec Exploitability Backfill ==="
|
||||
echo "Feed path: $FEED_PATH"
|
||||
echo "Dry run: $DRY_RUN"
|
||||
echo ""
|
||||
|
||||
# Verify prerequisites
|
||||
if [ ! -f "$FEED_PATH" ]; then
|
||||
echo "Error: Feed file not found: $FEED_PATH"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$ANALYZER" ]; then
|
||||
echo "Error: Analyzer script not found: $ANALYZER"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check Python availability
|
||||
if ! command -v python3 &> /dev/null; then
|
||||
echo "Error: python3 is required but not found in PATH"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify analyzer works
|
||||
if ! python3 "$ANALYZER" --help &> /dev/null; then
|
||||
echo "Error: Analyzer script failed to run. Check Python environment."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Determine whether detached signatures must be regenerated.
|
||||
# Runtime agents that only have public keys should run in dry-run mode.
|
||||
if [ "$DRY_RUN" = "false" ]; then
|
||||
if [ -f "${FEED_PATH}.sig" ]; then
|
||||
REQUIRE_SIGNING=true
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$REQUIRE_SIGNING" = "true" ]; then
|
||||
if ! command -v openssl &> /dev/null; then
|
||||
echo "Error: openssl is required for detached signature signing/verification"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$SIGNING_PRIVATE_KEY" ]; then
|
||||
echo "Error: Signing private key not found: $SIGNING_PRIVATE_KEY"
|
||||
echo "This backfill updates signed feed artifacts. Use --dry-run in public-key-only environments."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$SIGNING_PUBLIC_KEY" ]; then
|
||||
echo "Error: Signing public key not found: $SIGNING_PUBLIC_KEY"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Create temp directory
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
trap 'rm -rf "$TEMP_DIR"' EXIT
|
||||
|
||||
echo "=== Analyzing Feed ==="
|
||||
|
||||
# Extract advisories without exploitability_score
|
||||
jq '.advisories | map(select(.exploitability_score == null or .exploitability_score == ""))' \
|
||||
"$FEED_PATH" > "$TEMP_DIR/missing_exploitability.json"
|
||||
|
||||
MISSING_COUNT=$(jq 'length' "$TEMP_DIR/missing_exploitability.json")
|
||||
TOTAL_COUNT=$(jq '.advisories | length' "$FEED_PATH")
|
||||
ALREADY_DONE=$((TOTAL_COUNT - MISSING_COUNT))
|
||||
|
||||
echo "Total advisories: $TOTAL_COUNT"
|
||||
echo "Already have exploitability: $ALREADY_DONE"
|
||||
echo "Missing exploitability: $MISSING_COUNT"
|
||||
echo ""
|
||||
|
||||
if [ "$MISSING_COUNT" -eq 0 ]; then
|
||||
echo "✓ All advisories already have exploitability scores!"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "$DRY_RUN" = "true" ]; then
|
||||
echo "=== Dry Run - Would Update These Advisories ==="
|
||||
jq -r '.[] | .id' "$TEMP_DIR/missing_exploitability.json"
|
||||
echo ""
|
||||
echo "Total advisories to update: $MISSING_COUNT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "=== Processing Advisories ==="
|
||||
|
||||
# Process each advisory
|
||||
PROCESSED=0
|
||||
FAILED=0
|
||||
|
||||
# Read original feed to preserve all metadata
|
||||
cp "$FEED_PATH" "$TEMP_DIR/feed_working.json"
|
||||
|
||||
while IFS= read -r advisory; do
|
||||
CVE_ID=$(echo "$advisory" | jq -r '.id')
|
||||
|
||||
echo -n "Processing $CVE_ID... "
|
||||
|
||||
# Prepare input for analyzer
|
||||
ANALYZER_INPUT=$(echo "$advisory" | jq '{
|
||||
cve_id: .id,
|
||||
cvss_score: (.cvss_score // 0.0),
|
||||
type: .type,
|
||||
description: .description,
|
||||
references: (.references // [])
|
||||
}')
|
||||
|
||||
# Run analyzer
|
||||
if ANALYSIS=$(echo "$ANALYZER_INPUT" | python3 "$ANALYZER" --json --check-exploits 2>/dev/null); then
|
||||
# Extract exploitability fields
|
||||
EXPL_SCORE=$(echo "$ANALYSIS" | jq -r '.exploitability_score // "unknown"')
|
||||
EXPL_RATIONALE=$(echo "$ANALYSIS" | jq -r '.exploitability_rationale // "No rationale available"')
|
||||
|
||||
# Update advisory in working feed
|
||||
jq --arg id "$CVE_ID" \
|
||||
--arg score "$EXPL_SCORE" \
|
||||
--arg rationale "$EXPL_RATIONALE" \
|
||||
'(.advisories[] | select(.id == $id)) |= (. + {
|
||||
exploitability_score: $score,
|
||||
exploitability_rationale: $rationale
|
||||
})' "$TEMP_DIR/feed_working.json" > "$TEMP_DIR/feed_updated.json"
|
||||
|
||||
mv "$TEMP_DIR/feed_updated.json" "$TEMP_DIR/feed_working.json"
|
||||
|
||||
echo "✓ $EXPL_SCORE"
|
||||
PROCESSED=$((PROCESSED + 1))
|
||||
else
|
||||
echo "✗ Failed"
|
||||
FAILED=$((FAILED + 1))
|
||||
fi
|
||||
done < <(jq -c '.[]' "$TEMP_DIR/missing_exploitability.json")
|
||||
|
||||
# Check if loop executed successfully
|
||||
if [ ! -f "$TEMP_DIR/feed_working.json" ]; then
|
||||
echo "Error: Feed processing failed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Processing Complete ==="
|
||||
echo "Processed: $PROCESSED"
|
||||
echo "Failed: $FAILED"
|
||||
echo ""
|
||||
|
||||
# Write updated feed
|
||||
echo "Writing updated feed to: $FEED_PATH"
|
||||
cp "$TEMP_DIR/feed_working.json" "$FEED_PATH"
|
||||
|
||||
# Update feed version and timestamp
|
||||
CURRENT_VERSION=$(jq -r '.version' "$FEED_PATH")
|
||||
UPDATED_TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
|
||||
jq --arg ts "$UPDATED_TS" '.updated = $ts' "$FEED_PATH" > "$TEMP_DIR/feed_final.json"
|
||||
mv "$TEMP_DIR/feed_final.json" "$FEED_PATH"
|
||||
|
||||
echo "✓ Updated feed version: $CURRENT_VERSION"
|
||||
echo "✓ Updated timestamp: $UPDATED_TS"
|
||||
echo ""
|
||||
|
||||
if [ "$REQUIRE_SIGNING" = "true" ]; then
|
||||
echo ""
|
||||
echo "=== Re-signing Advisory Feed ==="
|
||||
|
||||
if [ -f "${FEED_PATH}.sig" ]; then
|
||||
if ! sign_and_verify_feed_signature "$FEED_PATH" "${FEED_PATH}.sig"; then
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Summary ==="
|
||||
echo "✓ Backfill complete!"
|
||||
echo "✓ $PROCESSED advisories updated with exploitability scores"
|
||||
|
||||
if [ "$FAILED" -gt 0 ]; then
|
||||
echo "⚠ $FAILED advisories failed analysis (kept original data)"
|
||||
fi
|
||||
|
||||
# Verify final state
|
||||
FINAL_MISSING=$(jq '.advisories | map(select(.exploitability_score == null or .exploitability_score == "")) | length' "$FEED_PATH")
|
||||
echo "✓ Advisories still missing exploitability: $FINAL_MISSING"
|
||||
@@ -1,263 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage:
|
||||
scripts/ci/enrich_exploitability.sh --mode single|batch --input <path> --output <path> [--cvss-vectors <path>] [--analyzer <path>]
|
||||
|
||||
Options:
|
||||
--mode Processing mode: single advisory object or batch advisory array
|
||||
--input Input JSON path
|
||||
--output Output JSON path
|
||||
--cvss-vectors Optional JSON object mapping advisory id -> CVSS vector
|
||||
--analyzer Optional analyzer path (default: utils/analyze_exploitability.py)
|
||||
--help Show this help
|
||||
EOF
|
||||
}
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||
cd "$REPO_ROOT"
|
||||
|
||||
MODE=""
|
||||
INPUT_PATH=""
|
||||
OUTPUT_PATH=""
|
||||
CVSS_VECTORS_PATH=""
|
||||
ANALYZER_PATH="utils/analyze_exploitability.py"
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--mode)
|
||||
MODE="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--input)
|
||||
INPUT_PATH="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--output)
|
||||
OUTPUT_PATH="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--cvss-vectors)
|
||||
CVSS_VECTORS_PATH="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--analyzer)
|
||||
ANALYZER_PATH="${2:-}"
|
||||
shift 2
|
||||
;;
|
||||
--help|-h)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
echo "ERROR: Unknown argument: $1" >&2
|
||||
usage >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ "$MODE" != "single" && "$MODE" != "batch" ]]; then
|
||||
echo "ERROR: --mode must be one of: single, batch" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -z "$INPUT_PATH" || -z "$OUTPUT_PATH" ]]; then
|
||||
echo "ERROR: --input and --output are required" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "$INPUT_PATH" ]]; then
|
||||
echo "ERROR: input file not found: $INPUT_PATH" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "$ANALYZER_PATH" ]]; then
|
||||
echo "ERROR: analyzer file not found: $ANALYZER_PATH" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -n "$CVSS_VECTORS_PATH" && ! -f "$CVSS_VECTORS_PATH" ]]; then
|
||||
echo "ERROR: --cvss-vectors file not found: $CVSS_VECTORS_PATH" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! command -v jq >/dev/null 2>&1; then
|
||||
echo "ERROR: jq is required" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if command -v python >/dev/null 2>&1; then
|
||||
PYTHON_BIN="python"
|
||||
elif command -v python3 >/dev/null 2>&1; then
|
||||
PYTHON_BIN="python3"
|
||||
else
|
||||
echo "ERROR: python or python3 is required" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
tmpdir="$(mktemp -d)"
|
||||
trap 'rm -rf "$tmpdir"' EXIT
|
||||
|
||||
resolve_cvss_vector() {
|
||||
local advisory_json="$1"
|
||||
local advisory_id
|
||||
advisory_id="$(echo "$advisory_json" | jq -r '.id // ""')"
|
||||
|
||||
if [[ -n "$CVSS_VECTORS_PATH" ]]; then
|
||||
jq -r --arg id "$advisory_id" '.[$id] // ""' "$CVSS_VECTORS_PATH"
|
||||
else
|
||||
echo "$advisory_json" | jq -r '.cvss_vector // ""'
|
||||
fi
|
||||
}
|
||||
|
||||
severity_to_cvss() {
|
||||
case "$1" in
|
||||
critical) echo "9.5" ;;
|
||||
high) echo "7.5" ;;
|
||||
medium) echo "5.5" ;;
|
||||
low) echo "3.0" ;;
|
||||
*) echo "5.0" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
build_analysis_input() {
|
||||
local advisory_json="$1"
|
||||
local mode="$2"
|
||||
local cve_id cvss_score cvss_vector vuln_type description references severity
|
||||
|
||||
cve_id="$(echo "$advisory_json" | jq -r '.id // ""')"
|
||||
vuln_type="$(echo "$advisory_json" | jq -r '.type // ""')"
|
||||
description="$(echo "$advisory_json" | jq -r '.description // ""')"
|
||||
references="$(echo "$advisory_json" | jq -c '.references // []')"
|
||||
cvss_vector="$(resolve_cvss_vector "$advisory_json")"
|
||||
|
||||
if [[ "$mode" == "single" ]]; then
|
||||
severity="$(echo "$advisory_json" | jq -r '.severity // "medium"')"
|
||||
cvss_score="$(severity_to_cvss "$severity")"
|
||||
else
|
||||
cvss_score="$(echo "$advisory_json" | jq -r '.cvss_score // 0')"
|
||||
fi
|
||||
|
||||
jq -n \
|
||||
--arg cve_id "$cve_id" \
|
||||
--argjson cvss_score "$cvss_score" \
|
||||
--arg cvss_vector "$cvss_vector" \
|
||||
--arg type "$vuln_type" \
|
||||
--arg description "$description" \
|
||||
--argjson references "$references" \
|
||||
'{
|
||||
cve_id: $cve_id,
|
||||
cvss_score: $cvss_score,
|
||||
cvss_vector: $cvss_vector,
|
||||
type: $type,
|
||||
description: $description,
|
||||
references: $references
|
||||
}'
|
||||
}
|
||||
|
||||
run_analysis() {
|
||||
local advisory_json="$1"
|
||||
local mode="$2"
|
||||
local output_file="$3"
|
||||
local advisory_id analysis_input analysis
|
||||
|
||||
advisory_id="$(echo "$advisory_json" | jq -r '.id // "unknown"')"
|
||||
analysis_input="$(build_analysis_input "$advisory_json" "$mode")"
|
||||
|
||||
if analysis="$(echo "$analysis_input" | "$PYTHON_BIN" "$ANALYZER_PATH" --json --check-exploits 2>/dev/null)"; then
|
||||
echo "$analysis" > "$output_file"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "::warning::Failed to analyze exploitability for $advisory_id, continuing without enrichment"
|
||||
return 1
|
||||
}
|
||||
|
||||
enrich_single() {
|
||||
if ! jq -e 'type == "object"' "$INPUT_PATH" >/dev/null; then
|
||||
echo "ERROR: single mode expects JSON object at $INPUT_PATH" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local advisory analysis_file output_tmp
|
||||
advisory="$(cat "$INPUT_PATH")"
|
||||
analysis_file="$tmpdir/analysis_single.json"
|
||||
output_tmp="$tmpdir/output_single.json"
|
||||
|
||||
if run_analysis "$advisory" "single" "$analysis_file"; then
|
||||
jq --slurpfile analysis "$analysis_file" '
|
||||
. + {
|
||||
exploitability_score: $analysis[0].exploitability_score,
|
||||
exploitability_rationale: $analysis[0].exploitability_rationale,
|
||||
attack_vector_analysis: $analysis[0].attack_vector_analysis,
|
||||
exploit_detection: $analysis[0].exploit_detection
|
||||
}
|
||||
' "$INPUT_PATH" > "$output_tmp"
|
||||
else
|
||||
cp "$INPUT_PATH" "$output_tmp"
|
||||
fi
|
||||
|
||||
mv "$output_tmp" "$OUTPUT_PATH"
|
||||
echo "Exploitability enrichment complete (single): $OUTPUT_PATH"
|
||||
}
|
||||
|
||||
enrich_batch() {
|
||||
if ! jq -e 'type == "array"' "$INPUT_PATH" >/dev/null; then
|
||||
echo "ERROR: batch mode expects JSON array at $INPUT_PATH" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local analyzed_count failed_count index advisory analysis_file output_tmp analyses_json
|
||||
analyzed_count=0
|
||||
failed_count=0
|
||||
index=0
|
||||
analyses_json="$tmpdir/analyses.json"
|
||||
output_tmp="$tmpdir/output_batch.json"
|
||||
|
||||
while IFS= read -r advisory; do
|
||||
analysis_file="$tmpdir/analysis_${index}.json"
|
||||
if run_analysis "$advisory" "batch" "$analysis_file"; then
|
||||
analyzed_count=$((analyzed_count + 1))
|
||||
else
|
||||
failed_count=$((failed_count + 1))
|
||||
rm -f "$analysis_file"
|
||||
fi
|
||||
index=$((index + 1))
|
||||
done < <(jq -c '.[]' "$INPUT_PATH")
|
||||
|
||||
if ls "$tmpdir"/analysis_*.json >/dev/null 2>&1; then
|
||||
jq -s '.' "$tmpdir"/analysis_*.json > "$analyses_json"
|
||||
else
|
||||
echo '[]' > "$analyses_json"
|
||||
fi
|
||||
|
||||
jq --slurpfile analyses "$analyses_json" '
|
||||
map(
|
||||
. as $advisory |
|
||||
($analyses[0] | map(select(.cve_id == $advisory.id)) | first) as $analysis |
|
||||
if $analysis then
|
||||
$advisory + {
|
||||
exploitability_score: $analysis.exploitability_score,
|
||||
exploitability_rationale: $analysis.exploitability_rationale,
|
||||
attack_vector_analysis: $analysis.attack_vector_analysis,
|
||||
exploit_detection: $analysis.exploit_detection
|
||||
}
|
||||
else
|
||||
$advisory
|
||||
end
|
||||
)
|
||||
' "$INPUT_PATH" > "$output_tmp"
|
||||
|
||||
mv "$output_tmp" "$OUTPUT_PATH"
|
||||
echo "Exploitability enrichment complete (batch): $OUTPUT_PATH"
|
||||
echo "Analyzed: $analyzed_count, failed: $failed_count"
|
||||
}
|
||||
|
||||
if [[ "$MODE" == "single" ]]; then
|
||||
enrich_single
|
||||
else
|
||||
enrich_batch
|
||||
fi
|
||||
@@ -1,359 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
import { mkdir, readFile, writeFile } from "node:fs/promises";
|
||||
import path from "node:path";
|
||||
import { installAgentForSkill, PLATFORM_KEYS } from "./skill_platforms.mjs";
|
||||
|
||||
const KNOWN_AGENT_TYPES = new Set(["codex", "hermes-agent", "openclaw", "universal"]);
|
||||
|
||||
function usage() {
|
||||
return [
|
||||
"Usage: node scripts/ci/generate_skill_release_trust_packet.mjs <skill-dir> <output-dir> [options]",
|
||||
"",
|
||||
"Options:",
|
||||
" --repository <owner/repo> Source repository used in install instructions",
|
||||
" --tag <tag> Release tag for this skill",
|
||||
" --source-ref <ref> Source ref for npx skills examples",
|
||||
].join("\n");
|
||||
}
|
||||
|
||||
function parseArgs(argv) {
|
||||
const positional = [];
|
||||
const options = {
|
||||
repository: "prompt-security/clawsec",
|
||||
tag: "",
|
||||
sourceRef: "main",
|
||||
};
|
||||
|
||||
for (let i = 0; i < argv.length; i += 1) {
|
||||
const token = argv[i];
|
||||
if (token === "--repository") {
|
||||
options.repository = argv[++i];
|
||||
} else if (token === "--tag") {
|
||||
options.tag = argv[++i];
|
||||
} else if (token === "--source-ref") {
|
||||
options.sourceRef = argv[++i];
|
||||
} else if (token === "--help" || token === "-h") {
|
||||
console.log(usage());
|
||||
process.exit(0);
|
||||
} else if (token.startsWith("--")) {
|
||||
throw new Error(`Unknown option: ${token}`);
|
||||
} else {
|
||||
positional.push(token);
|
||||
}
|
||||
}
|
||||
|
||||
if (positional.length !== 2) {
|
||||
throw new Error(usage());
|
||||
}
|
||||
|
||||
return {
|
||||
skillDir: positional[0],
|
||||
outputDir: positional[1],
|
||||
...options,
|
||||
};
|
||||
}
|
||||
|
||||
function parseFrontmatter(markdown) {
|
||||
if (!markdown.startsWith("---\n")) {
|
||||
return {};
|
||||
}
|
||||
|
||||
const end = markdown.indexOf("\n---", 4);
|
||||
if (end === -1) {
|
||||
return {};
|
||||
}
|
||||
|
||||
const result = {};
|
||||
const frontmatter = markdown.slice(4, end).split("\n");
|
||||
for (const line of frontmatter) {
|
||||
const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
|
||||
if (match) {
|
||||
result[match[1]] = match[2].replace(/^["']|["']$/g, "").trim();
|
||||
}
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
function asArray(value) {
|
||||
if (Array.isArray(value)) {
|
||||
return value.filter((item) => item !== null && item !== undefined).map(String);
|
||||
}
|
||||
if (typeof value === "string" && value.trim()) {
|
||||
return [value.trim()];
|
||||
}
|
||||
return [];
|
||||
}
|
||||
|
||||
function unique(values) {
|
||||
return [...new Set(values.filter(Boolean))];
|
||||
}
|
||||
|
||||
function detectPlatform(skill) {
|
||||
for (const key of PLATFORM_KEYS) {
|
||||
if (skill[key] && typeof skill[key] === "object") {
|
||||
return key;
|
||||
}
|
||||
}
|
||||
return skill.platform || "agent-skills";
|
||||
}
|
||||
|
||||
function platformMetadata(skill, platform) {
|
||||
const direct = skill[platform];
|
||||
return direct && typeof direct === "object" ? direct : {};
|
||||
}
|
||||
|
||||
function collectRequiredBinaries(metadata) {
|
||||
const requires = metadata.requires && typeof metadata.requires === "object" ? metadata.requires : {};
|
||||
const bins = asArray(requires.bins);
|
||||
|
||||
for (const [key, value] of Object.entries(requires)) {
|
||||
if (key !== "bins" && typeof value === "string") {
|
||||
bins.push(key);
|
||||
}
|
||||
}
|
||||
|
||||
return unique(bins);
|
||||
}
|
||||
|
||||
function collectOptionalBinaries(metadata) {
|
||||
return unique([
|
||||
...asArray(metadata.runtime?.optional_bins),
|
||||
...asArray(metadata.runtime?.optionalBins),
|
||||
]);
|
||||
}
|
||||
|
||||
function collectRequiredEnv(metadata) {
|
||||
const requires = metadata.requires && typeof metadata.requires === "object" ? metadata.requires : {};
|
||||
return unique([
|
||||
...asArray(requires.env),
|
||||
...asArray(metadata.runtime?.required_env),
|
||||
...asArray(metadata.runtime?.requiredEnv),
|
||||
]);
|
||||
}
|
||||
|
||||
function collectOptionalEnv(metadata) {
|
||||
return unique([
|
||||
...asArray(metadata.runtime?.optional_env),
|
||||
...asArray(metadata.runtime?.optionalEnv),
|
||||
]);
|
||||
}
|
||||
|
||||
function stringifyCapabilities(skill, metadata) {
|
||||
const capabilities = metadata.capabilities ?? skill.capabilities ?? {};
|
||||
if (Array.isArray(capabilities)) {
|
||||
return capabilities;
|
||||
}
|
||||
if (capabilities && typeof capabilities === "object") {
|
||||
return Object.entries(capabilities).map(([key, value]) => `${key}: ${String(value)}`);
|
||||
}
|
||||
if (typeof capabilities === "string") {
|
||||
return [capabilities];
|
||||
}
|
||||
return [];
|
||||
}
|
||||
|
||||
function requireField(skill, fieldName) {
|
||||
if (!skill[fieldName] || typeof skill[fieldName] !== "string" || !skill[fieldName].trim()) {
|
||||
throw new Error(`skill.json missing required trust-packet field: ${fieldName}`);
|
||||
}
|
||||
return skill[fieldName].trim();
|
||||
}
|
||||
|
||||
function codeBlock(command) {
|
||||
return ["```bash", command, "```"].join("\n");
|
||||
}
|
||||
|
||||
function buildPermissions({ skill, metadata, platform, generatedAt }) {
|
||||
const execution = metadata.execution && typeof metadata.execution === "object" ? metadata.execution : {};
|
||||
const permissions = {
|
||||
schema_version: "1",
|
||||
generated_at: generatedAt,
|
||||
skill: skill.name,
|
||||
version: skill.version,
|
||||
platform,
|
||||
required_binaries: collectRequiredBinaries(metadata),
|
||||
optional_binaries: collectOptionalBinaries(metadata),
|
||||
required_env: collectRequiredEnv(metadata),
|
||||
optional_env: collectOptionalEnv(metadata),
|
||||
network_egress: execution.network_egress || "Not declared in skill metadata.",
|
||||
persistence: execution.persistence || "Not declared in skill metadata.",
|
||||
automatic_execution: typeof execution.always === "boolean" ? execution.always : "Not declared in skill metadata.",
|
||||
capabilities: stringifyCapabilities(skill, metadata),
|
||||
operator_review: asArray(metadata.operator_review),
|
||||
};
|
||||
|
||||
return permissions;
|
||||
}
|
||||
|
||||
function buildSkillCard({ skill, frontmatter, permissions, repository, tag, sourceRef }) {
|
||||
const homepage = skill.homepage || frontmatter.homepage || `https://github.com/${repository}`;
|
||||
const supportRef = `${repository}@${tag || sourceRef}`;
|
||||
const licenseRef = `https://github.com/${repository}/blob/${tag || sourceRef}/LICENSE`;
|
||||
const outputTypes = ["Markdown instructions", "release artifact files"];
|
||||
if (permissions.capabilities.length > 0) {
|
||||
outputTypes.push("local security findings or status reports");
|
||||
}
|
||||
|
||||
return `# Skill Card
|
||||
|
||||
## Description
|
||||
|
||||
The \`${skill.name}\` skill provides this capability: ${skill.description}
|
||||
|
||||
This skill is intended for operator-reviewed security workflows, not unattended production mutation without the review steps declared in the skill instructions.
|
||||
|
||||
## Owner
|
||||
|
||||
prompt-security
|
||||
|
||||
## License/Terms of Use
|
||||
|
||||
${skill.license}
|
||||
|
||||
License reference: ${licenseRef}
|
||||
|
||||
Project homepage: ${homepage}
|
||||
|
||||
## Use Case
|
||||
|
||||
Use this skill for ${permissions.platform} workflows where an agent or operator needs the capability described in \`${skill.name}\`.
|
||||
|
||||
## Deployment Geography for Use
|
||||
|
||||
Global, subject to the operator's local compliance, network, and data-handling requirements.
|
||||
|
||||
## Known Risks and Mitigations
|
||||
|
||||
Risk: The skill may run commands, inspect local files, install hooks, or fetch remote security metadata depending on the workflow.
|
||||
|
||||
Mitigation: Review \`permissions.json\`, \`SKILL.md\`, and the signed \`checksums.json\` before enabling the skill. Keep high-impact actions approval-gated.
|
||||
|
||||
Risk: Security findings and remediation guidance can be incomplete or wrong.
|
||||
|
||||
Mitigation: Treat output as operator guidance. Review proposed removals, installs, configuration changes, and reports before acting.
|
||||
|
||||
## References
|
||||
|
||||
- Source release: ${supportRef}
|
||||
- Skill instructions: SKILL.md
|
||||
- Permission summary: permissions.json
|
||||
- SkillSpector scan: skillspector-report.md
|
||||
- Signed release manifest: checksums.json and checksums.sig
|
||||
|
||||
## Skill Output
|
||||
|
||||
Output type(s): ${outputTypes.join(", ")}
|
||||
|
||||
Output format: Markdown, JSON, shell commands, or local files as documented by the skill.
|
||||
|
||||
Output parameters: See \`SKILL.md\`, \`permissions.json\`, and release checksums for exact files and side effects.
|
||||
|
||||
Other properties: Release assets are covered by signed SHA-256 checksums.
|
||||
|
||||
## Skill Version
|
||||
|
||||
${skill.version}${tag ? ` (${tag})` : ""}
|
||||
|
||||
## Ethical Considerations
|
||||
|
||||
Use this skill only on systems, agents, repositories, and workspaces where you have authorization. Review generated security reports before sharing them because they may contain operational details.
|
||||
`;
|
||||
}
|
||||
|
||||
function buildInstallDoc({ skill, repository, tag, sourceRef }) {
|
||||
const refSuffix = sourceRef && sourceRef !== "main" ? `#${sourceRef}` : "";
|
||||
const source = `${repository}${refSuffix}`;
|
||||
const releaseUrl = tag ? `https://github.com/${repository}/releases/tag/${tag}` : `https://github.com/${repository}`;
|
||||
const agent = installAgentForSkill(skill, KNOWN_AGENT_TYPES);
|
||||
|
||||
return `# Install and Update ${skill.name}
|
||||
|
||||
## Install With Agent Skills CLI
|
||||
|
||||
Harness-aware global install:
|
||||
|
||||
${codeBlock(`npx skills add ${source} --skill ${skill.name} --agent ${agent} --global --yes`)}
|
||||
|
||||
Project-local install for compatible agents:
|
||||
|
||||
${codeBlock(`npx skills add ${source} --skill ${skill.name} --yes`)}
|
||||
|
||||
## Update
|
||||
|
||||
Update this skill when installed through the Skills CLI:
|
||||
|
||||
${codeBlock(`npx skills update ${skill.name}`)}
|
||||
|
||||
List installed skills:
|
||||
|
||||
${codeBlock("npx skills list")}
|
||||
|
||||
## Verify Release Artifact
|
||||
|
||||
When installing from a GitHub release instead of the Skills CLI, download the archive, \`checksums.json\`, \`checksums.sig\`, and \`signing-public.pem\` from:
|
||||
|
||||
${releaseUrl}
|
||||
|
||||
Verify \`checksums.json\` before trusting the archive or standalone files.
|
||||
`;
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const args = parseArgs(process.argv.slice(2));
|
||||
const skillDir = path.resolve(args.skillDir);
|
||||
const outputDir = path.resolve(args.outputDir);
|
||||
|
||||
const skillJsonPath = path.join(skillDir, "skill.json");
|
||||
const skillMdPath = path.join(skillDir, "SKILL.md");
|
||||
const [skillJsonRaw, skillMdRaw] = await Promise.all([
|
||||
readFile(skillJsonPath, "utf8"),
|
||||
readFile(skillMdPath, "utf8"),
|
||||
]);
|
||||
|
||||
const skill = JSON.parse(skillJsonRaw);
|
||||
const frontmatter = parseFrontmatter(skillMdRaw);
|
||||
skill.name = requireField(skill, "name");
|
||||
skill.version = requireField(skill, "version");
|
||||
skill.description = requireField(skill, "description");
|
||||
skill.license = requireField(skill, "license");
|
||||
|
||||
const platform = detectPlatform(skill);
|
||||
const metadata = platformMetadata(skill, platform);
|
||||
const generatedAt = new Date().toISOString();
|
||||
const permissions = buildPermissions({ skill, metadata, platform, generatedAt });
|
||||
|
||||
await mkdir(outputDir, { recursive: true });
|
||||
await Promise.all([
|
||||
writeFile(
|
||||
path.join(outputDir, "permissions.json"),
|
||||
`${JSON.stringify(permissions, null, 2)}\n`,
|
||||
),
|
||||
writeFile(
|
||||
path.join(outputDir, "skill-card.md"),
|
||||
buildSkillCard({
|
||||
skill,
|
||||
frontmatter,
|
||||
permissions,
|
||||
repository: args.repository,
|
||||
tag: args.tag,
|
||||
sourceRef: args.sourceRef,
|
||||
}),
|
||||
),
|
||||
writeFile(
|
||||
path.join(outputDir, "install.md"),
|
||||
buildInstallDoc({
|
||||
skill,
|
||||
repository: args.repository,
|
||||
tag: args.tag,
|
||||
sourceRef: args.sourceRef,
|
||||
}),
|
||||
),
|
||||
]);
|
||||
|
||||
console.log(`Generated release trust packet for ${skill.name} in ${outputDir}`);
|
||||
}
|
||||
|
||||
main().catch((error) => {
|
||||
console.error(error.message);
|
||||
process.exit(1);
|
||||
});
|
||||
@@ -1,79 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
import { existsSync, readFileSync } from "node:fs";
|
||||
import path from "node:path";
|
||||
import { collectDeclaredPlatforms, PLATFORM_KEYS } from "./skill_platforms.mjs";
|
||||
|
||||
const EXPLICIT_SLUGS = new Map([
|
||||
["openclaw-traffic-guardian", "clawsec-openclaw-traffic-guardian"],
|
||||
["openclaw-audit-watchdog", "clawsec-openclaw-audit-watchdog"],
|
||||
["soul-guardian", "clawsec-openclaw-soul-guardian"],
|
||||
["hermes-attestation-guardian", "clawsec-hermes-attestation-guardian"],
|
||||
["hermes-traffic-guardian", "clawsec-hermes-traffic-guardian"],
|
||||
["nanoclaw-traffic-guardian", "clawsec-nanoclaw-traffic-guardian"],
|
||||
["picoclaw-security-guardian", "clawsec-picoclaw-security-guardian"],
|
||||
["picoclaw-self-pen-testing", "clawsec-picoclaw-self-pen-testing"],
|
||||
["picoclaw-traffic-guardian", "clawsec-picoclaw-traffic-guardian"],
|
||||
["clawtributor", "clawsec-clawtributor"],
|
||||
]);
|
||||
|
||||
function usage() {
|
||||
return [
|
||||
"Usage: node scripts/ci/resolve_clawhub_slug.mjs <skill-dir-or-name>",
|
||||
"",
|
||||
"Prints the ClawHub slug for a skill without changing the GitHub release tag or skill package name.",
|
||||
].join("\n");
|
||||
}
|
||||
|
||||
function loadSkill(input) {
|
||||
const skillJsonPath = existsSync(path.join(input, "skill.json")) ? path.join(input, "skill.json") : null;
|
||||
if (!skillJsonPath) {
|
||||
return { name: input, platforms: [] };
|
||||
}
|
||||
|
||||
const skill = JSON.parse(readFileSync(skillJsonPath, "utf8"));
|
||||
if (!skill.name || typeof skill.name !== "string") {
|
||||
throw new Error(`${skillJsonPath} missing string field: name`);
|
||||
}
|
||||
|
||||
return { name: skill.name, platforms: collectDeclaredPlatforms(skill) };
|
||||
}
|
||||
|
||||
export function resolveClawHubSlug({ name, platforms = [] }) {
|
||||
if (!/^[a-z0-9-]+$/.test(name)) {
|
||||
throw new Error(`Invalid skill name for ClawHub slug mapping: ${name}`);
|
||||
}
|
||||
|
||||
if (name.startsWith("clawsec-")) {
|
||||
return name;
|
||||
}
|
||||
|
||||
if (EXPLICIT_SLUGS.has(name)) {
|
||||
return EXPLICIT_SLUGS.get(name);
|
||||
}
|
||||
|
||||
if (PLATFORM_KEYS.some((platform) => name.startsWith(`${platform}-`))) {
|
||||
return `clawsec-${name}`;
|
||||
}
|
||||
|
||||
const declaredPlatforms = collectDeclaredPlatforms({ platforms });
|
||||
if (declaredPlatforms.length === 1 && PLATFORM_KEYS.includes(declaredPlatforms[0])) {
|
||||
return `clawsec-${declaredPlatforms[0]}-${name}`;
|
||||
}
|
||||
|
||||
return `clawsec-${name}`;
|
||||
}
|
||||
|
||||
if (import.meta.url === `file://${process.argv[1]}`) {
|
||||
const input = process.argv[2];
|
||||
if (!input || input === "--help" || input === "-h") {
|
||||
console.log(usage());
|
||||
process.exit(input ? 0 : 1);
|
||||
}
|
||||
|
||||
try {
|
||||
console.log(resolveClawHubSlug(loadSkill(input)));
|
||||
} catch (error) {
|
||||
console.error(error instanceof Error ? error.message : String(error));
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
@@ -1,520 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
import { createHash } from "node:crypto";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import {
|
||||
cp,
|
||||
mkdir,
|
||||
mkdtemp,
|
||||
readFile,
|
||||
rm,
|
||||
stat,
|
||||
writeFile,
|
||||
} from "node:fs/promises";
|
||||
import { existsSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import path from "node:path";
|
||||
|
||||
const TRUST_ARTIFACTS = [
|
||||
"skill-card.md",
|
||||
"permissions.json",
|
||||
"install.md",
|
||||
"skillspector-report.md",
|
||||
];
|
||||
|
||||
function usage() {
|
||||
return [
|
||||
"Usage: node scripts/ci/simulate_skill_tag_release.mjs <skill-dir> <output-dir> [options]",
|
||||
"",
|
||||
"Options:",
|
||||
" --repository <owner/repo> Source repository used in release metadata",
|
||||
" --source-ref <ref> Source ref used in npx skills examples",
|
||||
" --skillspector-bin <path> SkillSpector executable to run",
|
||||
].join("\n");
|
||||
}
|
||||
|
||||
function parseArgs(argv) {
|
||||
const positional = [];
|
||||
const options = {
|
||||
repository: "prompt-security/clawsec",
|
||||
sourceRef: "main",
|
||||
skillspectorBin: "skillspector",
|
||||
};
|
||||
|
||||
for (let i = 0; i < argv.length; i += 1) {
|
||||
const token = argv[i];
|
||||
if (token === "--repository") {
|
||||
options.repository = argv[++i];
|
||||
} else if (token === "--source-ref") {
|
||||
options.sourceRef = argv[++i];
|
||||
} else if (token === "--skillspector-bin") {
|
||||
options.skillspectorBin = argv[++i];
|
||||
} else if (token === "--help" || token === "-h") {
|
||||
console.log(usage());
|
||||
process.exit(0);
|
||||
} else if (token.startsWith("--")) {
|
||||
throw new Error(`Unknown option: ${token}`);
|
||||
} else {
|
||||
positional.push(token);
|
||||
}
|
||||
}
|
||||
|
||||
if (positional.length !== 2) {
|
||||
throw new Error(usage());
|
||||
}
|
||||
|
||||
return {
|
||||
skillDir: positional[0],
|
||||
outputDir: positional[1],
|
||||
...options,
|
||||
};
|
||||
}
|
||||
|
||||
function run(command, args, options = {}) {
|
||||
const result = spawnSync(command, args, {
|
||||
encoding: "utf8",
|
||||
...options,
|
||||
});
|
||||
|
||||
if (result.status !== 0) {
|
||||
throw new Error(
|
||||
[
|
||||
`Command failed: ${command} ${args.join(" ")}`,
|
||||
result.stdout ? `stdout:\n${result.stdout}` : "",
|
||||
result.stderr ? `stderr:\n${result.stderr}` : "",
|
||||
].filter(Boolean).join("\n"),
|
||||
);
|
||||
}
|
||||
|
||||
return result.stdout;
|
||||
}
|
||||
|
||||
function runAllowFailure(command, args, options = {}) {
|
||||
return spawnSync(command, args, {
|
||||
encoding: "utf8",
|
||||
...options,
|
||||
});
|
||||
}
|
||||
|
||||
function nextSimulatedReleaseVersion(version) {
|
||||
const versionMatch = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-([a-zA-Z0-9]+))?$/);
|
||||
if (!versionMatch) {
|
||||
throw new Error(`Cannot derive simulated release version from unsupported version: ${version}`);
|
||||
}
|
||||
|
||||
const [, major, minor, patch, prerelease] = versionMatch;
|
||||
if (!prerelease) {
|
||||
return `${major}.${minor}.${Number(patch) + 1}`;
|
||||
}
|
||||
|
||||
const prereleaseMatch = prerelease.match(/^(.*?)(\d+)$/);
|
||||
if (prereleaseMatch) {
|
||||
const [, label, number] = prereleaseMatch;
|
||||
return `${major}.${minor}.${patch}-${label}${Number(number) + 1}`;
|
||||
}
|
||||
|
||||
return `${major}.${minor}.${patch}-${prerelease}1`;
|
||||
}
|
||||
|
||||
function normalizeReleasePath(rawPath) {
|
||||
let releasePath = rawPath.replaceAll("\\", "/");
|
||||
while (releasePath.startsWith("./")) {
|
||||
releasePath = releasePath.slice(2);
|
||||
}
|
||||
while (releasePath.includes("//")) {
|
||||
releasePath = releasePath.replaceAll("//", "/");
|
||||
}
|
||||
|
||||
if (
|
||||
releasePath === "" ||
|
||||
releasePath.startsWith("/") ||
|
||||
/^[A-Za-z]:/.test(releasePath) ||
|
||||
releasePath === ".." ||
|
||||
releasePath.startsWith("../") ||
|
||||
releasePath.endsWith("/..") ||
|
||||
releasePath.includes("/../")
|
||||
) {
|
||||
throw new Error(`Unsafe release path: ${rawPath}`);
|
||||
}
|
||||
|
||||
return releasePath;
|
||||
}
|
||||
|
||||
function isTestReleasePath(releasePath) {
|
||||
const lower = releasePath.toLowerCase();
|
||||
return lower === "test" ||
|
||||
lower === "tests" ||
|
||||
lower.startsWith("test/") ||
|
||||
lower.startsWith("tests/") ||
|
||||
lower.includes("/test/") ||
|
||||
lower.includes("/tests/");
|
||||
}
|
||||
|
||||
async function sha256File(filePath) {
|
||||
const buffer = await readFile(filePath);
|
||||
return createHash("sha256").update(buffer).digest("hex");
|
||||
}
|
||||
|
||||
async function fileSize(filePath) {
|
||||
return (await stat(filePath)).size;
|
||||
}
|
||||
|
||||
async function checksumEntry(filePath, releasePath) {
|
||||
return {
|
||||
sha256: await sha256File(filePath),
|
||||
size: await fileSize(filePath),
|
||||
path: releasePath,
|
||||
};
|
||||
}
|
||||
|
||||
function replaceSkillMarkdownVersion(markdown, version) {
|
||||
if (!markdown.startsWith("---\n")) {
|
||||
throw new Error("SKILL.md is missing YAML frontmatter");
|
||||
}
|
||||
|
||||
const end = markdown.indexOf("\n---", 4);
|
||||
if (end === -1) {
|
||||
throw new Error("SKILL.md frontmatter is not closed");
|
||||
}
|
||||
|
||||
const frontmatter = markdown.slice(0, end);
|
||||
if (!/^version:\s*.+$/m.test(frontmatter)) {
|
||||
throw new Error("SKILL.md frontmatter is missing a version field");
|
||||
}
|
||||
|
||||
return markdown.replace(/^version:\s*.+$/m, `version: ${version}`);
|
||||
}
|
||||
|
||||
async function addSimulatedChangelogEntry(skillDir, version) {
|
||||
const changelogPath = path.join(skillDir, "CHANGELOG.md");
|
||||
if (!existsSync(changelogPath)) {
|
||||
return;
|
||||
}
|
||||
|
||||
const today = new Date().toISOString().slice(0, 10);
|
||||
const original = await readFile(changelogPath, "utf8");
|
||||
if (original.includes(`## [${version}] -`)) {
|
||||
return;
|
||||
}
|
||||
|
||||
const entry = [
|
||||
`## [${version}] - ${today}`,
|
||||
"",
|
||||
"- Simulated prerelease build for release-pipeline validation.",
|
||||
"",
|
||||
"---",
|
||||
"",
|
||||
].join("\n");
|
||||
|
||||
await writeFile(changelogPath, `${entry}${original}`);
|
||||
}
|
||||
|
||||
async function writeJson(filePath, value) {
|
||||
await writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
async function signFileBase64({ keyPath, inputPath, outputPath, tempRoot }) {
|
||||
const sigBin = path.join(tempRoot, `${path.basename(outputPath)}.bin`);
|
||||
run("openssl", ["pkeyutl", "-sign", "-rawin", "-inkey", keyPath, "-in", inputPath, "-out", sigBin]);
|
||||
run("openssl", ["base64", "-A", "-in", sigBin, "-out", outputPath]);
|
||||
await rm(sigBin, { force: true });
|
||||
}
|
||||
|
||||
async function verifyFileBase64Signature({ publicKeyPath, inputPath, signaturePath, tempRoot }) {
|
||||
const sigBin = path.join(tempRoot, `${path.basename(signaturePath)}.verify.bin`);
|
||||
run("openssl", ["base64", "-d", "-A", "-in", signaturePath, "-out", sigBin]);
|
||||
run("openssl", [
|
||||
"pkeyutl",
|
||||
"-verify",
|
||||
"-rawin",
|
||||
"-pubin",
|
||||
"-inkey",
|
||||
publicKeyPath,
|
||||
"-sigfile",
|
||||
sigBin,
|
||||
"-in",
|
||||
inputPath,
|
||||
]);
|
||||
await rm(sigBin, { force: true });
|
||||
}
|
||||
|
||||
async function createSigningKeyPair(tempRoot) {
|
||||
const keyDir = await mkdtemp(path.join(tempRoot, "signing-"));
|
||||
const privateKeyPath = path.join(keyDir, "private.pem");
|
||||
const publicKeyPath = path.join(keyDir, "public.pem");
|
||||
|
||||
run("openssl", ["genpkey", "-algorithm", "ED25519", "-out", privateKeyPath]);
|
||||
run("openssl", ["pkey", "-in", privateKeyPath, "-pubout", "-out", publicKeyPath]);
|
||||
|
||||
return { privateKeyPath, publicKeyPath };
|
||||
}
|
||||
|
||||
async function signAdvisoryArtifacts(skillDir, tempRoot) {
|
||||
const advisoryDir = path.join(skillDir, "advisories");
|
||||
const feedPath = path.join(advisoryDir, "feed.json");
|
||||
if (!existsSync(feedPath)) {
|
||||
return;
|
||||
}
|
||||
|
||||
const { privateKeyPath, publicKeyPath } = await createSigningKeyPair(tempRoot);
|
||||
const feedSignaturePath = path.join(advisoryDir, "feed.json.sig");
|
||||
const checksumsPath = path.join(advisoryDir, "checksums.json");
|
||||
const checksumsSignaturePath = path.join(advisoryDir, "checksums.json.sig");
|
||||
const publicKeyOutputPath = path.join(advisoryDir, "feed-signing-public.pem");
|
||||
|
||||
await signFileBase64({
|
||||
keyPath: privateKeyPath,
|
||||
inputPath: feedPath,
|
||||
outputPath: feedSignaturePath,
|
||||
tempRoot,
|
||||
});
|
||||
await verifyFileBase64Signature({
|
||||
publicKeyPath,
|
||||
inputPath: feedPath,
|
||||
signaturePath: feedSignaturePath,
|
||||
tempRoot,
|
||||
});
|
||||
|
||||
await writeJson(checksumsPath, {
|
||||
schema_version: "1",
|
||||
algorithm: "sha256",
|
||||
version: "simulation",
|
||||
generated_at: new Date().toISOString(),
|
||||
files: {
|
||||
"advisories/feed.json": await checksumEntry(feedPath, "advisories/feed.json"),
|
||||
"advisories/feed.json.sig": await checksumEntry(feedSignaturePath, "advisories/feed.json.sig"),
|
||||
},
|
||||
});
|
||||
|
||||
await signFileBase64({
|
||||
keyPath: privateKeyPath,
|
||||
inputPath: checksumsPath,
|
||||
outputPath: checksumsSignaturePath,
|
||||
tempRoot,
|
||||
});
|
||||
await verifyFileBase64Signature({
|
||||
publicKeyPath,
|
||||
inputPath: checksumsPath,
|
||||
signaturePath: checksumsSignaturePath,
|
||||
tempRoot,
|
||||
});
|
||||
|
||||
await cp(publicKeyPath, publicKeyOutputPath);
|
||||
}
|
||||
|
||||
async function addReleaseAssetChecksum({ releaseAssetsDir, manifest, asset }) {
|
||||
const filePath = path.join(releaseAssetsDir, asset);
|
||||
if (!existsSync(filePath) || (await fileSize(filePath)) === 0) {
|
||||
throw new Error(`Required release trust artifact is missing or empty: ${filePath}`);
|
||||
}
|
||||
|
||||
manifest.files[asset] = await checksumEntry(filePath, asset);
|
||||
}
|
||||
|
||||
async function stageSbomFiles({ skillDir, innerDir, sbomFiles }) {
|
||||
for (const entry of sbomFiles) {
|
||||
const releasePath = normalizeReleasePath(entry.path);
|
||||
if (isTestReleasePath(releasePath)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
const fullPath = path.join(skillDir, releasePath);
|
||||
if (!existsSync(fullPath)) {
|
||||
throw new Error(`SBOM references missing file: ${releasePath}`);
|
||||
}
|
||||
|
||||
const destination = path.join(innerDir, releasePath);
|
||||
await mkdir(path.dirname(destination), { recursive: true });
|
||||
await cp(fullPath, destination);
|
||||
}
|
||||
}
|
||||
|
||||
async function buildFilesManifest({ skillDir, skillJsonPath, sbomFiles }) {
|
||||
const files = {};
|
||||
for (const entry of sbomFiles) {
|
||||
const releasePath = normalizeReleasePath(entry.path);
|
||||
if (isTestReleasePath(releasePath)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
const fullPath = path.join(skillDir, releasePath);
|
||||
if (existsSync(fullPath)) {
|
||||
files[releasePath] = await checksumEntry(fullPath, releasePath);
|
||||
}
|
||||
}
|
||||
|
||||
files["skill.json"] = {
|
||||
sha256: await sha256File(skillJsonPath),
|
||||
size: await fileSize(skillJsonPath),
|
||||
};
|
||||
|
||||
return files;
|
||||
}
|
||||
|
||||
async function runSkillSpector({ skillspectorBin, skillDir, reportPath }) {
|
||||
const result = runAllowFailure(skillspectorBin, [
|
||||
"scan",
|
||||
skillDir,
|
||||
"--no-llm",
|
||||
"--format",
|
||||
"markdown",
|
||||
"--output",
|
||||
reportPath,
|
||||
]);
|
||||
|
||||
if (!existsSync(reportPath) || (await fileSize(reportPath)) === 0) {
|
||||
throw new Error(
|
||||
[
|
||||
"SkillSpector did not produce a report.",
|
||||
result.stdout ? `stdout:\n${result.stdout}` : "",
|
||||
result.stderr ? `stderr:\n${result.stderr}` : "",
|
||||
].filter(Boolean).join("\n"),
|
||||
);
|
||||
}
|
||||
|
||||
if (result.status !== 0) {
|
||||
console.warn(`SkillSpector returned exit code ${result.status}; report is included for review.`);
|
||||
}
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const args = parseArgs(process.argv.slice(2));
|
||||
const sourceSkillDir = path.resolve(args.skillDir);
|
||||
const outputDir = path.resolve(args.outputDir);
|
||||
const releaseAssetsDir = path.join(outputDir, "release-assets");
|
||||
const tempRoot = await mkdtemp(path.join(tmpdir(), "clawsec-release-sim-"));
|
||||
|
||||
try {
|
||||
const skillName = path.basename(sourceSkillDir);
|
||||
const tempSkillDir = path.join(tempRoot, skillName);
|
||||
await cp(sourceSkillDir, tempSkillDir, { recursive: true });
|
||||
|
||||
const skillJsonPath = path.join(tempSkillDir, "skill.json");
|
||||
const skillMdPath = path.join(tempSkillDir, "SKILL.md");
|
||||
const skill = JSON.parse(await readFile(skillJsonPath, "utf8"));
|
||||
const originalVersion = skill.version;
|
||||
const simulatedVersion = nextSimulatedReleaseVersion(originalVersion);
|
||||
const tag = `${skillName}-v${simulatedVersion}`;
|
||||
const zipName = `${tag}.zip`;
|
||||
|
||||
skill.version = simulatedVersion;
|
||||
await writeJson(skillJsonPath, skill);
|
||||
await writeFile(
|
||||
skillMdPath,
|
||||
replaceSkillMarkdownVersion(await readFile(skillMdPath, "utf8"), simulatedVersion),
|
||||
);
|
||||
await addSimulatedChangelogEntry(tempSkillDir, simulatedVersion);
|
||||
await signAdvisoryArtifacts(tempSkillDir, tempRoot);
|
||||
|
||||
if (!skill.sbom || !Array.isArray(skill.sbom.files)) {
|
||||
throw new Error(`skill.json missing required release field: sbom.files`);
|
||||
}
|
||||
|
||||
await mkdir(releaseAssetsDir, { recursive: true });
|
||||
|
||||
const stagingDir = await mkdtemp(path.join(tempRoot, "staging-"));
|
||||
const innerDir = path.join(stagingDir, skillName);
|
||||
await mkdir(innerDir, { recursive: true });
|
||||
await stageSbomFiles({
|
||||
skillDir: tempSkillDir,
|
||||
innerDir,
|
||||
sbomFiles: skill.sbom.files,
|
||||
});
|
||||
await cp(skillJsonPath, path.join(innerDir, "skill.json"));
|
||||
|
||||
run("python3", ["scripts/ci/verify_skill_release_import_closure.py", innerDir], {
|
||||
cwd: process.cwd(),
|
||||
});
|
||||
|
||||
run("zip", ["-qr", path.join(releaseAssetsDir, zipName), "."], {
|
||||
cwd: stagingDir,
|
||||
});
|
||||
|
||||
const zipContents = run("unzip", ["-Z1", path.join(releaseAssetsDir, zipName)]);
|
||||
if (zipContents.split("\n").some((entry) => /(^|\/)(test|tests)\//i.test(entry))) {
|
||||
throw new Error(`Simulated release archive contains test-only files: ${zipName}`);
|
||||
}
|
||||
|
||||
const manifest = {
|
||||
skill: skillName,
|
||||
version: simulatedVersion,
|
||||
generated_at: new Date().toISOString(),
|
||||
repository: args.repository,
|
||||
tag,
|
||||
archive: {
|
||||
filename: zipName,
|
||||
sha256: await sha256File(path.join(releaseAssetsDir, zipName)),
|
||||
size: await fileSize(path.join(releaseAssetsDir, zipName)),
|
||||
url: `https://github.com/${args.repository}/releases/download/${tag}/${zipName}`,
|
||||
},
|
||||
files: await buildFilesManifest({
|
||||
skillDir: tempSkillDir,
|
||||
skillJsonPath,
|
||||
sbomFiles: skill.sbom.files,
|
||||
}),
|
||||
};
|
||||
|
||||
await writeJson(path.join(releaseAssetsDir, "checksums.json"), manifest);
|
||||
|
||||
run(process.execPath, [
|
||||
"scripts/ci/generate_skill_release_trust_packet.mjs",
|
||||
tempSkillDir,
|
||||
releaseAssetsDir,
|
||||
"--repository",
|
||||
args.repository,
|
||||
"--tag",
|
||||
tag,
|
||||
"--source-ref",
|
||||
args.sourceRef,
|
||||
]);
|
||||
|
||||
await runSkillSpector({
|
||||
skillspectorBin: args.skillspectorBin,
|
||||
skillDir: innerDir,
|
||||
reportPath: path.join(releaseAssetsDir, "skillspector-report.md"),
|
||||
});
|
||||
|
||||
for (const artifact of TRUST_ARTIFACTS) {
|
||||
await addReleaseAssetChecksum({ releaseAssetsDir, manifest, asset: artifact });
|
||||
}
|
||||
await writeJson(path.join(releaseAssetsDir, "checksums.json"), manifest);
|
||||
|
||||
await cp(skillJsonPath, path.join(releaseAssetsDir, "skill.json"));
|
||||
await cp(skillMdPath, path.join(releaseAssetsDir, "SKILL.md"));
|
||||
if (existsSync(path.join(tempSkillDir, "README.md"))) {
|
||||
await cp(path.join(tempSkillDir, "README.md"), path.join(releaseAssetsDir, "README.md"));
|
||||
}
|
||||
|
||||
const { privateKeyPath, publicKeyPath } = await createSigningKeyPair(tempRoot);
|
||||
await signFileBase64({
|
||||
keyPath: privateKeyPath,
|
||||
inputPath: path.join(releaseAssetsDir, "checksums.json"),
|
||||
outputPath: path.join(releaseAssetsDir, "checksums.sig"),
|
||||
tempRoot,
|
||||
});
|
||||
await verifyFileBase64Signature({
|
||||
publicKeyPath,
|
||||
inputPath: path.join(releaseAssetsDir, "checksums.json"),
|
||||
signaturePath: path.join(releaseAssetsDir, "checksums.sig"),
|
||||
tempRoot,
|
||||
});
|
||||
await cp(publicKeyPath, path.join(releaseAssetsDir, "signing-public.pem"));
|
||||
|
||||
await writeJson(path.join(outputDir, "simulation-summary.json"), {
|
||||
skill: skillName,
|
||||
original_version: originalVersion,
|
||||
simulated_version: simulatedVersion,
|
||||
tag,
|
||||
release_assets: path.relative(outputDir, releaseAssetsDir),
|
||||
archive: `release-assets/${zipName}`,
|
||||
});
|
||||
|
||||
console.log(`Simulated tag release build for ${skillName}: ${tag}`);
|
||||
} finally {
|
||||
await rm(tempRoot, { recursive: true, force: true });
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((error) => {
|
||||
console.error(error.message);
|
||||
process.exit(1);
|
||||
});
|
||||
@@ -1,52 +0,0 @@
|
||||
export const PLATFORM_KEYS = Object.freeze(["openclaw", "nanoclaw", "hermes", "picoclaw"]);
|
||||
|
||||
const PLATFORM_AGENT_ALIASES = new Map([["hermes", "hermes-agent"]]);
|
||||
|
||||
function asStringArray(value) {
|
||||
if (Array.isArray(value)) {
|
||||
return value.filter((item) => typeof item === "string" && item.trim()).map((item) => item.trim());
|
||||
}
|
||||
if (typeof value === "string" && value.trim()) {
|
||||
return [value.trim()];
|
||||
}
|
||||
return [];
|
||||
}
|
||||
|
||||
export function collectDeclaredPlatforms(skill) {
|
||||
const platforms = new Set([
|
||||
...asStringArray(skill.platform),
|
||||
...asStringArray(skill.platforms),
|
||||
]);
|
||||
|
||||
for (const key of PLATFORM_KEYS) {
|
||||
if (skill[key] && typeof skill[key] === "object") {
|
||||
platforms.add(key);
|
||||
}
|
||||
}
|
||||
|
||||
return [...platforms];
|
||||
}
|
||||
|
||||
export function installAgentForSkill(skill, agentTypes, fallback = "openclaw") {
|
||||
const platforms = collectDeclaredPlatforms(skill);
|
||||
if (platforms.length === 0) {
|
||||
return fallback;
|
||||
}
|
||||
|
||||
const matchedAgents = new Set();
|
||||
let allPlatformsMatched = true;
|
||||
for (const platform of platforms) {
|
||||
const candidate = PLATFORM_AGENT_ALIASES.get(platform) || platform;
|
||||
if (agentTypes.has(candidate)) {
|
||||
matchedAgents.add(candidate);
|
||||
} else {
|
||||
allPlatformsMatched = false;
|
||||
}
|
||||
}
|
||||
|
||||
if (allPlatformsMatched && matchedAgents.size === 1) {
|
||||
return [...matchedAgents][0];
|
||||
}
|
||||
|
||||
return fallback;
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user