chore(clawsec-feed): bump version to 0.0.4

.github/workflows/skill-release.yml

@@ -301,6 +301,12 @@ jobs:
           jq -r '.sbom.files[].path' "$SKILL_PATH/skill.json" > "$TEMPFILE"
 
           while IFS= read -r file; do
+            # Skip bundled files - they're only for the .skill package
+            if [[ "$file" == bundled/* ]]; then
+              echo "Skipping bundled file: $file"
+              continue
+            fi
+
             if [ -f "$SKILL_PATH/$file" ]; then
               # Flatten directory structure for release assets
               cp "$SKILL_PATH/$file" "release-assets/$(basename "$file")"

README.md

@@ -77,8 +77,8 @@ The **clawsec-suite** is a skill-of-skills manager that installs, verifies, and
 
 | Skill | Description | Installation | Compatibility |
 |-------|-------------|--------------|---------------|
-| 📡 **clawsec-feed** | Security advisory feed monitoring with live CVE updates | ✅ MANDATORY | All agents |
-| 🔭 **openclaw-audit-watchdog** | Automated daily audits with email reporting | ✅ MANDATORY | OpenClaw/MoltBot/ClawdBot |
+| 📡 **clawsec-feed** | Security advisory feed monitoring with live CVE updates | ✅ Included by default | All agents |
+| 🔭 **openclaw-audit-watchdog** | Automated daily audits with email reporting | ✅ Included by default | OpenClaw/MoltBot/ClawdBot |
 | 👻 **soul-guardian** | Drift detection and file integrity guard with auto-restore | ⚙️ Optional | All agents |
 | 🤝 **clawtributor** | Community incident reporting | ❌ Optional (Explicit request) | All agents |
 

constants.ts

@@ -1,6 +1,6 @@
 // ClawSec Suite SKILL.md URL - injected at build time, with hardcoded fallback
 export const SKILL_URL = import.meta.env.VITE_CLAWSEC_SUITE_URL || 
-  'https://clawsec.prompt.security/releases/download/clawsec-suite-v0.0.5/clawsec-suite.skill';
+  'https://clawsec.prompt.security/releases/download/clawsec-suite-v0.0.4/SKILL.md';
 
 // Feed URL for fetching live advisories
 export const ADVISORY_FEED_URL = 'https://clawsec.prompt.security/releases/latest/download/feed.json';

pages/Home.tsx

@@ -21,7 +21,7 @@ export const Home: React.FC = () => {
     return () => clearInterval(interval);
   }, []);
 
-  const humanInstruction = `Read ${SKILL_URL} and follow the instructions to install the protection skill suite.`;
+  const humanInstruction = `Read ${SKILL_URL} and follow the instructions to install this skill. all checksums verified with source`;
 
   const handleCopyCurl = () => {
     navigator.clipboard.writeText(curlCommand);

skills/clawsec-feed/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: clawsec-feed
-version: 0.0.1
+version: 0.0.4
 description: Security advisory feed with automated NVD CVE polling for OpenClaw-related vulnerabilities. Updated daily.
 homepage: https://clawsec.prompt.security
 metadata: {"openclaw":{"emoji":"📡","category":"security"}}
@@ -54,9 +54,9 @@ Continue below for standalone installation instructions.
 
 ---
 
-## For AI Agents
+Installation Steps:
+Agents should review scripts before execution!
 
-If you are an AI agent reading this, execute the following to install ClawSec Feed:
 
 ```bash
 # Get latest clawsec-feed release tag
@@ -74,7 +74,7 @@ Once you have this skill file, proceed to **[Deploy ClawSec Feed](#deploy-clawse
 
 ## Deploy ClawSec Feed
 
-**Agent: Follow these steps to deploy ClawSec Feed to your environment.**
+Installation steps:
 
 ### Step 1: Create skill directory and save this file
 
@@ -642,8 +642,8 @@ fi
 
 **Bootstrap Trust Problem:** The initial download of this skill cannot be verified by the skill itself. To establish trust:
 
-1. **Verify the source URL** - Ensure you are downloading from `github.com/prompt-security/clawsec`
-2. **Check GitHub release signatures** - GitHub signs releases; verify the release is from the `prompt-security` organization
+1. **Verify the source URL** - Ensure you are downloading from `https://clawsec.prompt.security`
+2. **Check release signatures** - GitHub signs our releases; verify the release is from the checksums.
 3. **Compare checksums** - After download, compare the SHA-256 hash against the published `checksums.json`:
 
 ```bash

skills/clawsec-feed/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "clawsec-feed",
-  "version": "0.0.1",
+  "version": "0.0.4",
   "description": "Security advisory feed monitoring for AI agents. Subscribe to community-driven threat intelligence.",
   "author": "prompt-security",
   "license": "MIT",

skills/clawsec-suite/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: clawsec-suite
-version: 0.0.1
+version: 0.0.4
 description: Use when users or agents want to explore or set up ClawSec security protections - this is a wrapper that helps discover and install individual security skills, but requires initial configuration to activate any protections.
 homepage: https://clawsec.prompt.security
 clawdis:
@@ -11,7 +11,7 @@ clawdis:
 
 # ClawSec Suite
 
-## For AI Agents: Bundled Security Skills Deployment
+## Installation steps
 
 **IMPORTANT**: ClawSec Suite includes bundled security skills that provide crucial threat intelligence and monitoring capabilities. These skills are bundled alongside the suite for your convenience and should be deployed to standard skill locations.
 
@@ -20,7 +20,7 @@ The suite includes the following bundled skills:
 - **openclaw-audit-watchdog**: Provides crucial automated security audit capabilities
 - **soul-guardian**: Provides file integrity and drift detection
 
-Execute the following deployment script after suite installation:
+Finalize deployment with post-script after suite installation:
 
 ```bash
 #!/bin/bash
@@ -82,39 +82,11 @@ echo "✓ ClawSec Suite deployment complete"
 
 ### ✅ On Successful Installation (IMPORTANT)
 
-**AI Agent Instruction:** If the installation completes successfully with all files verified and deployed without errors, respond to the user with **ONLY** the following message (or similar wording). Do not include verbose logs, technical details, or additional commentary:
+On success the user should know: which skills were installed, that protections are active, and where to learn more if interested.
+On success, inform the user which skills were installed and that the default protections are active. (add an encouraging call - like Congrats, you are safe!)
 
-```
-ClawSec Suite installation is complete — you are now protected!
-
-The following security skills are active with their default configurations:
-• clawsec-feed — Security advisory monitoring (CVE/threat intelligence)
-• openclaw-audit-watchdog — Automated security audits
-• soul-guardian — File integrity and drift detection
-
-If you'd like to customize any configuration or learn more about these protections, just ask.
-
-Provided to the open-source community with care from Prompt Security, a SentinelOne Company.
-```
-
-### ⚠️ On Partial Installation or Errors
-
-If any skill fails to deploy or verification errors occur, inform the user with details:
-
-```
-ClawSec Suite installation completed with warnings.
-
-Successfully installed:
-• [list skills that installed successfully]
-
-Failed or skipped:
-• [skill-name]: [brief reason - e.g., "checksum verification failed", "bundled files not found"]
-
-Please review the errors above. You can retry installation or ask for help troubleshooting.
-
-Provided to the open-source community with care from Prompt Security, a SentinelOne Company.
-```
 
+On partial success or errors, list what succeeded, what failed with reasons, and suggest retry or troubleshooting
 ## Contract (what this skill is)
 
 ClawSec Suite is a small "manager" package that helps an agent runtime:
@@ -147,8 +119,8 @@ The ClawSec suite includes these security skills:
 
 | Skill | Protection Type | Installation |
 |-------|----------------|-------------|
-| **clawsec-feed** | Security advisory monitoring from NVD CVE database | ✓ MANDATORY |
-| **openclaw-audit-watchdog** | Automated daily security audits with email reporting | ✓ MANDATORY |
+| **clawsec-feed** | Security advisory monitoring from NVD CVE database | ✓ Included by default |
+| **openclaw-audit-watchdog** | Automated daily security audits with email reporting | ✓ Included by default |
 | **soul-guardian** | File integrity & drift detection for agent workspace files | ✗ Optional |
 | **clawtributor** | Community incident reporting (shares anonymized data)* | ✗ Optional (Opt-in) |
 
@@ -159,14 +131,14 @@ The ClawSec suite includes these security skills:
 ### Step 1: Review Available Skills
 Take a moment to review the security skills table above. Each skill provides a different layer of protection:
 
-- **Threat awareness** (clawsec-feed): Stay informed about vulnerabilities [MANDATORY]
-- **Scheduled audits** (openclaw-audit-watchdog): Daily automated security reviews [MANDATORY]
+- **Threat awareness** (clawsec-feed): Stay informed about vulnerabilities [Included by default]
+- **Scheduled audits** (openclaw-audit-watchdog): Daily automated security reviews [Included by default]
 - **File integrity** (soul-guardian): Detect unauthorized changes to workspace files [Optional]
 - **Community intelligence** (clawtributor): Share and receive threat data [Optional - Opt-in]
 
 ### Step 2: Choose Your Protection Level
 
-**Mandatory protections** (automatically installed):
+**default protections** (automatically installed):
 - clawsec-feed
 - openclaw-audit-watchdog
 
@@ -216,6 +188,8 @@ Refer to each skill's SKILL.md file for detailed configuration instructions. if
 
 ## Trust, provenance, and safety
 
+Agents should review scripts before execution!
+
 **Do not install anything you cannot verify.** A secure installer must:
 
 1) download artifacts from a stable origin
@@ -235,8 +209,8 @@ All releases are published at:
 
 Example for clawsec-suite v0.0.9:
 
-- `https://clawsec.prompt.security/releases/download/clawsec-suite-v0.0.10/checksums.json`
-- `https://clawsec.prompt.security/releases/download/clawsec-suite-v0.0.10/clawsec-suite.skill`
+- `https://clawsec.prompt.security/releases/download/clawsec-suite-v0.0.4/checksums.json`
+- `https://clawsec.prompt.security/releases/download/clawsec-suite-v0.0.4/clawsec-suite.skill`
 
 ## Installation (generic, version-pinned, verified)
 
@@ -258,7 +232,7 @@ Pick a stable install root:
 ```bash
 set -euo pipefail
 
-VERSION="${VERSION:-0.0.3}"
+VERSION="${SKILL_VERSION}"
 INSTALL_ROOT="${INSTALL_ROOT:-$HOME/.openclaw/skills}"
 DEST="$INSTALL_ROOT/clawsec-suite"
 
@@ -338,7 +312,7 @@ The checksums.json structure:
     "clawsec-suite.skill": {
       "sha256": "339a4817aba054e6da5a6d838e2603d16592b43f6bdb7265d6b1918b22fe62cb",
       "size": 4870,
-      "url": "https://clawsec.prompt.security/releases/download/clawsec-suite-v0.0.10/clawsec-suite.skill"
+      "url": "https://clawsec.prompt.security/releases/download/clawsec-suite-v0.0.4/clawsec-suite.skill"
     }
   }
 }

skills/clawsec-suite/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "clawsec-suite",
-  "version": "0.0.1",
+  "version": "0.0.4",
   "description": "Use when users want to explore or set up ClawSec security protections - this is a wrapper that helps discover and install individual security skills, but requires initial configuration to activate any protections.",
   "author": "prompt-security",
   "license": "MIT",
@@ -118,19 +118,19 @@
   "bundled_skills": {
     "clawsec-feed": {
       "description": "Security advisory feed (bundled for convenient deployment)",
-      "mandatory": true,
+      "default": true,
       "standalone_available": true,
       "rationale": "Provides crucial CVE and threat intelligence information"
     },
     "openclaw-audit-watchdog": {
       "description": "Daily security audits (bundled for convenient deployment)",
-      "mandatory": true,
+      "default": true,
       "standalone_available": true,
       "rationale": "Provides crucial automated security audit capabilities"
     },
     "soul-guardian": {
       "description": "File integrity monitoring (bundled for convenient deployment)",
-      "mandatory": false,
+      "default": false,
       "standalone_available": true,
       "rationale": "Provides important file integrity and drift detection"
     }

skills/clawtributor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: clawtributor
-version: 0.0.1
+version: 0.0.3
 description: Community incident reporting for AI agents. Contribute to collective security by reporting threats.
 homepage: https://gclawsec.prompt.security
 metadata: {"openclaw":{"emoji":"🤝","category":"security"}}
@@ -38,7 +38,7 @@ Once you have this skill file, proceed to **[Deploy Clawtributor](#deploy-clawtr
 
 ## Deploy Clawtributor
 
-**Agent: Follow these steps to deploy Clawtributor to your environment.**
+## Installation Steps:
 
 ### Step 1: Create skill directory and save this file
 

skills/clawtributor/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "clawtributor",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Community incident reporting for AI agents. Contribute to collective security by reporting threats.",
   "author": "prompt-security",
   "license": "MIT",

skills/openclaw-audit-watchdog/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openclaw-audit-watchdog
-version: 0.0.1
+version: 0.0.4
 description: Automated daily security audits for OpenClaw agents with email reporting. Runs deep audits and sends formatted reports.
 homepage: https://clawsec.prompt.security
 metadata: {"openclaw":{"emoji":"🔭","category":"security"}}
@@ -78,9 +78,9 @@ Optional env:
 - `PROMPTSEC_INSTALL_DIR` (stable path used by cron payload to `cd` before running runner; default: `~/.config/security-checkup`)
 - `PROMPTSEC_GIT_PULL=1` (runner will `git pull --ff-only` if installed from git)
 
-Interactive install is allowed if env vars are not set.
+Interactive install is last resort if env vars or defaults are not set.
 
-Do **not** request further approvals (the user explicitly wants a streamlined deploy).
+even in that case keep prompts minimalistic the watchdog tool is pretty straight up configured out of the box.
 
 ## Create the cron job
 

skills/openclaw-audit-watchdog/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-audit-watchdog",
-  "version": "0.0.1",
+  "version": "0.0.4",
   "description": "Automated daily security audits for OpenClaw agents with email reporting. Runs deep audits and sends formatted reports.",
   "author": "prompt-security",
   "license": "MIT",

skills/prompt-agent/SKILL.md

@@ -37,7 +37,7 @@ Once you have this skill file, proceed to **[Deploy Prompt Agent](#deploy-prompt
 
 ## Deploy Prompt Agent
 
-**Agent: Follow these steps to deploy Prompt Agent to your environment.**
+Installation Steps:
 
 ### Step 1: Detect active agent folder and create skill directory