mirror of
https://github.com/prompt-security/clawsec.git
synced 2026-06-13 05:28:02 +03:00
davida-ps
4dbac421ab
* feat(advisories): add provisional ghsa feed * fix(workflows): include advisory signatures in checksums * fix(workflows): mirror ghsa feed at release root * feat(advisories): consolidate ghsa into agent feed * ci(advisories): consolidate ghsa during nvd poll * fix(advisories): retain unreplaced ghsa feed entries * chore(skills): bump advisory feed consumers * fix(release): resolve ts import closure dry run * fix(release): preserve urls while stripping comments * fix(release): ignore skill test-only changes * fix(advisories): follow ghsa pagination links * test(advisories): add nvd ghsa pipeline dry run
ClawSec Feed 📡
Security advisory feed monitoring for AI agents. Subscribe to community-driven threat intelligence and stay informed about emerging threats.
Operational Notes
- Required runtime for standalone installation:
bash,curl,jq,shasum,unzip - This package is advisory data plus install/update guidance; it does not create local persistence by itself
- Automated polling, installed-skill cross-referencing, and hook/cron behavior live in
clawsec-suite - Verify release provenance and checksums before installing the standalone artifact on production hosts
Features
- Real-time Advisories - Get notified about malicious skills, vulnerabilities, and attack patterns
- Cross-Reference Detection - Automatically checks if your installed skills are affected
- Community-Driven - Advisories contributed and reviewed by the security community
- Heartbeat Integration - Seamlessly integrates with your agent's routine checks
Quick Install
curl -sLO https://github.com/prompt-security/clawsec/releases/latest/download/clawsec-feed.skill
Advisory Types
| Type | Description |
|---|---|
malicious_skill |
Skills identified as intentionally harmful |
vulnerable_skill |
Skills with security vulnerabilities |
prompt_injection |
Known prompt injection patterns |
attack_pattern |
Observed attack techniques |
Feed Structure
{
"version": "1.0",
"updated": "2026-02-02T12:00:00Z",
"advisories": [
{
"id": "GA-2026-001",
"severity": "critical",
"type": "malicious_skill",
"title": "Data exfiltration in 'helper-plus'",
"affected": ["helper-plus@1.0.0"],
"action": "Remove immediately"
}
]
}
Response Example
📡 ClawSec Feed: 2 new advisories
CRITICAL - GA-2026-015: Malicious prompt pattern
→ Update your system prompt defenses.
HIGH - GA-2026-016: Vulnerable skill "data-helper"
→ You have this installed! Update to v1.2.1
Related Skills
- openclaw-audit-watchdog - Automated daily security audits
- clawtributor - Report vulnerabilities to the community
License
GNU AGPL v3.0 or later - Prompt Security