mirror of
https://github.com/prompt-security/clawsec.git
synced 2026-06-13 05:28:02 +03:00
David Abutbul
600c945fe2
* feat(hermes-attestation-guardian): harden attestation verification and drift controls * docs(wiki): add human-friendly claim mapping for hermes attestation guardian * docs(wiki): expand hermes attestation claim narratives and archive draft * fix(attestation): address Baz review findings for schema and verifier * fix(attestation): reject broken symlink output paths * docs(attestation): pass clean community install guard without force * fix(attestation): harden writes and fail-closed config parsing * feat(ui): add Hermes to rotating platform text * test(attestation): add sandboxed Hermes regression runner script --------- Co-authored-by: David Abutbul <David.a@prompt.security>
119 lines
3.6 KiB
JSON
119 lines
3.6 KiB
JSON
{
|
|
"name": "hermes-attestation-guardian",
|
|
"version": "0.0.1",
|
|
"description": "Hermes-only runtime security attestation and drift detection skill. Generates deterministic posture artifacts, verifies integrity fail-closed, and classifies baseline drift severity.",
|
|
"author": "prompt-security",
|
|
"license": "AGPL-3.0-or-later",
|
|
"homepage": "https://clawsec.prompt.security/",
|
|
"platform": "hermes",
|
|
"keywords": [
|
|
"security",
|
|
"hermes",
|
|
"attestation",
|
|
"integrity",
|
|
"drift-detection",
|
|
"posture"
|
|
],
|
|
"sbom": {
|
|
"files": [
|
|
{
|
|
"path": "SKILL.md",
|
|
"required": true,
|
|
"description": "Skill documentation and operator playbook"
|
|
},
|
|
{
|
|
"path": "CHANGELOG.md",
|
|
"required": true,
|
|
"description": "Version history and release notes"
|
|
},
|
|
{
|
|
"path": "README.md",
|
|
"required": true,
|
|
"description": "Human-oriented overview and quickstart"
|
|
},
|
|
{
|
|
"path": "lib/attestation.mjs",
|
|
"required": true,
|
|
"description": "Attestation schema, canonicalization, digest and validation helpers"
|
|
},
|
|
{
|
|
"path": "lib/diff.mjs",
|
|
"required": true,
|
|
"description": "Baseline comparison and severity classification"
|
|
},
|
|
{
|
|
"path": "scripts/generate_attestation.mjs",
|
|
"required": true,
|
|
"description": "Generate deterministic Hermes posture attestation artifact"
|
|
},
|
|
{
|
|
"path": "scripts/verify_attestation.mjs",
|
|
"required": true,
|
|
"description": "Verify attestation schema, digest and optional detached signature"
|
|
},
|
|
{
|
|
"path": "scripts/setup_attestation_cron.mjs",
|
|
"required": true,
|
|
"description": "Optional recurring schedule setup for Hermes attestation runs"
|
|
},
|
|
{
|
|
"path": "test/attestation_schema.test.mjs",
|
|
"required": false,
|
|
"description": "Schema and determinism tests"
|
|
},
|
|
{
|
|
"path": "test/attestation_diff.test.mjs",
|
|
"required": false,
|
|
"description": "Diff and severity mapping tests"
|
|
},
|
|
{
|
|
"path": "test/attestation_cli.test.mjs",
|
|
"required": false,
|
|
"description": "Generator/verifier CLI behavior tests"
|
|
},
|
|
{
|
|
"path": "test/setup_attestation_cron.test.mjs",
|
|
"required": false,
|
|
"description": "Hermes-only cron setup tests"
|
|
}
|
|
]
|
|
},
|
|
"hermes": {
|
|
"emoji": "🛡️",
|
|
"category": "security",
|
|
"requires": {
|
|
"bins": [
|
|
"node"
|
|
]
|
|
},
|
|
"runtime": {
|
|
"required_env": [],
|
|
"optional_env": [
|
|
"HERMES_HOME",
|
|
"HERMES_ATTESTATION_OUTPUT_DIR",
|
|
"HERMES_ATTESTATION_BASELINE",
|
|
"HERMES_ATTESTATION_INTERVAL",
|
|
"HERMES_ATTESTATION_FAIL_ON_SEVERITY",
|
|
"HERMES_ATTESTATION_POLICY"
|
|
]
|
|
},
|
|
"execution": {
|
|
"always": false,
|
|
"persistence": "Runs on demand by default. Optional scheduler helper can install a managed schedule block when run with --apply.",
|
|
"network_egress": "None"
|
|
},
|
|
"operator_review": [
|
|
"Hermes-only skill: unsupported for OpenClaw runtime hooks.",
|
|
"Verify watch/trust-anchor policy paths before scheduling recurring runs.",
|
|
"Verification fails closed for schema/digest/signature errors and unauthenticated baseline inputs; diff threshold defaults to critical."
|
|
],
|
|
"triggers": [
|
|
"generate hermes attestation",
|
|
"verify hermes attestation",
|
|
"hermes runtime drift detection",
|
|
"hermes trust anchor drift",
|
|
"setup hermes attestation cron"
|
|
]
|
|
}
|
|
}
|