clawsec

Why we included this project

Agent runtimes like OpenClaw, NanoClaw, Hermes, and Picoclaw keep much of their behavior in persistent files such as SOUL.md, and ClawSec is for people who want to watch over that. It installs as a suite of security skills that flag configuration drift, audit the agent environment, and verify that installed skill artifacts match a signed advisory feed. The guarded installer pauses on risky matches and asks for a second explicit confirmation before a questionable package goes through, so teams get a reviewable gate instead of silent auto-approval. The advisory feed carries detached signatures and a pinned public key, which matters if you already trust signed release channels and want the checks to be verifiable end to end. If you treat agent configuration as infrastructure, this gives it the same drift detection and change control you would expect for the rest of your stack.