Use when checking for security vulnerabilities in NanoClaw skills, before installing new skills, or when asked about security advisories affecting the bot
SkillScore73Maintained
Automatic
◆Security & AppSec pack
Last verified 8/16/2026
What it changes
Passed 13 of 18 test cases with the skill, and 4 of 18 without it.
Without skill23%
With skill73%
Checks it passed that the model alone missed
States feed updates every 6 hours
Sets autoRestore parameter to true
Invokes clawsec_check_integrity tool
and 9 more in the full report
11 fixed5 passed either way6 still failing0 broke
Pass-rate lift
+50 pp
Tokens
+60%
Agent turns
0%
Response time
-63%
Model gemini-3.6-flashMeasured 8/16/2026v116 of 22 cases passed with skill · 18 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 10
Prompt
In the standalone release verification shell script, which manifest file supplies the trusted SHA256 hashes for SKILL.md and skill.json?
What was checked, without and with the skill
Checked
Without skill
With skill
Identifies manifest checksums file as checksums.json
Missed
Passed
case-22 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md283 linessingle file
ClawSec for NanoClaw
Security advisory monitoring that protects your WhatsApp bot from known vulnerabilities in skills and dependencies.
Vercel Skills Installation
Install with the Vercel Skills CLI for this harness:
npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -a openclaw -y
Overview
ClawSec provides MCP tools that check installed skills against a curated feed of security advisories. It prevents installation of vulnerable skills, includes exploitability context for triage, and alerts you to issues in existing ones.
Core principle: Check before you install. Monitor what's running.
When to Use
Use ClawSec tools when:
Installing a new skill (check safety first)
User asks "are my skills secure?"
Investigating suspicious behavior
Regular security audits
After receiving security notifications
Do NOT use for:
Code review (use other tools)
Performance issues (different concern)
General debugging
MCP Tools Available
Pre-Installation Check
// Before installing any skill
const safety = await tools.clawsec_check_skill_safety({
skillName: 'new-skill',