skills.rest
prompt-security
prompt-securityOFFICIAL
Explore all skills by this author →
GitHub

picoclaw-security-guardian

Detects configuration drift, filters security advisories, and verifies signed release artifacts for Picoclaw gateways.

1.1k|113|Updated Feb 5, 2026
Search Tags:#drift detection#Security#supply chain#ed25519#advisory feed#AI Gateway#PicoClaw
One-click install
npx skills add https://github.com/prompt-security/clawsec --skill picoclaw-security-guardian
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: picoclaw-security-guardian
Source: https://github.com/prompt-security/clawsec/tree/main/skills/picoclaw-security-guardian
Command: npx skills add https://github.com/prompt-security/clawsec --skill picoclaw-security-guardian

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Picoclaw AI gateway operators lack visibility into security-relevant configuration changes, unverified advisory feeds, and untrusted release artifacts, leaving deployments exposed to silent drift and supply-chain tampering.

Core Features & Use Cases

  • Advisory Awareness: Filters the signed ClawSec advisory feed (NVD CVEs, community advisories, GHSA records) for Picoclaw-relevant entries, failing closed when feed verification state is not verified.
  • Configuration Drift Detection: Generates deterministic posture profiles of configs, Web UI exposure, tools, MCP, credentials, and release artifacts, then diffs them against an approved baseline with critical/high/medium/low/info findings.
  • Supply-Chain Verification: Validates release artifacts against SHA-256 checksum manifests plus required Ed25519 detached signatures before trusting installs.
  • Use Case: An operator baselines a hardened Picoclaw deployment, then runs drift checks on a schedule to catch critical changes like public Web UI enablement or disabled authentication before they become incidents.

Quick Start

Ask the agent to generate a Picoclaw security posture profile and compare it against your approved baseline to report any critical configuration drift.

Frequently Asked Questions about picoclaw-security-guardian

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect configuration drift in a Picoclaw gateway?▼

Generate a deterministic posture profile with scripts/generate_profile.mjs, then compare it against an approved baseline using scripts/check_drift.mjs. The diff reports findings by severity, with critical drift covering public Web UI enablement, disabled auth, and unsigned verification mode.

How do I verify Picoclaw release artifacts before installing?▼

Run scripts/verify_supply_chain.mjs with the artifact, a checksums.json manifest, its detached signature, and the trusted public key. Signed manifest verification is required for a passing provenance verdict; checksum-only mode is integrity-only and not sufficient for production installs.

Does the advisory check work without a verified feed?▼

No, advisory checks fail closed when the feed verification state is not verified. You can pass --allow-unsigned only for short, documented offline or emergency windows, but it should never be left enabled in recurring or production checks.

What counts as critical drift in Picoclaw posture profiles?▼

Critical findings include public Web UI enablement, Web UI auth disablement, workspace restriction disablement, unsigned/insecure verification mode, feed verification regression, and fingerprint changes to watched files or release artifacts.

Does this skill make network requests or modify my system?▼

No, it is read-only by default with no outbound network access and no scheduler creation. It writes only explicit profile or report outputs under $PICOCLAW_HOME/security/clawsec/ when you pass an --output path.

Related Skills

Explore More Software Engineering Skills→
prompt-securityprompt-security
1.1k

clawsec-feed

Integrate a live advisory feed to surface OpenClaw security advisories.

Official
Advanced
jeremylongshorejeremylongshore
2.6k

responding-to-security-incidents

Generate incident response playbooks for containment, eradication, and recovery.

Community
Advanced
majunbaomajunbao

runtime-behavior-probe

Plan and execute runtime probes to verify real behavior beyond static checks.

Community
Advanced
ISAQQSAIISAQQSAI

clawsec-suite

Monitors advisory feeds, verifies signatures, and gates risky OpenClaw skills via guarded workflows.

Community
Advanced