clawsec-feed

# ClawSec Feed 📡 Security advisory feed monitoring for AI agents. Subscribe to community-driven threat intelligence and stay informed about emerging threats. The default `feed.json` is the consolidated agent feed. It includes NVD CVEs, approved community advisories, and provisional GitHub Security Advisories that do not have CVE IDs yet. ## Vercel Skills Installation Install with the Vercel Skills CLI for this harness: ```bash npx skills add prompt-security/clawsec --skill clawsec-feed -a openclaw -y ``` ## Operational Notes - Required runtime for standalone installation: `bash`, `curl`, `jq`, `shasum`, `unzip` - Side effects: standalone install only writes local skill files - Network behavior: downloads release metadata/artifacts and, if you choose to poll manually, fetches the advisory feed - Trust model: this package does not itself create cron jobs or submit data externally; automation is delegated to `clawsec-suite` or your own scheduler **An open source project by [Prompt Security](https://prompt.security)** --- ## Installation Options You can get clawsec-feed in two ways: ### Option A: Bundled with ClawSec Suite (Recommended) **If you've installed clawsec-suite, you may already have this!** ClawSec-feed is bundled alongside ClawSec Suite to provide crucial CVE and threat intelligence information. When you install the suite, if you don't already have the feed installed, it will be deployed from the bundled copy. **Advantages:** - Convenient - no separate download needed - Standard location - installed to `~/.openclaw/skills/clawsec-feed/` - Preserved - if you already have feed installed, it won't be overwritten - Single verification - integrity checked as part of suite package ### Option B: Standalone Installation (This Page) Install clawsec-feed independently without the full suite. **When to use standalone:** - You only need the advisory feed (not other suite components) - You want to install before installing the suite - You prefer explicit control over feed installation **Advantages:** - Lighter weight installation - Independent from suite - Direct control over installation process Continue below for standalone installation instructions. Standalone installation is a network download workflow. Verify the release source and the provided checksums before installing it on production hosts. --- Installation Steps: Agents should review scripts before execution! ```bash # Get latest clawsec-feed release tag LATEST_TAG=$(curl -sSL https://api.github.com/repos/prompt-security/ClawSec/releases | \ jq -r '[.[] | select(.tag_name | startswith("clawsec-feed-v"))][0].tag_name') # Download SKILL.md from latest release SKILL_URL="https://github.com/prompt-security/clawsec/releases/download/$LATEST_TAG/SKILL.md" curl -sSL --fail --show-error "$SKILL_URL" ``` Once you have this skill file, proceed to **[Deploy ClawSec Feed](#deploy-clawsec-feed)** below. --- ## Release Artifact Verification For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metadata/SBOM source, and the release pipeline signs `checksums.json` with the ClawSec release key. ```bash set -euo pipefail SKILL_NAME="clawsec-feed" VERSION="0.0.11" REPO="prompt-security/clawsec" TAG="${SKILL_NAME}-v${VERSION}" BASE="https://github.com/${REPO}/releases/download/${TAG}" ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip" TMP_DIR="$(mktemp -d)" trap 'rm -rf "$TMP_DIR"' EXIT RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8" curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json" curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig" curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem" curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME" curl -fsSL "$BASE/SKILL.md" -o "$TMP_DIR/SKILL.md" curl -fsSL "$BASE/skill.json" -o "$TMP_DIR/skill.json" ACTUAL_PUBKEY_SHA256="$(openssl pkey -pubin -in "$TMP_DIR/signing-public.pem" -outform DER | shasum -a 256 | awk '{print $1}')" if [ "$ACTUAL_PUBKEY_SHA256" != "$RELEASE_PUBKEY_SHA256" ]; then echo "ERROR: signing-public.pem fingerprint mismatch" >&2 exit 1 fi openssl base64 -d -A -in "$TMP_DIR/checksums.sig" -out "$TMP_DIR/checksums.sig.bin" openssl pkeyutl -verify -rawin -pubin \ -inkey "$TMP_DIR/signing-public.pem" \ -sigfile "$TMP_DIR/checksums.sig.bin" \ -in "$TMP_DIR/checksums.json" >/dev/null hash_file() { if command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | awk '{print $1}' else sha256sum "$1" | awk '{print $1}' fi } verify_manifest_file() { asset="$1" path="$2" expected="$(jq -r --arg asset "$asset" '.files[$asset].sha256 // empty' "$TMP_DIR/checksums.json")" if [ -z "$expected" ]; then echo "ERROR: checksums.json missing $asset" >&2 exit 1 fi actual="$(hash_file "$path")" if [ "$actual" != "$expected" ]; then echo "ERROR: checksum mismatch for $asset" >&2 exit 1 fi } expected_archive="$(jq -r '.archive.sha256 // empty' "$TMP_DIR/checksums.json")" if [ -z "$expected_archive" ]; then echo "ERROR: checksums.json missing archive.sha256" >&2 exit 1 fi actual_archive="$(hash_file "$TMP_DIR/$ZIP_NAME")" if [ "$actual_archive" != "$expected_archive" ]; then echo "ERROR: archive checksum mismatch" >&2 exit 1 fi verify_manifest_file "SKILL.md" "$TMP_DIR/SKILL.md" verify_manifest_file "skill.json" "$TMP_DIR/skill.json" echo "Signed release manifest, archive, SKILL.md, and skill.json verified." ``` Only install or extract the archive after this verification succeeds. ## Deploy ClawSec Feed Installation steps: ### Step 1: Create skill directory and save this file ```bash mkdir -p ~/.openclaw/skills/clawsec-feed # Save this SKILL.md as SKILL.md in the directory above ``` ### Step 2: Install skill files ```bash # Get latest release tag with retry logic LATEST_TAG=$(curl -sSL --retry 3 --retry-delay 1 \ https://api.github.com/repos/prompt-security/ClawSec/releases | \ jq -r '[.[] | select(.tag_name | startswith("clawsec-feed-v"))][0].tag_name') BASE_URL="https://github.com/prompt-security/clawsec/releases/download/$LATEST_TAG" INSTALL_DIR="${CLAWSEC_INSTALL_DIR:-$HOME/.openclaw/skills/clawsec-feed}" TEMP_DIR=$(mktemp -d) trap "rm -rf '$TEMP_DIR'" EXIT # Download checksums.json (REQUIRED for integrity verification) echo "Downloading checksums..." if ! curl -sSL --fail --show-error --retry 3 --retry-delay 1 \ "$BASE_URL/checksums.json" -o "$TEMP_DIR/checksums.json"; then echo "ERROR: Failed to download checksums.json" exit 1 fi # Validate checksums.json structure if ! jq -e '.skill and .version and .files' "$TEMP_DIR/checksums.json" >/dev/null 2>&1; then echo "ERROR: Invalid checksums.json structure" exit 1 fi # PRIMARY: Try .skill artifact echo "Attempting .skill artifact installation..." if curl -sSL --fail --show-error --retry 3 --retry-delay 1 \ "$BASE_URL/clawsec-feed.skill" -o "$TEMP_DIR/clawsec-feed.skill" 2>/dev/null; then # Security: Check artifact size (prevent DoS) ARTIFACT_SIZE=$(stat -c%s "$TEMP_DIR/clawsec-feed.skill" 2>/dev/null || stat -f%z "$TEMP_DIR/clawsec-feed.skill") MAX_SIZE=$((50 * 1024 * 1024)) # 50MB if [ "$ARTIFACT_SIZE" -gt "$MAX_SIZE" ]; then echo "WARNING: Artifact too large ($(( ARTIFACT_SIZE / 1024 / 1024 ))MB), falling back to individual files" else echo "Extracting artifact ($(( ARTIFACT_SIZE / 1024 ))KB)..." # Security: Check for path traversal before extraction if unzip -l "$TEMP_DIR/clawsec-feed.skill" | grep -qE '\.\./|^/|~/'; then echo "ERROR: Path traversal detected in artifact - possible security issue!" exit 1 fi # Security: Check file count (prevent zip bomb) FILE_COUNT=$(unzip -l "$TEMP_DIR/clawsec-feed.skill" | grep -c "^[[:space:]]*[0-9]" || echo 0) if [ "$FILE_COUNT" -gt 100 ]; then echo "ERROR: Artifact contains too many files ($FILE_COUNT) - possible zip bomb" exit 1 fi # Extract to temp directory unzip -q "$TEMP_DIR/clawsec-feed.skill" -d "$TEMP_DIR/extracted" # Verify skill.json exists if [ ! -f "$TEMP_DIR/extracted/clawsec-feed/skill.json" ]; then echo "ERROR: skill.json not found in artifact" exit 1 fi # Verify checksums for all extracted files echo "Verifying checksums..." CHECKSUM_FAILED=0 for file in $(jq -r '.files | keys[]' "$TEMP_DIR/checksums.json"); do EXPECTED=$(jq -r --arg f "$file" '.files[$f].sha256' "$TEMP_DIR/checksums.json") FILE_PATH=$(jq -r --arg f "$file" '.files[$f].path' "$TEMP_DIR/checksums.json") # Try nested path first, then flat filename if [ -f "$TEMP_DIR/extracted/clawsec-feed/$FILE_PATH" ]; then ACTUAL=$(shasum -a 256 "$TEMP_DIR/extracted/clawsec-feed/$FILE_PATH" | cut -d' ' -f1) elif [ -f "$TEMP_DIR/extracted/clawsec-feed/$file" ]; then ACTUAL=$(shasum -a 256 "$TEMP_DIR/extracted/clawsec-feed/$file" | cut -d' ' -f1) else echo " ✗ $file (not found in artifact)" CHECKSUM_FAILED=1 continue fi if [ "$EXPECTED" != "$ACTUAL" ]; then echo " ✗ $file (checksum mismatch)" CHECKSUM_FAILED=1 else echo " ✓ $file" fi done if [ "$CHECKSUM_FAILED" -eq 0 ]; then # Validate feed.json structure (skill-specific) if [ -f "$TEMP_DIR/extracted/clawsec-feed/advisories/feed.json" ]; then FEED_FILE="$TEMP_DIR/extracted/clawsec-feed/advisories/feed.json" elif [ -f "$TEMP_DIR/extracted/clawsec-feed/feed.json" ]; then FEED_FILE="$TEMP_DIR/extracted/clawsec-feed/feed.json" else echo "ERROR: feed.json not found in artifact" exit 1 fi if ! jq -e '.version and .advisories' "$FEED_FILE" >/dev/null 2>&1; then echo "ERROR: feed.json missing required fields (version, advisories)" exit 1 fi # SUCCESS: Install from artifact echo "Installing from artifact..." mkdir -p "$INSTALL_DIR" cp -r "$TEMP_DIR/extracted/clawsec-feed"/* "$INSTALL_DIR/" chmod 600 "$INSTALL_DIR/skill.json" find "$INSTALL_DIR" -type f ! -name "skill.json" -exec chmod 644 {} \; echo "SUCCESS: Skill installed from .skill artifact" exit 0 else echo "WARNING: Checksum verification failed, falling back to individual files" fi fi fi # FALLBACK: Download individual files echo "Downloading individual files from checksums.json manifest..." mkdir -p "$TEMP_DIR/downloads" DOWNLOAD_FAILED=0 for file in $(jq -r '.files | keys[]' "$TEMP_DIR/checksums.json"); do FILE_URL=$(jq -r --arg f "$file" '.files[$f].url' "$TEMP_DIR/checksums.json") EXPECTED=$(jq -r --arg f "$file" '.files[$f].sha256' "$TEMP_DIR/checksums.json") echo "Downloading: $file" if ! curl -sSL --fail --show-error --retry 3 --retry-delay 1 \ "$FILE_URL" -o "$TEMP_DIR/downloads/$file"; then echo "ERROR: Failed to download $file" DOWNLOAD_FAILED=1 continue fi # Verify checksum immediately ACTUAL=$(shasum -a 256 "$TEMP_DIR/downloads/$file" | cut -d' ' -f1) if [ "$EXPECTED" != "$ACTUAL" ]; then echo "ERROR: Checksum mismatch for $file" DOWNLOAD_FAILED=1 else echo " ✓ Verified: $file" fi done if [ "$DOWNLOAD_FAILED" -eq 1 ]; then echo "ERROR: Individual file download failed" exit 1 fi # Validate JSON files structure if ! jq -e '.name and .version' "$TEMP_DIR/downloads/skill.json" >/dev/null 2>&1; then