undefined

Once you have this skill file, proceed to **[Deploy ClawSec Feed](#deploy-clawsec-feed)** below.

---

mkdir -p ~/.openclaw/skills/clawsec-feed

undefined

undefined

# Security: Check for path traversal before extraction
if unzip -l "$TEMP_DIR/clawsec-feed.skill" | grep -qE '\.\./|^/|~/'; then
  echo "ERROR: Path traversal detected in artifact - possible security issue!"
  exit 1
fi

# Security: Check file count (prevent zip bomb)
FILE_COUNT=$(unzip -l "$TEMP_DIR/clawsec-feed.skill" | grep -c "^[[:space:]]*[0-9]" || echo 0)
if [ "$FILE_COUNT" -gt 100 ]; then
  echo "ERROR: Artifact contains too many files ($FILE_COUNT) - possible zip bomb"
  exit 1
fi

# Extract to temp directory
unzip -q "$TEMP_DIR/clawsec-feed.skill" -d "$TEMP_DIR/extracted"

# Verify skill.json exists
if [ ! -f "$TEMP_DIR/extracted/clawsec-feed/skill.json" ]; then
  echo "ERROR: skill.json not found in artifact"
  exit 1
fi

# Verify checksums for all extracted files
echo "Verifying checksums..."
CHECKSUM_FAILED=0
for file in $(jq -r '.files | keys[]' "$TEMP_DIR/checksums.json"); do
  EXPECTED=$(jq -r --arg f "$file" '.files[$f].sha256' "$TEMP_DIR/checksums.json")
  FILE_PATH=$(jq -r --arg f "$file" '.files[$f].path' "$TEMP_DIR/checksums.json")

  # Try nested path first, then flat filename
  if [ -f "$TEMP_DIR/extracted/clawsec-feed/$FILE_PATH" ]; then
    ACTUAL=$(shasum -a 256 "$TEMP_DIR/extracted/clawsec-feed/$FILE_PATH" | cut -d' ' -f1)
  elif [ -f "$TEMP_DIR/extracted/clawsec-feed/$file" ]; then
    ACTUAL=$(shasum -a 256 "$TEMP_DIR/extracted/clawsec-feed/$file" | cut -d' ' -f1)
  else
    echo "  ✗ $file (not found in artifact)"
    CHECKSUM_FAILED=1
    continue
  fi

  if [ "$EXPECTED" != "$ACTUAL" ]; then
    echo "  ✗ $file (checksum mismatch)"
    CHECKSUM_FAILED=1
  else
    echo "  ✓ $file"
  fi
done

if [ "$CHECKSUM_FAILED" -eq 0 ]; then
  # Validate feed.json structure (skill-specific)
  if [ -f "$TEMP_DIR/extracted/clawsec-feed/advisories/feed.json" ]; then
    FEED_FILE="$TEMP_DIR/extracted/clawsec-feed/advisories/feed.json"
  elif [ -f "$TEMP_DIR/extracted/clawsec-feed/feed.json" ]; then
    FEED_FILE="$TEMP_DIR/extracted/clawsec-feed/feed.json"
  else
    echo "ERROR: feed.json not found in artifact"
    exit 1
  fi

  if ! jq -e '.version and .advisories' "$FEED_FILE" >/dev/null 2>&1; then
    echo "ERROR: feed.json missing required fields (version, advisories)"
    exit 1
  fi

  # SUCCESS: Install from artifact
  echo "Installing from artifact..."
  mkdir -p "$INSTALL_DIR"
  cp -r "$TEMP_DIR/extracted/clawsec-feed"/* "$INSTALL_DIR/"
  chmod 600 "$INSTALL_DIR/skill.json"
  find "$INSTALL_DIR" -type f ! -name "skill.json" -exec chmod 644 {} \;
  echo "SUCCESS: Skill installed from .skill artifact"
  exit 0
else
  echo "WARNING: Checksum verification failed, falling back to individual files"
fi

undefined

undefined

undefined

ClawSec Feed deployed successfully. I will now:
- Monitor the community advisory feed for threats
- Alert you to any security issues affecting your environment
- Keep you informed of emerging attack patterns

undefined

**Feed structure:**

```json
{
  "version": "1.0",
  "updated": "2026-02-02T12:00:00Z",
  "advisories": [
    {
      "id": "GA-2026-001",
      "severity": "critical",
      "type": "malicious_skill",
      "title": "Malicious data exfiltration in skill 'helper-plus'",
      "description": "Skill sends user data to external server",
      "affected": ["helper-plus@1.0.0", "helper-plus@1.0.1"],
      "action": "Remove immediately",
      "published": "2026-02-01T10:00:00Z"
    }
  ]
}

undefined

undefined

undefined

undefined

undefined

---

undefined

**If you find affected skills:**
1. Check the advisory for details and severity
2. Notify your user immediately for critical/high severity
3. Include the recommended action from the advisory

---

📡 ClawSec Feed: 2 new advisories since last check

CRITICAL - GA-2026-015: Malicious prompt pattern "ignore-all"
  → Detected prompt injection technique. Update your system prompt defenses.

HIGH - GA-2026-016: Vulnerable skill "data-helper" v1.2.0
  → You have this installed! Recommended action: Update to v1.2.1 or remove.

FEED_OK - Advisory feed checked, no new alerts. 📡

{
  "schema_version": "1.0",
  "last_feed_check": "2026-02-02T15:00:00Z",
  "last_feed_updated": "2026-02-02T12:00:00Z",
  "known_advisories": ["GA-2026-001", "GA-2026-002"]
}

STATE_FILE="$HOME/.openclaw/clawsec-feed-state.json"

---

undefined

---

undefined

---

undefined

**Note:** For maximum security, verify checksums.json via a separate trusted channel (e.g., direct from GitHub release page UI, not via curl).

---