clawsec-suite

This means clawsec-suite can: clawsec-suite does not hard-code add-on skill names in this document. Discover the current catalog from the authoritative index ( ) at runtime: Fallback behavior: After installing the suite, enable the advisory guardian hook: Optional: create/update a periodic cron nudge (default every 6h ) that triggers a main-session advisory scan: What this adds: Restart the OpenClaw gateway after enabling the hook. Then run /new once to force an immediate scan in the next session context. When the user asks to install a skill, treat that as the first request and run a guarded install check: Behavior: This enforces: The embedded feed logic uses these defaults: Fail-closed verification: Feed signatures are required by default. Checksum manifests are verified when companion checksum artifacts are available. Set CLAWSEC_ALLOW_UNSIGNED_FEED=1 only as a temporary migration bypass when adopting this version before signed feed artifacts are available upstream. Advisories in the feed can include exploitability_score and exploitability_rationale fields to help agents prioritize real-world threats: When processing advisories, prioritize by exploitability in addition to severity. A HIGH severity + HIGH exploitability CVE is more urgent than a CRITICAL severity + LOW exploitability CVE.