An open-source, single-binary cybersecurity platform offering 16 specialized modules to protect Linux servers and AI agent hosts.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install 1sec-security
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install 1sec-security using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is 1-SEC Security Platform?
1-SEC is a comprehensive security solution designed for modern Linux environments and VPS instances. It consolidates 16 powerful defense modules—including LLM firewalls, ransomware interceptors, and network guardians—into a single, high-performance binary. Built with the security of Openclaw Skills in mind, it provides robust protection against common vulnerabilities and advanced threats without requiring complex multi-service configurations. Whether you are securing a personal web server or a fleet of autonomous AI agents, 1-SEC delivers deep visibility and automated enforcement with zero-config requirements.
1-SEC Security Platform Use Cases
- Hardening Linux VPS instances against brute force, credential stuffing, and port scanning.
- Protecting AI agent hosts from prompt injection and malicious skill installations using specialized presets.
- Implementing a unified LLM firewall to monitor and filter agent interactions in real-time.
- Deploying automated ransomware interception and file integrity monitoring on production servers.
- Securing supply chains by monitoring SBOMs and detecting dependency confusion attacks.
How 1-SEC Security Platform Works
- The user downloads the 1-SEC binary and verifies its integrity using SHA256 checksums to ensure supply chain safety.
- The platform initializes a local configuration directory at ~/.1sec/ and loads its 16 defense modules with default safe settings.
- 1-SEC starts its monitoring engine, analyzing network traffic, system calls, and file modifications in real-time.
- Detected threats are processed through an enforcement engine that applies predefined policies, such as blocking malicious IPs via iptables or killing suspicious processes.
- Optional AI correlation via the Gemini API allows the platform to analyze cross-module metadata for sophisticated, multi-vector threat detection.
1-SEC Security Platform Setup
To install the platform for use with Openclaw Skills, follow these manual steps to ensure binary integrity:
# 1. Download the release binary and checksums
VERSION="0.4.11"
wget https://github.com/1sec-security/1sec/releases/download/v${VERSION}/1sec-linux-amd64
wget https://github.com/1sec-security/1sec/releases/download/v${VERSION}/checksums.txt
# 2. Verify SHA256 checksum
sha256sum -c checksums.txt 2>&1 | grep 1sec-linux-amd64
# 3. Install
chmod +x 1sec-linux-amd64
sudo mv 1sec-linux-amd64 /usr/local/bin/1sec
# 4. Initialize and start
1sec setup --non-interactive
1sec up
1-SEC Security Platform Data Schema & Taxonomy
1-SEC organizes its operations within the local user directory and specific configuration files to maintain a small footprint.
| Item | Description | Location |
|---|---|---|
| Config File | The primary YAML configuration for modules, webhooks, and enforcement rules. | ~/.1sec/1sec.yaml |
| State Directory | Stores the local threat database, logs, and agent state files. | ~/.1sec/ |
| Binary | The single-file executable used for both the daemon and CLI management. | /usr/local/bin/1sec |
| Alert Metadata | JSON-formatted metadata used for local logging and external webhook notifications. | Runtime Context |
1-SEC Security Platform Advanced Features
- VPS-Agent Preset: A purpose-built enforcement mode designed specifically for unattended AI agent hosts to prevent scope escalation.
- LLM Firewall: Includes over 65 detection patterns for prompt injection, jailbreaks, and multimodal scanning.
- AI Analysis Engine: A two-tier pipeline using the Gemini API for advanced cross-module threat correlation.
- Automated Enforcement: Supports autonomous process killing, file quarantine, and IP blocking with customizable escalation timers.
- Dashboard TUI: A real-time terminal user interface for monitoring alerts and module status directly from the CLI.
SKILL.md
Loading
Related Openclaw Skills
Agent Pipeline Skill
A standardized, multi-agent development workflow that orchestrates specialized AI agents to handle research, coding, security, and testing tasks.
Community Demand Prospecting
A comprehensive workflow for product auditing, market research, and high-intent community outreach on platforms like Reddit and X.
NEAR GetPay Skill
A versatile tool for creating hosted, mobile-friendly payment pages to accept NEAR, USDC, and USDT via PingPay or HOT PAY integrations.
NEAR Tools
A comprehensive toolkit for installing and managing the NEAR Protocol CLI across all platforms.
unit-convert
A comprehensive conversion utility for real-time currency exchange, physical unit transformations, and data encoding.
verify-claim
A real-time fact-checking skill that validates claims against live data sources with structured verdicts and confidence scores.
METADATA
Featured*
