A transparent HTTP/HTTPS proxy that inspects AI agent traffic in real time to detect threats and data exfiltration.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawsec-1-0-0
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawsec-1-0-0 using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawSec Monitor?
ClawSec Monitor is a sophisticated security layer designed for developers deploying AI agents. By sitting between your agents and the internet, it acts as a transparent proxy that intercepts all HTTP and HTTPS requests. It uses full Man-in-the-Middle (MITM) interception to ensure that even encrypted traffic is visible for scanning, allowing it to identify potential security breaches before they cause damage.
As a featured part of the Openclaw Skills ecosystem, ClawSec Monitor provides real-time detection of both outbound exfiltration (like API keys or private keys leaving your system) and inbound injections (like malicious shell commands). All detections are recorded in a structured format, giving you full visibility into what your AI agents are actually doing on the network.
ClawSec Monitor Use Cases
- Monitoring AI agents for accidental leaking of sensitive credentials like AWS keys or .env files.
- Preventing prompt injection attacks that attempt to execute destructive shell commands like rm -rf.
- Auditing third-party AI agent behavior to ensure compliance with data privacy standards.
- Debugging network requests and responses during AI agent development.
How ClawSec Monitor Works
- The ClawSec Monitor proxy starts and begins listening on a local port (default 8888).
- AI agent traffic is routed through the proxy using standard environment variables.
- For HTTPS traffic, the monitor performs a MITM handshake using a local Certificate Authority to decrypt the stream.
- Every request and response is scanned against a database of EXFIL and INJECTION patterns.
- If a match is found, a detailed threat entry is appended to a structured JSONL log file.
- The monitor re-encrypts the traffic and forwards it to the intended destination.
ClawSec Monitor Setup
To integrate this into your workflow with Openclaw Skills, follow these steps:
# Install dependencies
pip install cryptography>=42.0.0
# Start the monitor
python3 clawsec-monitor.py start
# Install the generated CA certificate (macOS example)
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt
# Route your agent traffic
export HTTP_PROXY=http://127.0.0.1:8888
export HTTPS_PROXY=http://127.0.0.1:8888
ClawSec Monitor Data Schema & Taxonomy
ClawSec Monitor organizes its findings in a structured threats.jsonl file. Each entry follows this schema:
| Field | Description |
|---|---|
direction |
outbound (agent to internet) or inbound (internet to agent) |
threat_type |
EXFIL (data leaving) or INJECTION (malicious commands) |
pattern |
The specific rule triggered (e.g., ai_api_key, shell_exec) |
snippet |
A 200-character context window of the detected threat |
dest |
The target host and port of the communication |
timestamp |
ISO 8601 UTC format |
ClawSec Monitor Advanced Features
- Full MITM HTTPS Interception: Real-time decryption and inspection of secure traffic.
- Automated Deduplication: Suppresses redundant alerts for the same pattern/destination within a 60-second window.
- Docker Support: Seamless deployment using Docker Compose with built-in health checks.
- Custom Configuration: Fine-grained control over ports, log levels, and scanning byte limits via JSON config.
- Threat Forensics: CLI tools to dump and analyze the most recent threats with customizable limits.
SKILL.md
Loading
Related Openclaw Skills
ClawSec Monitor
ClawSec Monitor is a transparent HTTP/HTTPS proxy designed to inspect, log, and secure all real-time traffic generated by AI agents.
Skill-Find
A discovery engine for finding and installing specialized capabilities within the Openclaw Skills ecosystem.
Claw Shell Hardened
A hardened shell execution environment that runs commands within a dedicated, persistent tmux session to ensure safe and isolated terminal interactions.
ArXiv Watcher Hardened
A specialized research skill that enables AI agents to search, summarize, and maintain a persistent log of ArXiv papers.
Magister Skill
A specialized tool for fetching student schedules, grades, and attendance records from the Dutch Magister education portal.
WhisperX Speech Recognition
A high-performance local speech recognition skill that provides lightning-fast offline transcription with word-level precision.
Featured*
