ClawSec Monitor is a transparent HTTP/HTTPS proxy designed to inspect, log, and secure all real-time traffic generated by AI agents.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawsec-bak
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawsec-bak using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawSec Monitor?
ClawSec Monitor v3.0 serves as a critical security layer between AI agents and the internet. By acting as a transparent proxy, it intercepts every request and response to scan for potential threats. This tool is essential for developers using Openclaw Skills who need deep visibility into agent behavior, ensuring that sensitive data like API keys or SSH credentials are not leaked during autonomous operations.
The system utilizes full Man-in-the-Middle (MITM) interception for HTTPS traffic. It achieves this by generating a local CA to sign per-host certificates, allowing the proxy to view plaintext data before re-encrypting it for its destination. This provides a comprehensive security audit trail for both outbound requests and inbound responses, making it a cornerstone for safe AI deployment.
ClawSec Monitor Use Cases
- Monitoring AI agents in real-time to prevent the exfiltration of sensitive credentials like AWS keys or .env files.
- Detecting and blocking prompt injection attacks that attempt to execute shell commands or reverse shells.
- Auditing high-stakes AI workflows to ensure compliance with data privacy standards.
- Debugging network connectivity issues for AI agents by inspecting raw HTTP/HTTPS traffic payloads.
- Protecting local environments from destructive commands like recursive file deletion triggered by untrusted model outputs.
How ClawSec Monitor Works
- The proxy initializes a local Certificate Authority (CA) and starts listening for HTTP/HTTPS traffic on a designated port (default 8888).
- The user configures the AI agent's environment variables to route all traffic through the ClawSec gateway.
- As traffic flows, the monitor performs full MITM decryption on HTTPS connections using
asyncio.start_tls(). - Every packet is scanned against a database of EXFIL (exfiltration) and INJECTION patterns.
- Matches are recorded in a structured JSONL threat log with metadata including direction, destination, and code snippets.
- The system applies a 60-second deduplication window to prevent log flooding from repetitive requests.
ClawSec Monitor Setup
First, start the monitor to generate the necessary CA certificates:
# Start the proxy monitor
python3 clawsec-monitor.py start
Install the generated certificate (/tmp/clawsec/ca.crt) into your system or process trust store. For example, on macOS:
# Trust the CA certificate
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt
Finally, route your Openclaw Skills agent traffic through the proxy:
export HTTP_PROXY=http://127.0.0.1:8888
export HTTPS_PROXY=http://127.0.0.1:8888
ClawSec Monitor Data Schema & Taxonomy
ClawSec Monitor organizes its security data in /tmp/clawsec/threats.jsonl. Each entry follows this schema:
| Field | Description | Example |
|---|---|---|
direction |
Flow relative to agent | outbound, inbound |
threat_type |
Category of threat | EXFIL, INJECTION |
pattern |
Specific rule triggered | ai_api_key, shell_exec |
snippet |
Contextual text match | Authorization: Bearer sk-ant-... |
dest |
Target host and port | api.anthropic.com:443 |
timestamp |
ISO 8601 UTC time | 2026-02-19T13:41:59Z |
ClawSec Monitor Advanced Features
- Multi-agent support via centralized Docker deployment using Docker Compose.
- Customizable detection thresholds and deduplication windows via JSON configuration files.
- Capability to disable MITM for blind CONNECT tunneling when deep inspection is not required.
- Seamless integration with CI/CD pipelines via a 28-test regression suite and healthcheck protocols.
- Real-time threat querying and log rotation (10 MB x 3 backups) for high-traffic environments.
SKILL.md
Loading
Related Openclaw Skills
Skill-Find
A discovery engine for finding and installing specialized capabilities within the Openclaw Skills ecosystem.
Claw Shell Hardened
A hardened shell execution environment that runs commands within a dedicated, persistent tmux session to ensure safe and isolated terminal interactions.
ArXiv Watcher Hardened
A specialized research skill that enables AI agents to search, summarize, and maintain a persistent log of ArXiv papers.
Code Review & Fix (Hardened)
An automated code analysis and repair tool designed to identify bugs, security vulnerabilities, and performance bottlenecks with optional in-place fixing.
ClawSec Monitor
A transparent HTTP/HTTPS proxy that inspects AI agent traffic in real time to detect threats and data exfiltration.
Magister Skill
A specialized tool for fetching student schedules, grades, and attendance records from the Dutch Magister education portal.
Featured*
