skills.rest
chrisochrisochriso-cmyk
chrisochrisochriso-cmykCOMMUNITY
Explore all skills by this author →
GitHub

clawsec

Detect secrets, sensitive file accesses, and command injection in HTTP/HTTPS traffic.

6|2|Updated Feb 19, 2026
Search Tags:#logging#mitm#proxy#secret-detection#threat-detection#traffic-inspection
One-click install
npx skills add https://github.com/chrisochrisochriso-cmyk/clawsec-monitor --skill clawsec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: clawsec
Source: https://github.com/chrisochrisochriso-cmyk/clawsec-monitor/tree/main
Command: npx skills add https://github.com/chrisochrisochriso-cmyk/clawsec-monitor --skill clawsec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Many autonomous AI agents make outbound network requests that can accidentally leak secrets, expose sensitive files, or carry injected commands; ClawSec provides transparent, real-time visibility and automatic detection so you can see and stop those risks without changing agent code or workflows.

Core Features & Use Cases

  • Transparent HTTP/HTTPS proxy that inspects both request and response payloads and supports optional TLS MITM via a locally generated CA for full plaintext analysis.
  • Pattern-based threat detection for API keys, private key material, sensitive file paths, command injection, reverse shells, and SSH lateral movement with deduplication and structured JSONL logging.
  • Operational tooling & deployment including a Docker Compose option, a PID-managed CLI (start/stop/status/threats), and an integrated test suite to validate detection and resilience.
  • Use case: Route a containerised agent through the proxy to detect and block accidental exfiltration of API keys or execution of shell payloads delivered over HTTP.

Quick Start

Install the cryptography dependency and start the monitor in the foreground to inspect traffic on localhost:8888.

Frequently Asked Questions about clawsec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I monitor AI agent HTTP traffic for secret exfiltration?▼

Monitor AI agent HTTP traffic for secret exfiltration by applying an intercepting proxy to agent processes, inspecting payloads in real time to detect API keys and sensitive file access automatically. It routes traffic through a transparent proxy to prevent data leaks.

How does TLS MITM proxy inspection work for detecting command injection?▼

TLS MITM proxy inspection works by generating a local CA to decrypt HTTPS traffic into plaintext, enabling pattern-based detection of command injection and reverse shells within the payloads. It logs deduplicated threats for containerized deployments.

Can I deploy a traffic inspection proxy using Docker for autonomous agents?▼

You can deploy a traffic inspection proxy using a health-checked Docker Compose deployment configured for containerized autonomous agents. This setup allows you to route agent traffic through the proxy without modifying code.

What are the limitations of pattern-based threat detection for AI agents?▼

Limitations of pattern-based threat detection include reliance on predefined patterns for secrets and command injection, requiring a configurable scan byte limit to handle large payloads. It focuses on HTTP/HTTPS traffic rather than full network-level intrusion prevention.

Related Skills

Explore More Software Engineering Skills→
googlegoogle
68

dev-mitm-proxy

Develop and maintain Capsem's MITM proxy for TLS traffic inspection.

Official
Advanced
YukiIto1999YukiIto1999

analyzing-network-traffic-for-incidents

Detect adversary activity in PCAPs, Zeek logs, and IDS alerts.

Community
Advanced
afel6afel6

docker-management

Manage Docker containers, images, volumes, networks, and Compose stacks.

Community
Intermediate
dougwithseismicdougwithseismic

mitm-start

Start the MITM proxy in headless mode and export HTTP/HTTPS proxy environment variables.

Community
Basic