skills.rest
automateyournetwork
automateyournetworkCOMMUNITY
Explore all skills by this author →
Website𝕏@john_capobiancoGitHub

defenseclaw-ops

Manage DefenseClaw security scanning, tool permissions, alerts, and guardrails for NetClaw deployments.

650|182|Updated Feb 19, 2026
Search Tags:#audit#scanning#Security#siem#Guardrails#defenseclaw#Compliance
One-click install
npx skills add https://github.com/automateyournetwork/netclaw --skill defenseclaw-ops
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defenseclaw-ops
Source: https://github.com/automateyournetwork/netclaw/tree/main/workspace/skills/defenseclaw-ops
Command: npx skills add https://github.com/automateyournetwork/netclaw --skill defenseclaw-ops

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Operating an AI network automation agent introduces security risks from untrusted skills, MCP servers, and plugins, plus the need for audit trails and runtime guardrails. This Skill provides the operational commands to scan components, enforce tool permissions, monitor alerts, and configure DefenseClaw enterprise security.

Core Features & Use Cases

  • Component Scanning: Scan skills, MCP servers, and plugins for HIGH/CRITICAL findings before deployment, with allow/block verdicts.
  • Tool Permission Management: Block or allow specific tools (e.g., destructive operations like delete_file) with wildcard pattern support.
  • Alerts & Audit Export: View and filter security alerts by severity or date, and export to JSON or CSV for compliance reporting.
  • Guardrail Configuration: Switch between observe mode (log only) and action mode (block violations) across categories like secrets, shell commands, and prompt injection.
  • Use Case: Before deploying a new community skill, run a DefenseClaw scan to detect hardcoded credentials, then export the audit log to your SIEM for compliance review.

Quick Start

Ask the agent to check the DefenseClaw security status and scan a skill before deploying it.

Frequently Asked Questions about defenseclaw-ops

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a skill or MCP server for security issues before deploying it?▼

Run defenseclaw skill scan <name>, defenseclaw mcp scan <name>, or defenseclaw plugin scan <name>. Clean components return an ALLOWED status, while HIGH or CRITICAL findings such as hardcoded credentials result in a BLOCKED status.

How do I block a dangerous tool like delete_file?▼

Use defenseclaw tool block delete_file --reason "destructive operation" to block a specific tool. Wildcards are supported, so defenseclaw tool block "*_write" blocks all write operations, and defenseclaw tool list shows all active rules.

What is the difference between observe and action guardrail modes?▼

Observe mode logs guardrail violations but allows execution, suited for development and onboarding. Action mode logs violations and blocks them, intended for production and compliance environments. Switch modes with defenseclaw setup guardrail --mode action --restart.

Can DefenseClaw export audit logs to a SIEM like Splunk?▼

Yes. Configure a Splunk HEC or OTLP endpoint with defenseclaw config siem, then verify connectivity using defenseclaw config siem --test. Alerts can also be exported directly to JSON or CSV files for compliance reporting.

What should I do if a component is falsely blocked by a scan?▼

Run defenseclaw skill scan <name> --verbose to view detailed findings. If the finding is a false positive, add an exception with defenseclaw exception add <component> --finding <id> --reason "reviewed".

Why is the defenseclaw command not found in my shell?▼

The defenseclaw binary may not be in your PATH. Add it with export PATH="$HOME/.local/bin:$PATH", then verify installation with defenseclaw --version and confirm the gateway is running with pgrep defenseclaw-gateway.

Related Skills

Explore More Software Engineering Skills→
tyronerosstyroneross
1

build-loop:defenseclaw-bridge

Generates Cisco DefenseClaw runtime-security spec files from project artifacts.

Community
Advanced
xalgordxalgord
954

building-soc-metrics-and-kpi-tracking

Builds SOC performance dashboards tracking MTTD, MTTR, alert quality, and ATT&CK detection coverage from SIEM data.

Community
Intermediate
ComposioHQComposioHQ
74.2k

Webex Automation

Automate Cisco Webex messaging, room management, and webhook configuration through natural language commands.

Official
Intermediate
openaiopenai
5.3k

connect-chatcut-desktop

Installs and connects ChatCut Desktop to restore missing chatcut_desktop MCP tools.

Official
Intermediate