skills.rest
supportersimulator
supportersimulatorCOMMUNITY
Explore all skills by this author →
GitHub

fleet-security

Signs fleet messages with HMAC-SHA256 to prevent tampering and replay attacks.

2|Updated Apr 5, 2026
Search Tags:#security#fleet#replay-protection#hmac#peer-validation#session-sanitization
One-click install
npx skills add https://github.com/supportersimulator/multi-fleet --skill fleet-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fleet-security
Source: https://github.com/supportersimulator/multi-fleet/tree/main/skills/fleet-security
Command: npx skills add https://github.com/supportersimulator/multi-fleet --skill fleet-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

All fleet messages can be HMAC-SHA256 signed for authentication, preventing tampering, impersonation, and enabling replay protection. The security layer also provides peer identity validation and session gold sanitization to protect sensitive metadata.

Core Features & Use Cases

  • HMAC-SHA256 Message Signing: Each outbound message includes an _hmac signature and _signed_ts timestamp to ensure integrity and authenticity.
  • Replay Prevention: Messages with aged timestamps are rejected to thwart replay attacks.
  • Peer Identity Validation: Inbound messages are filtered against a known-peers allowlist to block unknown sources.
  • HTTP Peer IP Validation: Public HTTP endpoints validate peer IPs, while loopback remains allowed.
  • Session Gold Sanitization: Before publishing, sensitive fields are stripped, leaving only safe metadata.

Quick Start

Enable HMAC across all fleet nodes and verify the health endpoint to ensure signatures are active.

Frequently Asked Questions about fleet-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add HMAC signatures to fleet messages for authentication?▼

HMAC signatures secure fleet messages by applying HMAC-SHA256 to outbound communications, appending an _hmac signature and _signed_ts timestamp to ensure message integrity and authenticity across nodes.

What's the best way to prevent replay attacks on inter-node fleet communications?▼

Replay attacks are prevented by rejecting inbound fleet messages with aged _signed_ts timestamps, ensuring older captured messages cannot be maliciously resent across the deployment.

How does peer identity validation work for multifleet deployments?▼

Peer validation filters inbound messages against a known-peers allowlist to block unknown sources, and public HTTP endpoints validate peer IPs while loopback remains allowed.

Do I need a shared HMAC key to secure multifleet messaging?▼

A shared HMAC key is required across all nodes to compute HMAC-SHA256 signatures, along with a health-check endpoint to monitor signature activity and verify security enforcement.

How do I sanitize session gold before publishing fleet messages?▼

Session gold sanitization strips sensitive fields from metadata before publication, applying a policy that leaves only safe metadata in outbound fleet messages.

Related Skills

Explore More Software Engineering Skills→
venturecraneventurecrane

health-monitor

Poll console health endpoints and send email alerts for degraded machines.

Official
Intermediate
b-open-iob-open-io
1

fleet-check

Queries the ClawNet peers API and probes heartbeat endpoints to produce a JSON health summary.

Official
Intermediate
PsqasimPsqasim
1

agent-communication

Coordinate multi-agent communications via typed, immutable messages.

Community
Advanced
igbuendigbuend
8

digital-signature-pattern

Implement digital signature patterns with asymmetric cryptography for data integrity.

Community
Advanced