skills.rest
prompt-security
prompt-securityOFFICIAL
Explore all skills by this author →
GitHub

nanoclaw-traffic-guardian

Defines a baseline specification for host-side NanoClaw traffic monitoring with redacted MCP status surfaces.

1.1k|113|Updated Feb 5, 2026
Search Tags:#mcp#Security#nanoClaw#traffic monitoring#injection detection#exfiltration detection#proxy inspection
One-click install
npx skills add https://github.com/prompt-security/clawsec --skill nanoclaw-traffic-guardian
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nanoclaw-traffic-guardian
Source: https://github.com/prompt-security/clawsec/tree/main/skills/nanoclaw-traffic-guardian
Command: npx skills add https://github.com/prompt-security/clawsec --skill nanoclaw-traffic-guardian

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

NanoClaw agent runtimes currently lack a defined, container-safe way to monitor host-managed traffic for outbound secret exfiltration and inbound command injection. This Skill provides the specification baseline, safety contract, and signed release verification procedure that builders follow to implement that monitoring without breaking container isolation.

Core Features & Use Cases

  • Specification Baseline: Ships a full SPEC.md defining the detector core, host service, MCP tool surface (clawsec_traffic_status, clawsec_traffic_findings, clawsec_traffic_check_config), and operator interface for runtime traffic monitoring.
  • Safety Contract: Enforces opt-in, detect-and-log defaults, host-held CA private keys, redacted snippets, and no blocking or automatic trust-store changes in the first implementation.
  • Signed Release Verification: Provides a complete shell procedure to verify checksums.json, checksums.sig, signing-public.pem, the archive hash, and SKILL.md/skill.json checksums before standalone installation.
  • Use Case: A builder extending NanoClaw uses this scaffold to implement HTTP proxy inspection that detects AI API keys and AWS credentials leaving the runtime, while exposing only redacted findings to the container via MCP tools.

Quick Start

Ask your agent to install the nanoclaw-traffic-guardian skill from prompt-security/clawsec and then read SPEC.md to plan the host-side proxy implementation.

Frequently Asked Questions about nanoclaw-traffic-guardian

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I monitor NanoClaw runtime traffic for data exfiltration?▼

Use this skill as the specification baseline: implement a host-side HTTP proxy that inspects request and response text up to a bounded byte limit, detects patterns like AI API keys and AWS access key IDs, and writes redacted JSONL findings. The container only sees status and redacted findings through MCP tools.

What MCP tools does nanoclaw-traffic-guardian define?▼

It defines three MCP tools: clawsec_traffic_status, clawsec_traffic_findings, and clawsec_traffic_check_config. These expose bounded, redacted status and findings to the container while the host service owns the proxy lifecycle and CA key material.

Does nanoclaw-traffic-guardian actively block malicious traffic?▼

No. The v0.0.1 baseline is detect-and-log only, and blocking is explicitly out of scope for the first implementation. It is also a spec scaffold, so no active runtime proxy interception ships yet.

Can the container access the HTTPS inspection CA private key?▼

No. The safety contract requires CA private key material to stay on the host side, and system trust-store changes must never run automatically. HTTPS MITM is optional and only enabled with explicit per-runtime operator trust configuration.

How do I verify the signed release before installing standalone?▼

Download checksums.json, checksums.sig, signing-public.pem, the archive, SKILL.md, and skill.json from the release tag, confirm the public key SHA256 fingerprint, verify the signature with openssl pkeyutl, then check each file hash against the manifest before extracting.

Related Skills

Explore More Software Engineering Skills→
clsandovalclsandoval

setup

Automate NanoClaw setup by installing dependencies, configuring channels, and starting services.

Community
Advanced
clsandovalclsandoval

x-integration

Automate X posting, liking, replying, retweeting, and quoting via IPC.

Community
Advanced
ISAQQSAIISAQQSAI

clawsec-suite

Monitors advisory feeds, verifies signatures, and gates risky OpenClaw skills via guarded workflows.

Community
Advanced
jboothomasjboothomas
1

convert-to-apple-container

Migrate NauggieClaw from Docker to Apple Container on macOS.

Community
Advanced