skills.rest
prompt-security
prompt-securityOFFICIAL
Explore all skills by this author →
GitHub

picoclaw-self-pen-testing

Analyzes Picoclaw posture profiles and emits severity-ranked read-only security findings.

1.1k|113|Updated Feb 5, 2026
Search Tags:#audit#Security#read-only#findings#Node#posture review#PicoClaw
One-click install
npx skills add https://github.com/prompt-security/clawsec --skill picoclaw-self-pen-testing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: picoclaw-self-pen-testing
Source: https://github.com/prompt-security/clawsec/tree/main/skills/picoclaw-self-pen-testing
Command: npx skills add https://github.com/prompt-security/clawsec --skill picoclaw-self-pen-testing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Operators running Picoclaw agent environments need a local, read-only way to review their security posture without modifying configuration or sending data over the network. This Skill turns a generated Picoclaw posture profile into severity-ranked findings with remediation guidance.

Core Features & Use Cases

  • Posture Finding Engine: Detects critical issues such as publicly exposed Web UI, disabled UI auth, unrestricted workspace tooling, and unsigned verification mode.
  • Trust-Boundary Reviews: Flags MCP server usage, scheduler persistence, plaintext secret markers, and multi-channel gateway auth for operator review.
  • Deterministic Output: Emits stable, sorted JSON findings plus a severity summary count for auditing and diffing over time.
  • Use Case: An operator runs the CLI against their current Picoclaw profile before exposing a gateway, receives a critical finding for a public Web UI, and binds it to localhost with auth before going live.

Quick Start

Ask the agent to run the Picoclaw posture review against your current profile at ~/.picoclaw/security/clawsec/current-profile.json and summarize the findings.

Frequently Asked Questions about picoclaw-self-pen-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Picoclaw security posture review?▼

Run the CLI with node scripts/self_pen_test.mjs --profile followed by the path to your Picoclaw posture profile JSON. It prints severity-ranked findings and a summary count as stable JSON for operator review.

What security issues does Picoclaw posture review detect?▼

It flags public Web UI exposure, disabled UI auth, unrestricted workspace tooling, unsigned verification mode, MCP trust-boundary review needs, scheduler persistence, plaintext secret markers, and multi-channel gateway auth concerns.

Does the Picoclaw self pen test modify my configuration?▼

No, the analysis is strictly read-only against an existing posture profile. It installs no scheduler, makes no network requests, and findings are guidance only; remediation requires explicit operator approval.

Can I verify the integrity of the skill release before installing?▼

Yes, standalone installs can verify the signed release manifest by checking checksums.json against checksums.sig with the published signing key, then validating the archive, SKILL.md, and skill.json hashes before extraction.

What are the limitations of local posture-review findings?▼

Findings depend entirely on the accuracy of the input posture profile and only cover the checks encoded in the finding engine. It does not perform live scanning, exploitation, or auto-remediation of the flagged issues.

Related Skills

Explore More Software Engineering Skills→
RakameNouyaRakameNouya

profiler-get-status

Retrieve Unity profiler status including enabled modules and memory usage.

Community
Basic
elasticelastic
21.2k

encrypted-saved-objects

Encrypt sensitive attributes within Kibana Saved Objects using AAD binding.

Official
Advanced
prompt-securityprompt-security
1.1k

clawsec-feed

Integrate a live advisory feed to surface OpenClaw security advisories.

Official
Advanced
prince3626ezechiel-langprince3626ezechiel-lang

hermes-attestation-guardian

Generate and verify Hermes infrastructure posture attestations to detect configuration drift.

Community
Advanced