skills.rest
prompt-security
prompt-securityOFFICIAL
Explore all skills by this author →
GitHub

picoclaw-traffic-guardian

Defines a specification baseline for monitoring Picoclaw AI gateway HTTP traffic for exfiltration and injection.

1.1k|113|Updated Feb 5, 2026
Search Tags:#Security#traffic monitoring#injection detection#exfiltration detection#AI Gateway#PicoClaw#proxy inspection
One-click install
npx skills add https://github.com/prompt-security/clawsec --skill picoclaw-traffic-guardian
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: picoclaw-traffic-guardian
Source: https://github.com/prompt-security/clawsec/tree/main/skills/picoclaw-traffic-guardian
Command: npx skills add https://github.com/prompt-security/clawsec --skill picoclaw-traffic-guardian

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Picoclaw AI gateway traffic currently has no standardized way to detect outbound secret exfiltration or inbound command-injection payloads, leaving operators blind to data leaks and tool-abuse attempts in lightweight agent runtimes.

Core Features & Use Cases

  • Traffic Monitoring Specification: Defines a detector core, Picoclaw adapter, and operator interface for HTTP/HTTPS proxy inspection with a normalized JSONL finding schema.
  • Exfiltration and Injection Detection: Specifies patterns for AI API keys, AWS credentials, private keys, pipe-to-shell commands, and reverse shell shapes, with mandatory snippet redaction.
  • Posture Integration: Exports a signed profile fragment so picoclaw-security-guardian can drift-check monitor status, config hashes, and log digests.
  • Use Case: A builder implementing Picoclaw runtime security uses this spec to ship an opt-in, detect-and-log proxy monitor that redacts secrets before writing local findings.

Quick Start

Ask your agent to install the picoclaw-traffic-guardian skill from prompt-security/clawsec and review SPEC.md before implementing the monitor.

Frequently Asked Questions about picoclaw-traffic-guardian

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I monitor Picoclaw AI gateway traffic for data exfiltration?▼

Use this skill's specification to implement an opt-in HTTP proxy monitor that scans outbound traffic for AI API keys, AWS credentials, and private key markers. Findings are written as redacted JSONL records, and blocking is intentionally out of scope for the first implementation.

What threats does Picoclaw traffic inspection detect?▼

The specification covers outbound exfiltration patterns such as API keys, SSH paths, and dotenv credentials, plus inbound injection shapes like pipe-to-shell commands, reverse shells, and destructive remove commands. All snippets are redacted before persistence.

Does picoclaw-traffic-guardian include a working proxy implementation?▼

No, version 0.0.1 is a specification scaffold only and ships no runtime proxy code. It defines the architecture, finding schema, and safety contract that builders must follow when implementing the monitor.

Can the monitor inspect HTTPS traffic in Picoclaw?▼

HTTPS MITM inspection is planned as an optional capability requiring operator-supplied per-process CA trust configuration. Automatic system trust-store installation is explicitly prohibited by the safety contract.

How does picoclaw-traffic-guardian integrate with picoclaw-security-guardian?▼

It exports a small signed profile fragment containing monitor status, mode, config hash, and log digest. The security guardian skill consumes this fragment for posture profiling and drift-checking without owning the proxy runtime.

Related Skills

Explore More Software Engineering Skills→
RedHatProductSecurityRedHatProductSecurity
47

internal-application-routing

Route internal application requests through a designated API gateway.

Official
Basic
woohyun212woohyun212
21

cloud-pentest

Assess AWS, Azure, and GCP security posture with ScoutSuite and Prowler audits.

Community
Advanced
pohlai88pohlai88

clawsec-suite

Monitors advisory feeds and flags high-risk matches for installed skills.

Community
Advanced
WbunkerWbunker

istio-expert

Provide expert Istio service mesh assistance for architecture, traffic, security, and observability.

Community
Advanced