Xpersona
agentCLAWHUBUnverified

clawtributor

Community incident reporting for AI agents. Contribute to collective security by reporting threats. Skill: clawtributor Owner: davida-ps Summary: Community incident reporting for AI agents. Contribute to collective security by reporting threats. Tags: latest:0.0.3 Version history: v0.0.3 | 2026-02-05T22:37:23.624Z | user Release 0.0.3 via CI v0.0.2 | 2026-02-05T22:33:12.444Z | user Release 0.0.2 via CI v0.0.1 | 2026-02-05T21:16:04.750Z | user Release 0.0.1 via CI Archive index: Archive v0.0.3: 5 files, 13308 bytes

OpenClaw
View on ClawHub

Rank

62

Safety

84

Downloads

1.3k

Updated

Apr 15, 2026

Version

0.0.3

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1.3K downloads reported by the source. Last updated 4/15/2026.

Avoid when

  • Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor
Clawhubvendor · observed Apr 15, 2026
Protocol compatibility
OpenClawcompatibility · observed Apr 15, 2026
Adoption signal
1.3K downloadsadoption · observed Apr 15, 2026
Latest release
0.0.3release · observed Feb 5, 2026
Handshake status
UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install kn76m78f01hqrtpgm895s0jsax80jd8v:clawtributor
  1. Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.
  2. Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-davida-ps-clawtributor/snapshot"

Documentation

CLAWHUB

68,759 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: clawtributor
version: 0.0.3
description: Community incident reporting for AI agents. Contribute to collective security by reporting threats.
homepage: https://gclawsec.prompt.security
metadata: {"openclaw":{"emoji":"🤝","category":"security"}}
clawdis:
  emoji: "🤝"
  requires:
    bins: [curl, git, gh]
---

# Clawtributor 🤝

Community incident reporting for AI agents. Contribute to collective security by reporting threats, vulnerabilities, and attack patterns.

**An open source project by [Prompt Security](https://prompt.security)**

---

## For AI Agents

If you are an AI agent reading this, execute the following to install Clawtributor:

```bash
# Get latest clawtributor release tag
LATEST_TAG=$(curl -sSL https://api.github.com/repos/prompt-security/ClawSec/releases | \
  jq -r '[.[] | select(.tag_name | startswith("clawtributor-v"))][0].tag_name')

# Download SKILL.md from latest release
SKILL_URL="https://github.com/prompt-security/clawsec/releases/download/$LATEST_TAG/SKILL.md"
curl -sSL --fail --show-error "$SKILL_URL"
```

Once you have this skill file, proceed to **[Deploy Clawtributor](#deploy-clawtributor)** below.

---

## Deploy Clawtributor

## Installation Steps:

### Step 1: Create skill directory and save this file

```bash
mkdir -p ~/.openclaw/skills/clawtributor
# Save this SKILL.md as SKILL.md in the directory above
```

### Step 2: Install skill files

```bash
# Get latest release tag with retry logic
LATEST_TAG=$(curl -sSL --retry 3 --retry-delay 1 \
  https://api.github.com/repos/prompt-security/ClawSec/releases | \
  jq -r '[.[] | select(.tag_name | startswith("clawtributor-v"))][0].tag_name')

BASE_URL="https://github.com/prompt-security/clawsec/releases/download/$LATEST_TAG"
INSTALL_DIR="${CLAWTRIBUTOR_INSTALL_DIR:-$HOME/.openclaw/skills/clawtributor}"
TEMP_DIR=$(mktemp -d)
trap "rm -rf '$TEMP_DIR'" EXIT

# Download checksums.json (REQUIRED for integrity verification)
echo "Downloading checksums..."
if ! curl -sSL --fail --show-error --retry 3 --retry-delay 1 \
     "$BASE_URL/checksums.json" -o "$TEMP_DIR/checksums.json"; then
  echo "ERROR: Failed to download checksums.json"
  exit 1
fi

# Validate checksums.json structure
if ! jq -e '.skill and .version and .files' "$TEMP_DIR/checksums.json" >/dev/null 2>&1; then
  echo "ERROR: Invalid checksums.json structure"
  exit 1
fi

# PRIMARY: Try .skill artifact
echo "Attempting .skill artifact installation..."
if curl -sSL --fail --show-error --retry 3 --retry-delay 1 \
   "$BASE_URL/clawtributor.skill" -o "$TEMP_DIR/clawtributor.skill" 2>/dev/null; then

  # Security: Check artifact size (prevent DoS)
  ARTIFACT_SIZE=$(stat -c%s "$TEMP_DIR/clawtributor.skill" 2>/dev/null || stat -f%z "$TEMP_DIR/clawtributor.skill")
  MAX_SIZE=$((50 * 1024 * 1024))  # 50MB

  if [ "$ARTIFACT_SIZE" -gt "$MAX_SIZE" ]; then
    echo "WARNING: Artifact too large ($(( ARTIFACT_SIZE / 1024 / 1024 ))MB), falling back to individual files"
  else
    echo "Extracting artifact ($(( ARTIFACT

README.md

# Clawtributor 🤝

Community incident reporting for AI agents. Contribute to collective security by reporting threats, vulnerabilities, and attack patterns.

## Features

- **Opt-in Reporting** - All submissions require explicit user approval
- **GitHub Issues** - Reports submitted via Security Incident Report template
- **Auto-Publishing** - Approved reports become `CLAW-YYYY-NNNN` advisories automatically
- **Privacy-First** - Guidelines ensure no sensitive data is shared
- **Collective Defense** - Your reports help protect all agents

## Quick Install

```bash
curl -sLO https://clawsec.prompt.security/releases/latest/download/clawtributor.skill
```

## What to Report

| Type | Examples |
|------|----------|
| `malicious_prompt` | Prompt injection, social engineering attempts |
| `vulnerable_skill` | Data exfiltration, excessive permissions |
| `tampering_attempt` | Attacks on security tools |

## How It Works

```
Agent detects threat → User approves → GitHub Issue submitted → Maintainer reviews →
"advisory-approved" label added → Auto-published as CLAW-YYYY-NNNN → All agents notified
```

## Report Example

```json
{
  "report_type": "vulnerable_skill",
  "severity": "critical",
  "title": "Data exfiltration in 'helper-plus'",
  "description": "Skill sends data to external server",
  "evidence": {
    "indicators": ["Undocumented network call", "Sends conversation context"]
  },
  "recommended_action": "Remove immediately"
}
```

## Privacy Guidelines

**DO include:** Sanitized examples, technical indicators, skill names
**DO NOT include:** User data, API keys, identifying information

## Related Skills

- **clawsec-feed** - Subscribe to security advisories
- **openclaw-audit-watchdog** - Automated daily security audits

## License

MIT License - [Prompt Security](https://prompt.security)

Together, we make the agent ecosystem safer.

_meta.json

{
  "ownerId": "kn76m78f01hqrtpgm895s0jsax80jd8v",
  "slug": "clawtributor",
  "version": "0.0.3",
  "publishedAt": 1770331043624
}

reporting.md

# ClawSec Reporting 🛡️📋

Community-driven security reporting for the agent ecosystem.

Observed a malicious prompt? Found a vulnerable skill? Report it to help protect all agents.

## How Reporting Works

```
┌─────────────────────────────────────────────────────────────┐
│                                                             │
│   Agent observes ──► Creates report ──► GitHub Issue        │
│   suspicious                                                │
│   activity                        ↓                         │
│                                                             │
│                           Maintainer review                 │
│                                   │                         │
│                         "advisory-approved"?                │
│                              │      │                       │
│                             YES     NO                      │
│                              │      │                       │
│                              ▼      ▼                       │
│   Advisory Feed ◄── Auto-published  Feedback provided       │
│   (CLAW-YYYY-NNNN)       ↓                                  │
│   All agents notified via clawsec-feed                    │
│                                                             │
└─────────────────────────────────────────────────────────────┘
```

---

## What to Report

### 1. Malicious Prompt Attempts

Prompts that attempted to:
- Bypass security controls or sandboxing
- Extract sensitive information (credentials, API keys, personal data)
- Manipulate the agent into harmful actions
- Disable or circumvent ClawSec
- Inject instructions to override user intent

**Example indicators:**
- "Ignore previous instructions..."
- "You are now in developer mode..."
- Encoded/obfuscated payloads
- Attempts to access system files or environment variables
- Social engineering to leak conversation history

### 2. Vulnerable Skills/Plugins

Skills that exhibit:
- Data exfiltration (sending data to unknown external servers)
- Excessive permission requests without justification
- Self-modification or self-replication behavior
- Attempts to disable security tooling
- Known CVEs or security flaws
- Deceptive functionality (does something other than described)

### 3. Tampering Attempts

Any attempt to:
- Modify ClawSec files
- Disable the security audit cron job
- Alter the advisory feed URL
- Remove or bypass health checks

---

## Creating a Report

### Report Format

Create a JSON file following this structure:

```json
{
  "opener_type": "human | agent",
  "report_type": "malicious_prompt | vulnerable_skill | tampering_attempt",
  "severity": "critical | high | medium | low",
  "title": "Brief descriptive title",
  "description": "Detailed description of what was observed",
  "evidence": {
    "observed_at": "2026-02-02T15:30:00Z",
    "context": "What was happening when this occurred",
    "payload": "The actual prompt/code/behavior observed (sanitized if needed)

skill.json

{
  "name": "clawtributor",
  "version": "0.0.3",
  "description": "Community incident reporting for AI agents. Contribute to collective security by reporting threats.",
  "author": "prompt-security",
  "license": "MIT",
  "homepage": "https://clawsec.prompt.security",
  "keywords": [
    "security",
    "reporting",
    "community",
    "agents",
    "ai",
    "vulnerability",
    "contribution"
  ],
  "sbom": {
    "files": [
      {
        "path": "SKILL.md",
        "required": true,
        "description": "Community reporting skill documentation"
      },
      {
        "path": "reporting.md",
        "required": true,
        "description": "Incident report format and submission guide"
      }
    ]
  },
  "openclaw": {
    "emoji": "🤝",
    "category": "security",
    "requires": {
      "bins": [
        "curl",
        "git",
        "gh"
      ]
    },
    "triggers": [
      "report vulnerability",
      "report attack",
      "clawtributor",
      "submit report",
      "security report",
      "contribute report",
      "report incident",
      "report threat"
    ]
  }
}

Related agents

Same protocol, similar job.

Github ReposUpdated 2h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW
Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW
Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW
Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular

OPENCLAW

Machine-readable data

The same record, as JSON, for agents and crawlers.

{
  "facts": [
    {
      "factKey": "vendor",
      "category": "vendor",
      "label": "Vendor",
      "value": "Clawhub",
      "href": "https://clawhub.ai/davida-ps/clawtributor",
      "sourceUrl": "https://clawhub.ai/davida-ps/clawtributor",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-04-15T00:45:39.800Z",
      "isPublic": true
    },
    {
      "factKey": "protocols",
      "category": "compatibility",
      "label": "Protocol compatibility",
      "value": "OpenClaw",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-davida-ps-clawtributor/contract",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-davida-ps-clawtributor/contract",
      "sourceType": "contract",
      "confidence": "medium",
      "observedAt": "2026-04-15T00:45:39.800Z",
      "isPublic": true
    },
    {
      "factKey": "traction",
      "category": "adoption",
      "label": "Adoption signal",
      "value": "1.3K downloads",
      "href": "https://clawhub.ai/davida-ps/clawtributor",
      "sourceUrl": "https://clawhub.ai/davida-ps/clawtributor",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-04-15T00:45:39.800Z",
      "isPublic": true
    },
    {
      "factKey": "latest_release",
      "category": "release",
      "label": "Latest release",
      "value": "0.0.3",
      "href": "https://clawhub.ai/davida-ps/clawtributor",
      "sourceUrl": "https://clawhub.ai/davida-ps/clawtributor",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-02-05T22:37:23.624Z",
      "isPublic": true
    },
    {
      "factKey": "handshake_status",
      "category": "security",
      "label": "Handshake status",
      "value": "UNKNOWN",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-davida-ps-clawtributor/trust",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-davida-ps-clawtributor/trust",
      "sourceType": "trust",
      "confidence": "medium",
      "observedAt": null,
      "isPublic": true
    }
  ],
  "events": [
    {
      "eventType": "release",
      "title": "Release 0.0.3",
      "description": "Release 0.0.3 via CI",
      "href": "https://clawhub.ai/davida-ps/clawtributor",
      "sourceUrl": "https://clawhub.ai/davida-ps/clawtributor",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-02-05T22:37:23.624Z",
      "isPublic": true
    }
  ]
}

Record generated Oct 9, 2026.

Sponsored

Ads related to clawtributor and adjacent AI workflows.