• This page appears under the Start Here section in INDEX.md.
• ClawSec sits between upstream intelligence sources (NVD + community issues), GitHub automation, and runtime agent environments.
• The repository publishes both static site content and signed artifacts that runtime skills verify before using.
• External actor groups:
  • GitHub Actions runners executing CI, release, and feed workflows.
  • OpenClaw/NanoClaw agents consuming skills, advisories, and verification scripts.
  • Repository maintainers approving advisory issues and merging release/tag changes.

• Skill catalog flow:
  1. Release/tag workflows publish skill assets.
  2. Deploy workflow discovers release assets and builds public/skills/index.json.
  3. UI fetches public/skills/index.json and skill docs for /skills pages.
• Advisory feed flow:
  1. poll-nvd-cves.yml and community-advisory.yml update advisories/feed.json.
  2. Feed is signed and mirrored to public paths.
  3. Runtime hooks/scripts load remote feed and fallback to local signed copies.
• Guarded install flow:
  1. Installer requests target skill + version.
  2. Advisory matcher checks affected specifiers and severity/risk hints.
  3. Exit code 42 enforces second confirmation when advisories match.

flowchart TD
 A["NVD + Community Inputs"] --> B["Feed Workflows\n(poll/community)"]
 B --> C["advisories/feed.json + signatures"]
 C --> D["Deploy Workflow Mirrors to public/"]
 D --> E["React UI (catalog/feed pages)"]
 C --> F["clawsec-suite hook + installers"]
 F --> G["Agent advisory alerts / gated install"]

Prompt Line Motif

• Feed fetching is fail-closed for invalid signatures and malformed manifests.
• Remote fetch failures gracefully fall back to local signed feeds.
• Hook state uses atomic file writes with strict mode where supported.
• UI pages detect HTML fallbacks served as JSON and avoid rendering corrupted data.
• Workflow steps enforce key-fingerprint consistency to avoid split-key drift.

// Route topology in the web app
<Routes>
 <Route path="/" element={<Home />} />
 <Route path="/skills" element={<SkillsCatalog />} />
 <Route path="/skills/:skillId" element={<SkillDetail />} />
 <Route path="/feed" element={<FeedSetup />} />
 <Route path="/feed/:advisoryId" element={<AdvisoryDetail />} />
 <Route path="/wiki/*" element={<WikiBrowser />} />
</Routes>

// Guarded feed loading contract in advisory hook
const remoteFeed = await loadRemoteFeed(feedUrl, {
 signatureUrl: feedSignatureUrl,
 checksumsUrl: feedChecksumsUrl,
 checksumsSignatureUrl: feedChecksumsSignatureUrl,
 publicKeyPem,
 checksumsPublicKeyPem: publicKeyPem,
 allowUnsigned,
 verifyChecksumManifest,
});

• Advisory volume scales with keyword set in NVD polling; dedupe and post-filtering control noise.
• Deploy workflow processes release lists and keeps newest skill versions in index output.
• Module boundaries by skill folder allow adding new security capabilities without changing frontend structure.
• Signature verification paths remain lightweight because payload sizes (feed/manifests) are small.

• App.tsx
• pages/SkillsCatalog.tsx
• pages/FeedSetup.tsx
• pages/AdvisoryDetail.tsx
• pages/WikiBrowser.tsx
• skills/clawsec-suite/hooks/clawsec-advisory-guardian/handler.ts
• skills/clawsec-suite/hooks/clawsec-advisory-guardian/lib/feed.mjs
• skills/clawsec-suite/scripts/guarded_skill_install.mjs
• skills/clawsec-suite/scripts/discover_skill_catalog.mjs
• skills/clawsec-nanoclaw/lib/advisories.ts
• skills/clawsec-nanoclaw/lib/signatures.ts
• .github/workflows/poll-nvd-cves.yml
• .github/workflows/community-advisory.yml
• .github/workflows/deploy-pages.yml
• .github/workflows/skill-release.yml