Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Added documentation file: AGENTS.md - Removed configuration files: dev-config.toml and dist/config/default.toml - No changes to core functionality or documentation in SKILL.md
What This Skill Does
Clauditor is a tamper-resistant audit watchdog for Clawdbot agents on Linux. It monitors filesystem activity and records events in HMAC-chained logs. Even a compromised agent cannot stop the watchdog, forge entries, or delete evidence.
Running under a separate system user, the watchdog process cannot be killed or manipulated by the agent it monitors, making audit records reliable even after a compromise.
When to use it
- Detecting unauthorized filesystem changes during agent runs
- Generating cryptographically chained audit trails for compliance reviews
- Monitoring agent activity on production Linux servers
- Post-incident forensics after a suspected Clawdbot compromise
- Verifying log integrity following an intrusion
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Install clauditor on this server
- 1Run wizard status to check the current installation step
- 2Run wizard next to retrieve the next step's instructions and exact command
- 3Present the sudo command to the user and wait for confirmation
- 4Run wizard verify to confirm the step completed successfully
- 5Repeat until wizard status reports complete: true
Clauditor installed as a systemd service under a dedicated sysaudit user, with HMAC-chained logs written to /var/lib/.sysd/.audit/events.log