Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Restructuring.
What This Skill Does
1-SEC is an open-source cybersecurity platform that runs as a single binary with 16 detection modules covering network defense, intrusion detection, LLM firewall, ransomware interception, and AI agent containment. It defaults to dry-run mode with no live enforcement until explicitly enabled. All detection runs on-host with no required API keys or external connections.
One binary replaces a stack of separate tools for IDS, WAF, FIM, and brute force protection without requiring configuration or API keys to start.
When to use it
- Harden a new Linux VPS before deploying an AI agent
- Set up brute force and port scan detection on a production server
- Monitor a server for ransomware or file tampering activity
- Block prompt injection attempts on an LLM-serving host
- Receive Slack or Discord alerts when suspicious activity is detected
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: secure my VPS that runs an AI agent
- 1Download 1-SEC binary and checksums.txt from GitHub Releases for the target architecture
- 2Verify SHA256 checksum against checksums.txt before executing anything as root
- 3Install binary to /usr/local/bin/1sec and run 1sec setup --non-interactive
- 4Apply vps-agent preset in dry-run mode and start the engine with 1sec up
- 5Monitor alerts with 1sec alerts for 24-48 hours, then disable dry-run with 1sec enforce dry-run off
1-SEC running with vps-agent preset, all 16 modules active, enforcement live after dry-run validation
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.