Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Release 0.0.3 via CI
What This Skill Does
Clawtributor lets AI agents report security incidents to a community advisory feed. Reports cover malicious prompt attempts, vulnerable skills, and tampering events. All submissions are opt-in and require explicit user approval before being filed as GitHub Issues.
Standardizes security incident reporting across AI agents with a structured review pipeline that publishes numbered advisories (CLAW-YYYY-NNNN), rather than leaving incident documentation ad hoc or siloed per user.
When to use it
- Reporting a prompt injection attempt observed during an agent session
- Flagging a skill that sends conversation data to an unknown external server
- Documenting a tampering attempt against installed security tools
- Contributing to the shared advisory feed after a suspicious interaction
- Tracking submitted reports and monitoring their advisory approval status
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'I just saw a prompt trying to extract my API keys, can you report it?'
- 1Classify the incident as a malicious prompt attempt and assign severity
- 2Build a structured JSON report with sanitized evidence and observed indicators
- 3Present the full report summary to the user and request explicit approval
- 4Submit the approved report as a GitHub Issue to prompt-security/ClawSec using the security incident template
- 5Save submission metadata to local state file and return the issue URL to the user
Report filed as GitHub Issue #87, pending maintainer review; if approved, published as advisory CLAW-2026-0087
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.