[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ERN5TAAAJ7FE9N86SX6M2M":3,"skill-same:01M6ERN5TAAAJ7FE9N86SX6M2M":254},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":6,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6ERN5TAAAJ7FE9N86SX6M2M","lesson-screen",null,"Opens a lesson screen in the browser next to the terminal while a course tutor teaches. It shows the lesson's registered figures, code traces with real values, and clickable predictions. It also builds a figure for the lesson on the fly with the course figure skills and any figure skill the host has installed: a blueprint, a mechanism, an isometric machine, or a 3D model. Clicks return to the tutor as events. Trigger phrases: \"open the lesson screen\", \"show me this visually\", \"show this in 3D\", \"draw the architecture\", \"visualize this lesson\", \"build a figure for this lesson\", \"lesson screen\".","rohitg00\u002Fai-engineering-from-scratch","rohitg00","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F48523873?v=4","01M6ERFX7W55NRHW3AV85T2MM8","Rohit Ghumare","01M6ERFXCHT482XQFVY40TM2FN",78316,"MIT","https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000039","教师与教育","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"lesson screen","screen","lesson","show","figures","predictions","events","host","next","me","terminal","Blueprint","model","show me","open","fly","3D","browser","code","architecture","2026-11-10 10:12:30",false,"---\nname: clawsec-suite\nversion: 0.1.3\ndescription: ClawSec suite manager with embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup for additional security skills.\nhomepage: https:\u002F\u002Fclawsec.prompt.security\nclawdis:\n  emoji: \"?\"\n  requires:\n    bins: [curl, jq, shasum, openssl]\n---\n\n# ClawSec Suite\n\nThis means `clawsec-suite` can:\n- monitor the ClawSec advisory feed,\n- track which advisories are new since last check,\n- cross-reference advisories against locally installed skills,\n- recommend removal for malicious-skill advisories and require explicit user approval first,\n- and still act as the setup\u002Fmanagement entrypoint for other ClawSec protections.\n\n## Included vs Optional Protections\n\n### Built into clawsec-suite\n- Embedded feed seed file: `advisories\u002Ffeed.json`\n- Portable heartbeat workflow in `HEARTBEAT.md`\n- Advisory polling + state tracking + affected-skill checks\n- OpenClaw advisory guardian hook package: `hooks\u002Fclawsec-advisory-guardian\u002F`\n- Setup scripts for hook and optional cron scheduling: `scripts\u002F`\n- Guarded installer: `scripts\u002Fguarded_skill_install.mjs`\n- Dynamic catalog discovery for installable skills: `scripts\u002Fdiscover_skill_catalog.mjs`\n\n### Installed separately (dynamic catalog)\n`clawsec-suite` does not hard-code add-on skill names in this document.\n\nDiscover the current catalog from the authoritative index (`https:\u002F\u002Fclawsec.prompt.security\u002Fskills\u002Findex.json`) at runtime:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fdiscover_skill_catalog.mjs\"\n```\n\nFallback behavior:\n- If the remote catalog index is reachable and valid, the suite uses it.\n- If the remote index is unavailable or malformed, the script falls back to suite-local catalog metadata in `skill.json`.\n\n## Installation\n\n### Cross-shell path note\n\n- In `bash`\u002F`zsh`, keep path variables expandable (for example, `INSTALL_ROOT=\"$HOME\u002F.openclaw\u002Fskills\"`).\n- Do not single-quote home-variable paths (avoid `'$HOME\u002F.openclaw\u002Fskills'`).\n- In PowerShell, set an explicit path:\n  - `$env:INSTALL_ROOT = Join-Path $HOME \".openclaw\\\\skills\"`\n- If a path is passed with unresolved tokens (like `\\$HOME\u002F...`), suite scripts now fail fast with a clear error.\n\n### Option A: Via clawhub (recommended)\n\n```bash\nnpx clawhub@latest install clawsec-suite\n```\n\n### Option B: Manual download with signature + checksum verification\n\n```bash\nset -euo pipefail\n\nVERSION=\"${SKILL_VERSION:?Set SKILL_VERSION (e.g. 0.0.8)}\"\nINSTALL_ROOT=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\"\nDEST=\"$INSTALL_ROOT\u002Fclawsec-suite\"\nBASE=\"https:\u002F\u002Fgithub.com\u002Fprompt-security\u002Fclawsec\u002Freleases\u002Fdownload\u002Fclawsec-suite-v${VERSION}\"\n\nTEMP_DIR=\"$(mktemp -d)\"\ntrap 'rm -rf \"$TEMP_DIR\"' EXIT\n\n# Pinned release-signing public key (verify fingerprint out-of-band on first use)\n# Fingerprint (SHA-256 of SPKI DER): 711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8\nRELEASE_PUBKEY_SHA256=\"711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8\"\ncat > \"$TEMP_DIR\u002Frelease-signing-public.pem\" \u003C\u003C'PEM'\n-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAS7nijfMcUoOBCj4yOXJX+GYGv2pFl2Yaha1P4v5Cm6A=\n-----END PUBLIC KEY-----\nPEM\n\nACTUAL_KEY_SHA256=\"$(openssl pkey -pubin -in \"$TEMP_DIR\u002Frelease-signing-public.pem\" -outform DER | shasum -a 256 | awk '{print $1}')\"\nif [ \"$ACTUAL_KEY_SHA256\" != \"$RELEASE_PUBKEY_SHA256\" ]; then\n  echo \"ERROR: Release public key fingerprint mismatch\" >&2\n  exit 1\nfi\n\nZIP_NAME=\"clawsec-suite-v${VERSION}.zip\"\n\n# 1) Download release archive + signed checksums manifest + signing public key\ncurl -fsSL \"$BASE\u002F$ZIP_NAME\" -o \"$TEMP_DIR\u002F$ZIP_NAME\"\ncurl -fsSL \"$BASE\u002Fchecksums.json\" -o \"$TEMP_DIR\u002Fchecksums.json\"\ncurl -fsSL \"$BASE\u002Fchecksums.sig\" -o \"$TEMP_DIR\u002Fchecksums.sig\"\n\n# 2) Verify checksums manifest signature before trusting any hashes\nopenssl base64 -d -A -in \"$TEMP_DIR\u002Fchecksums.sig\" -out \"$TEMP_DIR\u002Fchecksums.sig.bin\"\nif ! openssl pkeyutl -verify \\\n  -pubin \\\n  -inkey \"$TEMP_DIR\u002Frelease-signing-public.pem\" \\\n  -sigfile \"$TEMP_DIR\u002Fchecksums.sig.bin\" \\\n  -rawin \\\n  -in \"$TEMP_DIR\u002Fchecksums.json\" >\u002Fdev\u002Fnull 2>&1; then\n  echo \"ERROR: checksums.json signature verification failed\" >&2\n  exit 1\nfi\n\nEXPECTED_ZIP_SHA=\"$(jq -r '.archive.sha256 \u002F\u002F empty' \"$TEMP_DIR\u002Fchecksums.json\")\"\nif [ -z \"$EXPECTED_ZIP_SHA\" ]; then\n  echo \"ERROR: checksums.json missing archive.sha256\" >&2\n  exit 1\nfi\n\nif command -v shasum >\u002Fdev\u002Fnull 2>&1; then\n  ACTUAL_ZIP_SHA=\"$(shasum -a 256 \"$TEMP_DIR\u002F$ZIP_NAME\" | awk '{print $1}')\"\nelse\n  ACTUAL_ZIP_SHA=\"$(sha256sum \"$TEMP_DIR\u002F$ZIP_NAME\" | awk '{print $1}')\"\nfi\n\nif [ \"$EXPECTED_ZIP_SHA\" != \"$ACTUAL_ZIP_SHA\" ]; then\n  echo \"ERROR: Archive checksum mismatch for $ZIP_NAME\" >&2\n  exit 1\nfi\n\necho \"Checksums manifest signature and archive hash verified.\"\n\n# 3) Install verified archive\nmkdir -p \"$INSTALL_ROOT\"\nrm -rf \"$DEST\"\nunzip -q \"$TEMP_DIR\u002F$ZIP_NAME\" -d \"$INSTALL_ROOT\"\n\nchmod 600 \"$DEST\u002Fskill.json\"\nfind \"$DEST\" -type f ! -name \"skill.json\" -exec chmod 644 {} \\;\n\necho \"Installed clawsec-suite v${VERSION} to: $DEST\"\necho \"Next step (OpenClaw): node \\\"\\$DEST\u002Fscripts\u002Fsetup_advisory_hook.mjs\\\"\"\n```\n\n## OpenClaw Automation (Hook + Optional Cron)\n\nAfter installing the suite, enable the advisory guardian hook:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fsetup_advisory_hook.mjs\"\n```\n\nOptional: create\u002Fupdate a periodic cron nudge (default every `6h`) that triggers a main-session advisory scan:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fsetup_advisory_cron.mjs\"\n```\n\nWhat this adds:\n- scan on `agent:bootstrap` and `\u002Fnew` (`command:new`),\n- compare advisory `affected` entries against installed skills,\n- consider advisories with `application: \"openclaw\"` (and legacy entries without `application` for backward compatibility),\n- notify when new matches appear,\n- and ask for explicit user approval before any removal flow.\n\nRestart the OpenClaw gateway after enabling the hook. Then run `\u002Fnew` once to force an immediate scan in the next session context.\n\n## Guarded Skill Install Flow (Double Confirmation)\n\nWhen the user asks to install a skill, treat that as the first request and run a guarded install check:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fguarded_skill_install.mjs\" --skill helper-plus --version 1.0.1\n```\n\nBehavior:\n- If no advisory match is found, install proceeds.\n- If `--version` is omitted, matching is conservative: any advisory that references the skill name is treated as a match.\n- If advisory match is found, the script prints advisory context and exits with code `42`.\n- Then require an explicit second confirmation from the user and rerun with `--confirm-advisory`:\n\n```bash\nnode \"$SUITE_DIR\u002Fscripts\u002Fguarded_skill_install.mjs\" --skill helper-plus --version 1.0.1 --confirm-advisory\n```\n\nThis enforces:\n1. First confirmation: user asked to install.\n2. Second confirmation: user explicitly approves install after seeing advisory details.\n\n## Embedded Advisory Feed Behavior\n\nThe embedded feed logic uses these defaults:\n\n- Remote feed URL: `https:\u002F\u002Fclawsec.prompt.security\u002Fadvisories\u002Ffeed.json`\n- Remote feed signature URL: `${CLAWSEC_FEED_URL}.sig` (override with `CLAWSEC_FEED_SIG_URL`)\n- Remote checksums manifest URL: sibling `checksums.json` (override with `CLAWSEC_FEED_CHECKSUMS_URL`)\n- Local seed fallback: `~\u002F.openclaw\u002Fskills\u002Fclawsec-suite\u002Fadvisories\u002Ffeed.json`\n- Local feed signature: `${CLAWSEC_LOCAL_FEED}.sig` (override with `CLAWSEC_LOCAL_FEED_SIG`)\n- Local checksums manifest: `~\u002F.openclaw\u002Fskills\u002Fclawsec-suite\u002Fadvisories\u002Fchecksums.json`\n- Pinned feed signing key: `~\u002F.openclaw\u002Fskills\u002Fclawsec-suite\u002Fadvisories\u002Ffeed-signing-public.pem` (override with `CLAWSEC_FEED_PUBLIC_KEY`)\n- State file: `~\u002F.openclaw\u002Fclawsec-suite-feed-state.json`\n- Hook rate-limit env (OpenClaw hook): `CLAWSEC_HOOK_INTERVAL_SECONDS` (default `300`)\n\n**Fail-closed verification:** Feed signatures are required by default. Checksum manifests are verified when companion checksum artifacts are available. Set `CLAWSEC_ALLOW_UNSIGNED_FEED=1` only as a temporary migration bypass when adopting this version before signed feed artifacts are available upstream.\n\n### Quick feed check\n\n```bash\nFEED_URL=\"${CLAWSEC_FEED_URL:-https:\u002F\u002Fclawsec.prompt.security\u002Fadvisories\u002Ffeed.json}\"\nSTATE_FILE=\"${CLAWSEC_SUITE_STATE_FILE:-$HOME\u002F.openclaw\u002Fclawsec-suite-feed-state.json}\"\n\nTMP=\"$(mktemp -d)\"\ntrap 'rm -rf \"$TMP\"' EXIT\n\nif ! curl -fsSLo \"$TMP\u002Ffeed.json\" \"$FEED_URL\"; then\n  echo \"ERROR: Failed to fetch advisory feed\"\n  exit 1\nfi\n\nif ! jq -e '.version and (.advisories | type == \"array\")' \"$TMP\u002Ffeed.json\" >\u002Fdev\u002Fnull; then\n  echo \"ERROR: Invalid advisory feed format\"\n  exit 1\nfi\n\nmkdir -p \"$(dirname \"$STATE_FILE\")\"\nif [ ! -f \"$STATE_FILE\" ]; then\n  echo '{\"schema_version\":\"1.0\",\"known_advisories\":[],\"last_feed_check\":null,\"last_feed_updated\":null}' > \"$STATE_FILE\"\n  chmod 600 \"$STATE_FILE\"\nfi\n\nNEW_IDS_FILE=\"$TMP\u002Fnew_ids.txt\"\njq -r --argfile state \"$STATE_FILE\" '($state.known_advisories \u002F\u002F []) as $known | [.advisories[]?.id | select(. != null and ($known | index(.) | not))] | .[]?' \"$TMP\u002Ffeed.json\" > \"$NEW_IDS_FILE\"\n\nif [ -s \"$NEW_IDS_FILE\" ]; then\n  echo \"New advisories detected:\"\n  while IFS= read -r id; do\n    [ -z \"$id\" ] && continue\n    jq -r --arg id \"$id\" '.advisories[] | select(.id == $id) | \"- [\\(.severity | ascii_upcase)] \\(.id): \\(.title)\"' \"$TMP\u002Ffeed.json\"\n  done \u003C \"$NEW_IDS_FILE\"\nelse\n  echo \"FEED_OK - no new advisories\"\nfi\n```\n\n## Heartbeat Integration\n\nUse the suite heartbeat script as the single periodic security check entrypoint:\n\n- `skills\u002Fclawsec-suite\u002FHEARTBEAT.md`\n\nIt handles:\n- suite update checks,\n- feed polling,\n- new-advisory detection,\n- affected-skill cross-referencing,\n- approval-gated response guidance for malicious\u002Fremoval advisories,\n- and persistent state updates.\n\n## Approval-Gated Response Contract\n\nIf an advisory indicates a malicious or removal-recommended skill and that skill is installed:\n\n1. Notify the user immediately with advisory details and severity.\n2. Recommend removing or disabling the affected skill.\n3. Treat the original install request as first intent only.\n4. Ask for explicit second confirmation before deletion\u002Fdisable action (or before proceeding with risky install).\n5. Only proceed after that second confirmation.\n\nThe suite hook and heartbeat guidance are intentionally non-destructive by default.\n\n## Advisory Suppression \u002F Allowlist\n\nThe advisory guardian pipeline supports opt-in suppression for advisories that have been reviewed and accepted by your security team. This is useful for first-party tooling or advisories that do not apply to your deployment.\n\n### Activation\n\nAdvisory suppression requires a single gate: the configuration file must contain `\"enabledFor\"` with `\"advisory\"` in the array. No CLI flag is needed -- the sentinel in the config file IS the opt-in gate.\n\nIf the `enabledFor` array is missing, empty, or does not include `\"advisory\"`, all advisories are reported normally.\n\n### Config File Resolution (4-tier)\n\nThe advisory guardian resolves the suppression config using the same priority order as the audit pipeline:\n\n1. Explicit `--config \u003Cpath>` argument\n2. `OPENCLAW_AUDIT_CONFIG` environment variable\n3. `~\u002F.openclaw\u002Fsecurity-audit.json`\n4. `.clawsec\u002Fallowlist.json`\n\n### Config Format\n\n```json\n{\n  \"enabledFor\": [\"advisory\"],\n  \"suppressions\": [\n    {\n      \"checkId\": \"CVE-2026-25593\",\n      \"skill\": \"clawsec-suite\",\n      \"reason\": \"First-party security tooling — reviewed by security team\",\n      \"suppressedAt\": \"2026-02-15\"\n    },\n    {\n      \"checkId\": \"CLAW-2026-0001\",\n      \"skill\": \"example-skill\",\n      \"reason\": \"Advisory does not apply to our deployment configuration\",\n      \"suppressedAt\": \"2026-02-16\"\n    }\n  ]\n}\n```\n\n### Sentinel Semantics\n\n- `\"enabledFor\": [\"advisory\"]` -- only advisory suppression active\n- `\"enabledFor\": [\"audit\"]` -- only audit suppression active (no effect on advisory pipeline)\n- `\"enabledFor\": [\"audit\", \"advisory\"]` -- both pipelines honor suppressions\n- Missing or empty `enabledFor` -- no suppression active (safe default)\n\n### Matching Rules\n\n- **checkId:** exact match against the advisory ID (e.g., `CVE-2026-25593` or `CLAW-2026-0001`)\n- **skill:** case-insensitive match against the affected skill name from the advisory\n- Both fields must match for an advisory to be suppressed\n\n### Required Fields per Suppression Entry\n\n| Field | Description | Example |\n|-------|-------------|---------|\n| `checkId` | Advisory ID to suppress | `CVE-2026-25593` |\n| `skill` | Affected skill name | `clawsec-suite` |\n| `reason` | Justification for audit trail (required) | `First-party tooling, reviewed by security team` |\n| `suppressedAt` | ISO 8601 date (YYYY-MM-DD) | `2026-02-15` |\n\n### Shared Config with Audit Pipeline\n\nThe advisory and audit pipelines share the same config file. Use the `enabledFor` array to control which pipelines honor the suppression list:\n\n```json\n{\n  \"enabledFor\": [\"audit\", \"advisory\"],\n  \"suppressions\": [\n    {\n      \"checkId\": \"skills.code_safety\",\n      \"skill\": \"clawsec-suite\",\n      \"reason\": \"First-party tooling — audit finding accepted\",\n      \"suppressedAt\": \"2026-02-15\"\n    },\n    {\n      \"checkId\": \"CVE-2026-25593\",\n      \"skill\": \"clawsec-suite\",\n      \"reason\": \"First-party tooling — advisory reviewed\",\n      \"suppressedAt\": \"2026-02-15\"\n    }\n  ]\n}\n```\n\nAudit entries (with check identifiers like `skills.code_safety`) are only matched by the audit pipeline. Advisory entries (with advisory IDs like `CVE-2026-25593` or `CLAW-2026-0001`) are only matched by the advisory pipeline. Each pipeline filters for its own relevant entries.\n\n## Optional Skill Installation\n\nDiscover currently available installable skills dynamically, then install the ones you want:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fdiscover_skill_catalog.mjs\"\n\n# then install any discovered skill by name\nnpx clawhub@latest install \u003Cskill-name>\n```\n\nMachine-readable output is also available for automation:\n\n```bash\nnode \"$SUITE_DIR\u002Fscripts\u002Fdiscover_skill_catalog.mjs\" --json\n```\n\n## Security Notes\n\n- Always verify `checksums.json` signature before trusting its file URLs\u002Fhashes, then verify each file checksum.\n- Verify advisory feed detached signatures; do not enable `CLAWSEC_ALLOW_UNSIGNED_FEED` outside temporary migration windows.\n- Keep advisory polling rate-limited (at least 5 minutes between checks).\n- Treat `critical` and `high` advisories affecting installed skills as immediate action items.\n- If you migrate off standalone `clawsec-feed`, keep one canonical state file to avoid duplicate notifications.\n- Pin and verify public key fingerprints out-of-band before first use.\n","# ClawSec Suite\n\nThis means `clawsec-suite` can:\n- monitor the ClawSec advisory feed,\n- track which advisories are new since last check,\n- cross-reference advisories against locally installed skills,\n- recommend removal for malicious-skill advisories and require explicit user approval first,\n- and still act as the setup\u002Fmanagement entrypoint for other ClawSec protections.\n\n## Included vs Optional Protections\n\n### Built into clawsec-suite\n- Embedded feed seed file: `advisories\u002Ffeed.json`\n- Portable heartbeat workflow in `HEARTBEAT.md`\n- Advisory polling + state tracking + affected-skill checks\n- OpenClaw advisory guardian hook package: `hooks\u002Fclawsec-advisory-guardian\u002F`\n- Setup scripts for hook and optional cron scheduling: `scripts\u002F`\n- Guarded installer: `scripts\u002Fguarded_skill_install.mjs`\n- Dynamic catalog discovery for installable skills: `scripts\u002Fdiscover_skill_catalog.mjs`\n\n### Installed separately (dynamic catalog)\n`clawsec-suite` does not hard-code add-on skill names in this document.\n\nDiscover the current catalog from the authoritative index (`https:\u002F\u002Fclawsec.prompt.security\u002Fskills\u002Findex.json`) at runtime:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fdiscover_skill_catalog.mjs\"\n```\n\nFallback behavior:\n- If the remote catalog index is reachable and valid, the suite uses it.\n- If the remote index is unavailable or malformed, the script falls back to suite-local catalog metadata in `skill.json`.\n\n## Installation\n\n### Cross-shell path note\n\n- In `bash`\u002F`zsh`, keep path variables expandable (for example, `INSTALL_ROOT=\"$HOME\u002F.openclaw\u002Fskills\"`).\n- Do not single-quote home-variable paths (avoid `'$HOME\u002F.openclaw\u002Fskills'`).\n- In PowerShell, set an explicit path:\n  - `$env:INSTALL_ROOT = Join-Path $HOME \".openclaw\\\\skills\"`\n- If a path is passed with unresolved tokens (like `\\$HOME\u002F...`), suite scripts now fail fast with a clear error.\n\n### Option A: Via clawhub (recommended)\n\n```bash\nnpx clawhub@latest install clawsec-suite\n```\n\n### Option B: Manual download with signature + checksum verification\n\n```bash\nset -euo pipefail\n\nVERSION=\"${SKILL_VERSION:?Set SKILL_VERSION (e.g. 0.0.8)}\"\nINSTALL_ROOT=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\"\nDEST=\"$INSTALL_ROOT\u002Fclawsec-suite\"\nBASE=\"https:\u002F\u002Fgithub.com\u002Fprompt-security\u002Fclawsec\u002Freleases\u002Fdownload\u002Fclawsec-suite-v${VERSION}\"\n\nTEMP_DIR=\"$(mktemp -d)\"\ntrap 'rm -rf \"$TEMP_DIR\"' EXIT\n\n# Pinned release-signing public key (verify fingerprint out-of-band on first use)\n# Fingerprint (SHA-256 of SPKI DER): 711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8\nRELEASE_PUBKEY_SHA256=\"711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8\"\ncat > \"$TEMP_DIR\u002Frelease-signing-public.pem\" \u003C\u003C'PEM'\n-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAS7nijfMcUoOBCj4yOXJX+GYGv2pFl2Yaha1P4v5Cm6A=\n-----END PUBLIC KEY-----\nPEM\n\nACTUAL_KEY_SHA256=\"$(openssl pkey -pubin -in \"$TEMP_DIR\u002Frelease-signing-public.pem\" -outform DER | shasum -a 256 | awk '{print $1}')\"\nif [ \"$ACTUAL_KEY_SHA256\" != \"$RELEASE_PUBKEY_SHA256\" ]; then\n  echo \"ERROR: Release public key fingerprint mismatch\" >&2\n  exit 1\nfi\n\nZIP_NAME=\"clawsec-suite-v${VERSION}.zip\"\n\n# 1) Download release archive + signed checksums manifest + signing public key\ncurl -fsSL \"$BASE\u002F$ZIP_NAME\" -o \"$TEMP_DIR\u002F$ZIP_NAME\"\ncurl -fsSL \"$BASE\u002Fchecksums.json\" -o \"$TEMP_DIR\u002Fchecksums.json\"\ncurl -fsSL \"$BASE\u002Fchecksums.sig\" -o \"$TEMP_DIR\u002Fchecksums.sig\"\n\n# 2) Verify checksums manifest signature before trusting any hashes\nopenssl base64 -d -A -in \"$TEMP_DIR\u002Fchecksums.sig\" -out \"$TEMP_DIR\u002Fchecksums.sig.bin\"\nif ! openssl pkeyutl -verify \\\n  -pubin \\\n  -inkey \"$TEMP_DIR\u002Frelease-signing-public.pem\" \\\n  -sigfile \"$TEMP_DIR\u002Fchecksums.sig.bin\" \\\n  -rawin \\\n  -in \"$TEMP_DIR\u002Fchecksums.json\" >\u002Fdev\u002Fnull 2>&1; then\n  echo \"ERROR: checksums.json signature verification failed\" >&2\n  exit 1\nfi\n\nEXPECTED_ZIP_SHA=\"$(jq -r '.archive.sha256 \u002F\u002F empty' \"$TEMP_DIR\u002Fchecksums.json\")\"\nif [ -z \"$EXPECTED_ZIP_SHA\" ]; then\n  echo \"ERROR: checksums.json missing archive.sha256\" >&2\n  exit 1\nfi\n\nif command -v shasum >\u002Fdev\u002Fnull 2>&1; then\n  ACTUAL_ZIP_SHA=\"$(shasum -a 256 \"$TEMP_DIR\u002F$ZIP_NAME\" | awk '{print $1}')\"\nelse\n  ACTUAL_ZIP_SHA=\"$(sha256sum \"$TEMP_DIR\u002F$ZIP_NAME\" | awk '{print $1}')\"\nfi\n\nif [ \"$EXPECTED_ZIP_SHA\" != \"$ACTUAL_ZIP_SHA\" ]; then\n  echo \"ERROR: Archive checksum mismatch for $ZIP_NAME\" >&2\n  exit 1\nfi\n\necho \"Checksums manifest signature and archive hash verified.\"\n\n# 3) Install verified archive\nmkdir -p \"$INSTALL_ROOT\"\nrm -rf \"$DEST\"\nunzip -q \"$TEMP_DIR\u002F$ZIP_NAME\" -d \"$INSTALL_ROOT\"\n\nchmod 600 \"$DEST\u002Fskill.json\"\nfind \"$DEST\" -type f ! -name \"skill.json\" -exec chmod 644 {} \\;\n\necho \"Installed clawsec-suite v${VERSION} to: $DEST\"\necho \"Next step (OpenClaw): node \\\"\\$DEST\u002Fscripts\u002Fsetup_advisory_hook.mjs\\\"\"\n```\n\n## OpenClaw Automation (Hook + Optional Cron)\n\nAfter installing the suite, enable the advisory guardian hook:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fsetup_advisory_hook.mjs\"\n```\n\nOptional: create\u002Fupdate a periodic cron nudge (default every `6h`) that triggers a main-session advisory scan:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fsetup_advisory_cron.mjs\"\n```\n\nWhat this adds:\n- scan on `agent:bootstrap` and `\u002Fnew` (`command:new`),\n- compare advisory `affected` entries against installed skills,\n- consider advisories with `application: \"openclaw\"` (and legacy entries without `application` for backward compatibility),\n- notify when new matches appear,\n- and ask for explicit user approval before any removal flow.\n\nRestart the OpenClaw gateway after enabling the hook. Then run `\u002Fnew` once to force an immediate scan in the next session context.\n\n## Guarded Skill Install Flow (Double Confirmation)\n\nWhen the user asks to install a skill, treat that as the first request and run a guarded install check:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fguarded_skill_install.mjs\" --skill helper-plus --version 1.0.1\n```\n\nBehavior:\n- If no advisory match is found, install proceeds.\n- If `--version` is omitted, matching is conservative: any advisory that references the skill name is treated as a match.\n- If advisory match is found, the script prints advisory context and exits with code `42`.\n- Then require an explicit second confirmation from the user and rerun with `--confirm-advisory`:\n\n```bash\nnode \"$SUITE_DIR\u002Fscripts\u002Fguarded_skill_install.mjs\" --skill helper-plus --version 1.0.1 --confirm-advisory\n```\n\nThis enforces:\n1. First confirmation: user asked to install.\n2. Second confirmation: user explicitly approves install after seeing advisory details.\n\n## Embedded Advisory Feed Behavior\n\nThe embedded feed logic uses these defaults:\n\n- Remote feed URL: `https:\u002F\u002Fclawsec.prompt.security\u002Fadvisories\u002Ffeed.json`\n- Remote feed signature URL: `${CLAWSEC_FEED_URL}.sig` (override with `CLAWSEC_FEED_SIG_URL`)\n- Remote checksums manifest URL: sibling `checksums.json` (override with `CLAWSEC_FEED_CHECKSUMS_URL`)\n- Local seed fallback: `~\u002F.openclaw\u002Fskills\u002Fclawsec-suite\u002Fadvisories\u002Ffeed.json`\n- Local feed signature: `${CLAWSEC_LOCAL_FEED}.sig` (override with `CLAWSEC_LOCAL_FEED_SIG`)\n- Local checksums manifest: `~\u002F.openclaw\u002Fskills\u002Fclawsec-suite\u002Fadvisories\u002Fchecksums.json`\n- Pinned feed signing key: `~\u002F.openclaw\u002Fskills\u002Fclawsec-suite\u002Fadvisories\u002Ffeed-signing-public.pem` (override with `CLAWSEC_FEED_PUBLIC_KEY`)\n- State file: `~\u002F.openclaw\u002Fclawsec-suite-feed-state.json`\n- Hook rate-limit env (OpenClaw hook): `CLAWSEC_HOOK_INTERVAL_SECONDS` (default `300`)\n\n**Fail-closed verification:** Feed signatures are required by default. Checksum manifests are verified when companion checksum artifacts are available. Set `CLAWSEC_ALLOW_UNSIGNED_FEED=1` only as a temporary migration bypass when adopting this version before signed feed artifacts are available upstream.\n\n### Quick feed check\n\n```bash\nFEED_URL=\"${CLAWSEC_FEED_URL:-https:\u002F\u002Fclawsec.prompt.security\u002Fadvisories\u002Ffeed.json}\"\nSTATE_FILE=\"${CLAWSEC_SUITE_STATE_FILE:-$HOME\u002F.openclaw\u002Fclawsec-suite-feed-state.json}\"\n\nTMP=\"$(mktemp -d)\"\ntrap 'rm -rf \"$TMP\"' EXIT\n\nif ! curl -fsSLo \"$TMP\u002Ffeed.json\" \"$FEED_URL\"; then\n  echo \"ERROR: Failed to fetch advisory feed\"\n  exit 1\nfi\n\nif ! jq -e '.version and (.advisories | type == \"array\")' \"$TMP\u002Ffeed.json\" >\u002Fdev\u002Fnull; then\n  echo \"ERROR: Invalid advisory feed format\"\n  exit 1\nfi\n\nmkdir -p \"$(dirname \"$STATE_FILE\")\"\nif [ ! -f \"$STATE_FILE\" ]; then\n  echo '{\"schema_version\":\"1.0\",\"known_advisories\":[],\"last_feed_check\":null,\"last_feed_updated\":null}' > \"$STATE_FILE\"\n  chmod 600 \"$STATE_FILE\"\nfi\n\nNEW_IDS_FILE=\"$TMP\u002Fnew_ids.txt\"\njq -r --argfile state \"$STATE_FILE\" '($state.known_advisories \u002F\u002F []) as $known | [.advisories[]?.id | select(. != null and ($known | index(.) | not))] | .[]?' \"$TMP\u002Ffeed.json\" > \"$NEW_IDS_FILE\"\n\nif [ -s \"$NEW_IDS_FILE\" ]; then\n  echo \"New advisories detected:\"\n  while IFS= read -r id; do\n    [ -z \"$id\" ] && continue\n    jq -r --arg id \"$id\" '.advisories[] | select(.id == $id) | \"- [\\(.severity | ascii_upcase)] \\(.id): \\(.title)\"' \"$TMP\u002Ffeed.json\"\n  done \u003C \"$NEW_IDS_FILE\"\nelse\n  echo \"FEED_OK - no new advisories\"\nfi\n```\n\n## Heartbeat Integration\n\nUse the suite heartbeat script as the single periodic security check entrypoint:\n\n- `skills\u002Fclawsec-suite\u002FHEARTBEAT.md`\n\nIt handles:\n- suite update checks,\n- feed polling,\n- new-advisory detection,\n- affected-skill cross-referencing,\n- approval-gated response guidance for malicious\u002Fremoval advisories,\n- and persistent state updates.\n\n## Approval-Gated Response Contract\n\nIf an advisory indicates a malicious or removal-recommended skill and that skill is installed:\n\n1. Notify the user immediately with advisory details and severity.\n2. Recommend removing or disabling the affected skill.\n3. Treat the original install request as first intent only.\n4. Ask for explicit second confirmation before deletion\u002Fdisable action (or before proceeding with risky install).\n5. Only proceed after that second confirmation.\n\nThe suite hook and heartbeat guidance are intentionally non-destructive by default.\n\n## Advisory Suppression \u002F Allowlist\n\nThe advisory guardian pipeline supports opt-in suppression for advisories that have been reviewed and accepted by your security team. This is useful for first-party tooling or advisories that do not apply to your deployment.\n\n### Activation\n\nAdvisory suppression requires a single gate: the configuration file must contain `\"enabledFor\"` with `\"advisory\"` in the array. No CLI flag is needed -- the sentinel in the config file IS the opt-in gate.\n\nIf the `enabledFor` array is missing, empty, or does not include `\"advisory\"`, all advisories are reported normally.\n\n### Config File Resolution (4-tier)\n\nThe advisory guardian resolves the suppression config using the same priority order as the audit pipeline:\n\n1. Explicit `--config \u003Cpath>` argument\n2. `OPENCLAW_AUDIT_CONFIG` environment variable\n3. `~\u002F.openclaw\u002Fsecurity-audit.json`\n4. `.clawsec\u002Fallowlist.json`\n\n### Config Format\n\n```json\n{\n  \"enabledFor\": [\"advisory\"],\n  \"suppressions\": [\n    {\n      \"checkId\": \"CVE-2026-25593\",\n      \"skill\": \"clawsec-suite\",\n      \"reason\": \"First-party security tooling — reviewed by security team\",\n      \"suppressedAt\": \"2026-02-15\"\n    },\n    {\n      \"checkId\": \"CLAW-2026-0001\",\n      \"skill\": \"example-skill\",\n      \"reason\": \"Advisory does not apply to our deployment configuration\",\n      \"suppressedAt\": \"2026-02-16\"\n    }\n  ]\n}\n```\n\n### Sentinel Semantics\n\n- `\"enabledFor\": [\"advisory\"]` -- only advisory suppression active\n- `\"enabledFor\": [\"audit\"]` -- only audit suppression active (no effect on advisory pipeline)\n- `\"enabledFor\": [\"audit\", \"advisory\"]` -- both pipelines honor suppressions\n- Missing or empty `enabledFor` -- no suppression active (safe default)\n\n### Matching Rules\n\n- **checkId:** exact match against the advisory ID (e.g., `CVE-2026-25593` or `CLAW-2026-0001`)\n- **skill:** case-insensitive match against the affected skill name from the advisory\n- Both fields must match for an advisory to be suppressed\n\n### Required Fields per Suppression Entry\n\n| Field | Description | Example |\n|-------|-------------|---------|\n| `checkId` | Advisory ID to suppress | `CVE-2026-25593` |\n| `skill` | Affected skill name | `clawsec-suite` |\n| `reason` | Justification for audit trail (required) | `First-party tooling, reviewed by security team` |\n| `suppressedAt` | ISO 8601 date (YYYY-MM-DD) | `2026-02-15` |\n\n### Shared Config with Audit Pipeline\n\nThe advisory and audit pipelines share the same config file. Use the `enabledFor` array to control which pipelines honor the suppression list:\n\n```json\n{\n  \"enabledFor\": [\"audit\", \"advisory\"],\n  \"suppressions\": [\n    {\n      \"checkId\": \"skills.code_safety\",\n      \"skill\": \"clawsec-suite\",\n      \"reason\": \"First-party tooling — audit finding accepted\",\n      \"suppressedAt\": \"2026-02-15\"\n    },\n    {\n      \"checkId\": \"CVE-2026-25593\",\n      \"skill\": \"clawsec-suite\",\n      \"reason\": \"First-party tooling — advisory reviewed\",\n      \"suppressedAt\": \"2026-02-15\"\n    }\n  ]\n}\n```\n\nAudit entries (with check identifiers like `skills.code_safety`) are only matched by the audit pipeline. Advisory entries (with advisory IDs like `CVE-2026-25593` or `CLAW-2026-0001`) are only matched by the advisory pipeline. Each pipeline filters for its own relevant entries.\n\n## Optional Skill Installation\n\nDiscover currently available installable skills dynamically, then install the ones you want:\n\n```bash\nSUITE_DIR=\"${INSTALL_ROOT:-$HOME\u002F.openclaw\u002Fskills}\u002Fclawsec-suite\"\nnode \"$SUITE_DIR\u002Fscripts\u002Fdiscover_skill_catalog.mjs\"\n\n# then install any discovered skill by name\nnpx clawhub@latest install \u003Cskill-name>\n```\n\nMachine-readable output is also available for automation:\n\n```bash\nnode \"$SUITE_DIR\u002Fscripts\u002Fdiscover_skill_catalog.mjs\" --json\n```\n\n## Security Notes\n\n- Always verify `checksums.json` signature before trusting its file URLs\u002Fhashes, then verify each file checksum.\n- Verify advisory feed detached signatures; do not enable `CLAWSEC_ALLOW_UNSIGNED_FEED` outside temporary migration windows.\n- Keep advisory polling rate-limited (at least 5 minutes between checks).\n- Treat `critical` and `high` advisories affecting installed skills as immediate action items.\n- If you migrate off standalone `clawsec-feed`, keep one canonical state file to avoid duplicate notifications.\n- Pin and verify public key fingerprints out-of-band before first use.\n",{"name":49,"clawdis":50,"version":58,"homepage":59,"description":60},"clawsec-suite",{"emoji":51,"requires":52},"?",{"bins":53},[54,55,56,57],"curl","jq","shasum","openssl","0.1.3","https:\u002F\u002Fclawsec.prompt.security","ClawSec suite manager with embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup for additional security skills.","main","1ca81b0a7de199942400f965edd4d7544077ac5d","skills\u002Flesson-screen",13936,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch","https:\u002F\u002Faiengineeringfromscratch.com","https:\u002F\u002Fgithub.com\u002Frohitg00","Engineer | DevRel | GDE | CNCF, AAIF, Claude, Devin, PE Ambassador | Docker Captain | AWS CB | Ex - iii, Cloudera, Solo.io, Cerbos, Oracle, Reliance Jio","2026-11-10 13:24:29",{"source":8,"skillName":49,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add rohitg00\u002Fai-engineering-from-scratch --skill clawsec-suite",{"tool":76,"command":77},"bunx","bunx skills add rohitg00\u002Fai-engineering-from-scratch --skill clawsec-suite",{"tool":79,"command":80},"pnpm","pnpm dlx skills add rohitg00\u002Fai-engineering-from-scratch --skill clawsec-suite","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002FSKILL.md",true,[84,90,94,100,104,108,112,118,122,126,130,134,138,142,146,150,154,158,162,166,170,174,178,182,186,190,194,198,202,206,210,214,218,222,226,230,234,238,242,246,250],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},".clawhubignore","OTHER","其他",147,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002F.clawhubignore",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":92,"sourceHtmlUrl":93},"advisories\u002Ffeed-signing-public.pem",113,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fadvisories\u002Ffeed-signing-public.pem",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"advisories\u002Ffeed.json","REFERENCE","参考文档",6761,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fadvisories\u002Ffeed.json",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"agents\u002Fopenai.yaml",237,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Fagents\u002Fopenai.yaml",{"path":105,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":106,"sourceHtmlUrl":107},"CHANGELOG.md",8193,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002FCHANGELOG.md",{"path":109,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":110,"sourceHtmlUrl":111},"HEARTBEAT.md",6803,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002FHEARTBEAT.md",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"hooks\u002Fclawsec-advisory-guardian\u002Fhandler.ts","SCRIPT","脚本",8809,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Fhandler.ts",{"path":119,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":120,"sourceHtmlUrl":121},"hooks\u002Fclawsec-advisory-guardian\u002FHOOK.md",2072,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002FHOOK.md",{"path":123,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":124,"sourceHtmlUrl":125},"hooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fadvisory_scope.mjs",1197,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fadvisory_scope.mjs",{"path":127,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":128,"sourceHtmlUrl":129},"hooks\u002Fclawsec-advisory-guardian\u002Flib\u002Ffeed.mjs",17545,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Flib\u002Ffeed.mjs",{"path":131,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":132,"sourceHtmlUrl":133},"hooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fmatching.ts",6261,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fmatching.ts",{"path":135,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":136,"sourceHtmlUrl":137},"hooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fstate.ts",2475,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fstate.ts",{"path":139,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":140,"sourceHtmlUrl":141},"hooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fsuppression.mjs",5483,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fsuppression.mjs",{"path":143,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":144,"sourceHtmlUrl":145},"hooks\u002Fclawsec-advisory-guardian\u002Flib\u002Ftypes.ts",871,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Flib\u002Ftypes.ts",{"path":147,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":148,"sourceHtmlUrl":149},"hooks\u002Fclawsec-advisory-guardian\u002Flib\u002Futils.mjs",3656,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Flib\u002Futils.mjs",{"path":151,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":152,"sourceHtmlUrl":153},"hooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fversion.mjs",2972,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fhooks\u002Fclawsec-advisory-guardian\u002Flib\u002Fversion.mjs",{"path":155,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":156,"sourceHtmlUrl":157},"references\u002Fbuild.md",7258,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Freferences\u002Fbuild.md",{"path":159,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":160,"sourceHtmlUrl":161},"references\u002Fhosts.md",2799,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Freferences\u002Fhosts.md",{"path":163,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":164,"sourceHtmlUrl":165},"references\u002Fscreens.md",7044,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Freferences\u002Fscreens.md",{"path":167,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":168,"sourceHtmlUrl":169},"scripts\u002Fdiscover_skill_catalog.mjs",8231,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fscripts\u002Fdiscover_skill_catalog.mjs",{"path":171,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":172,"sourceHtmlUrl":173},"scripts\u002Fgenerate_checksums_json.mjs",2176,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fscripts\u002Fgenerate_checksums_json.mjs",{"path":175,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":176,"sourceHtmlUrl":177},"scripts\u002Fguarded_skill_install.mjs",9855,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fscripts\u002Fguarded_skill_install.mjs",{"path":179,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":180,"sourceHtmlUrl":181},"scripts\u002Flesson-screen.mjs",50509,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Fscripts\u002Flesson-screen.mjs",{"path":183,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":184,"sourceHtmlUrl":185},"scripts\u002Fsetup_advisory_cron.mjs",2993,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fscripts\u002Fsetup_advisory_cron.mjs",{"path":187,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":188,"sourceHtmlUrl":189},"scripts\u002Fsetup_advisory_hook.mjs",2434,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fscripts\u002Fsetup_advisory_hook.mjs",{"path":191,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":192,"sourceHtmlUrl":193},"scripts\u002Fsign_detached_ed25519.mjs",1689,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fscripts\u002Fsign_detached_ed25519.mjs",{"path":195,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":196,"sourceHtmlUrl":197},"scripts\u002Fverify_detached_ed25519.mjs",1847,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fscripts\u002Fverify_detached_ed25519.mjs",{"path":199,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":200,"sourceHtmlUrl":201},"skill.json",7572,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Fskill.json",{"path":203,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":204,"sourceHtmlUrl":205},"templates\u002Fframe.html",11834,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Ftemplates\u002Fframe.html",{"path":207,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":208,"sourceHtmlUrl":209},"templates\u002Fhelper.js",2526,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Ftemplates\u002Fhelper.js",{"path":211,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":212,"sourceHtmlUrl":213},"templates\u002Fpractice.html",38802,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Ftemplates\u002Fpractice.html",{"path":215,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":216,"sourceHtmlUrl":217},"templates\u002Fshell.html",11626,"https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flesson-screen\u002Ftemplates\u002Fshell.html",{"path":219,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":220,"sourceHtmlUrl":221},"test\u002Fadvisory_application_scope.test.mjs",2959,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Fadvisory_application_scope.test.mjs",{"path":223,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":224,"sourceHtmlUrl":225},"test\u002Fadvisory_suppression.test.mjs",13437,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Fadvisory_suppression.test.mjs",{"path":227,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":228,"sourceHtmlUrl":229},"test\u002Ffeed_verification.test.mjs",20208,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Ffeed_verification.test.mjs",{"path":231,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":232,"sourceHtmlUrl":233},"test\u002Ffuzz_properties.js",2004,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Ffuzz_properties.js",{"path":235,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":236,"sourceHtmlUrl":237},"test\u002Ffuzz_properties.test.mjs",493,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Ffuzz_properties.test.mjs",{"path":239,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":240,"sourceHtmlUrl":241},"test\u002Ffuzz_semver_scope_suppression.test.mjs",4420,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Ffuzz_semver_scope_suppression.test.mjs",{"path":243,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":244,"sourceHtmlUrl":245},"test\u002Fguarded_install.test.mjs",14573,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Fguarded_install.test.mjs",{"path":247,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":248,"sourceHtmlUrl":249},"test\u002Fpath_resolution.test.mjs",5321,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Fpath_resolution.test.mjs",{"path":251,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":252,"sourceHtmlUrl":253},"test\u002Fskill_catalog_discovery.test.mjs",7391,"https:\u002F\u002Fgithub.com\u002FCoralShades\u002Facm-ai\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fclawsec-suite\u002Ftest\u002Fskill_catalog_discovery.test.mjs",[255,290,324,349,374,390],{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":261,"publishedAt":44},"01M6ERNQB1QMAD1FH5Z5ASYHXZ","write-manual","Writes a long technical manual that explains one subject at one pinned version, from its purpose to each request and response. Every listing comes from an offline capture, every claim traces to a ranked source, and an audit must report TOTAL 0. Use it for \"write a manual\", \"write a 101 manual for \u003Csubject>\", \"manual.json\", \"add a manual section\", \"build a capture kit\", \"audit the manual\", or \"pin a spec version and document it\".","https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Fwrite-manual\u002FSKILL.md",[],[262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289],"write","write manual","manual","technical-writing","claim","writing","documentation","audit","offline","add","long","technical","use","document","pin","version","build","manuals","specifications","json","report","kit","listing","request","at","source","for","section",{"skillNo":291,"name":292,"nameZh":6,"description":293,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":294,"categories":295,"keywords":305,"publishedAt":44},"01M6ERNKG9FZ3WGJ87B975SHW5","start-learning","One-time onboarding for the AI Engineering from Scratch curriculum (542 lessons, 20 phases). Interviews the learner, runs the placement quiz, and writes LEARNING.md, a persistent study plan the learn skill drives. Trigger phrases: \"start learning\", \"set up the course\", \"begin the curriculum\", \"onboard me\", \"create my learning plan\"","https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Fstart-learning\u002FSKILL.md",[296,301,304],{"categoryNo":297,"categoryName":298,"taxonomyType":299,"taxonomyTypeDesc":300},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":302,"categoryName":303,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000038","人力资源",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[306,307,308,309,310,311,312,313,314,315,316,33,317,318,319,320,321,322,323,288],"start","learning","start learning","SET","ai-engineering","time","up","learn","ai engineering","create","plan","course","learner","curriculum","study","trigger","interviews","my",{"skillNo":325,"name":326,"nameZh":6,"description":327,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":328,"categories":329,"keywords":330,"publishedAt":44},"01M6ERNECV0WVSTXHX8KRF9MBJ","motion-figure","Builds figures that move or respond to the reader, in three tiers: SMIL animations and slider widgets inside lessons, interactive mechanism figures that show the named parts of a real system with a computed verdict, and ordered dither bands in the course palette. Triggers: \"animated figure\", \"add a slider widget\", \"interactive figure\", \"show how this system works\", \"make this diagram move\", \"dither masthead\", \"mechanism figure\", \"figure fence\".","https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Fmotion-figure\u002FSKILL.md",[],[331,332,333,27,334,335,336,337,338,339,271,340,28,317,341,342,343,344,345,346,347,348],"motion","motion figure","Animation","move","respond","palette","diagram","widgets","how","make","SVG","three","system","triggers","interactive","with","animations","lessons",{"skillNo":350,"name":351,"nameZh":6,"description":352,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":353,"categories":354,"keywords":358,"publishedAt":44},"01M6ERNAC0DQ8ER3A99VQBXNNZ","mcpa-certification","AI-native tutor and onboarding workflow for the MCPA (Model Context Protocol Associate) certification in AI Engineering from Scratch. Use when a learner wants to prepare for the MCPA, resume their certification path, learn the next lesson interactively, run and verify practical labs, take the diagnostic or a full mock, or remediate weak exam domains from GitHub with Claude Code, Codex, ChatGPT, Cursor, or another agent.","https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Fmcpa-certification\u002FSKILL.md",[355,356,357],{"categoryNo":297,"categoryName":298,"taxonomyType":299,"taxonomyTypeDesc":300},{"categoryNo":302,"categoryName":303,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[359,360,26,361,36,362,363,313,364,42,365,314,366,32,367,368,369,370,371,372,373],"mcpa certification","certification","practical","domains","exam","workflow","model context protocol","native","run","take","chatgpt","full","context","ai-native","when",{"skillNo":375,"name":313,"nameZh":6,"description":376,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":377,"categories":378,"keywords":382,"publishedAt":44},"01M6ERN1HS8HW1TRJVX5P7SPY0","Interactive lesson tutor for the AI Engineering from Scratch curriculum. Reads LEARNING.md, fetches the next lesson, teaches it section by section in the terminal, quizzes at the end, and records progress. Works cloned or entirely over raw.githubusercontent.com — no setup required. Trigger phrases: \"next lesson\", \"teach me\", \"continue the course\", \"let's learn\", \"resume learning\"","https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flearn\u002FSKILL.md",[379,380,381],{"categoryNo":297,"categoryName":298,"taxonomyType":299,"taxonomyTypeDesc":300},{"categoryNo":302,"categoryName":303,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[313,26,310,383,314,33,384,32,34,317,319,321,385,386,307,345,387,388,286,288,289,389],"end","progress","records","continue","interactive-learning","From Scratch","scratch",{"skillNo":391,"name":392,"nameZh":6,"description":393,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":394,"categories":395,"keywords":397,"publishedAt":44},"01M6ERMX6FFWGB9NPDN8FV4QYG","learn-reverse-engineering","Focused interactive tutor for the Reverse Engineering path in AI Engineering from Scratch. Start or resume this route when a learner wants to read a compiled program: file formats, disassembly, control flow, lifting, evidence, proof, calling conventions, compiler idioms, linking, types, debugging, bytecode, diffing, symbolic execution, and AI-assisted analysis. Teaches one lesson per invocation and records evidence in REVERSE-ENGINEERING-LEARNING.md.","https:\u002F\u002Fgithub.com\u002Frohitg00\u002Fai-engineering-from-scratch\u002Fblob\u002Fmain\u002Fskills\u002Flearn-reverse-engineering\u002FSKILL.md",[396],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[313,398,399,400,401,26,402,403,404,405,314,406,407,408,306,409,410,318,385,307,411,412,373,413,414,415,416],"learn reverse engineering","engineering","reverse","reverse engineering","types","reverse-engineering","debugging","analysis","route","read","flow","disassembly","evidence","execution","calling","program","linking","formats","path"]