Nanoclaw Traffic Guardian

NanoClaw Traffic Guardian

This is a baseline specification skill. It intentionally does not ship a proxy or runtime implementation yet.

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill nanoclaw-traffic-guardian -a openclaw -y

Release Artifact Verification

For standalone installs, verify the signed release manifest before trusting SKILL.md, skill.json, or the archive. The skill.json file is the package metadata/SBOM source, and the release pipeline signs checksums.json with the ClawSec release key.

set -euo pipefail

SKILL_NAME="nanoclaw-traffic-guardian"
VERSION="0.0.1-beta3"
REPO="prompt-security/clawsec"
TAG="${SKILL_NAME}-v${VERSION}"
BASE="https://github.com/${REPO}/releases/download/${TAG}"
ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"
curl -fsSL "$BASE/SKILL.md" -o "$TMP_DIR/SKILL.md"
curl -fsSL "$BASE/skill.json" -o "$TMP_DIR/skill.json"

ACTUAL_PUBKEY_SHA256="$(openssl pkey -pubin -in "$TMP_DIR/signing-public.pem" -outform DER | shasum -a 256 | awk '{print $1}')"
if [ "$ACTUAL_PUBKEY_SHA256" != "$RELEASE_PUBKEY_SHA256" ]; then
  echo "ERROR: signing-public.pem fingerprint mismatch" >&2
  exit 1
fi

openssl base64 -d -A -in "$TMP_DIR/checksums.sig" -out "$TMP_DIR/checksums.sig.bin"
openssl pkeyutl -verify -rawin -pubin \
  -inkey "$TMP_DIR/signing-public.pem" \
  -sigfile "$TMP_DIR/checksums.sig.bin" \
  -in "$TMP_DIR/checksums.json" >/dev/null

hash_file() {
  if command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | awk '{print $1}'
  else
    sha256sum "$1" | awk '{print $1}'
  fi
}

verify_manifest_file() {
  asset="$1"
  path="$2"
  expected="$(jq -r --arg asset "$asset" '.files[$asset].sha256 // empty' "$TMP_DIR/checksums.json")"
  if [ -z "$expected" ]; then
    echo "ERROR: checksums.json missing $asset" >&2
    exit 1
  fi
  actual="$(hash_file "$path")"
  if [ "$actual" != "$expected" ]; then
    echo "ERROR: checksum mismatch for $asset" >&2
    exit 1
  fi
}

expected_archive="$(jq -r '.archive.sha256 // empty' "$TMP_DIR/checksums.json")"
if [ -z "$expected_archive" ]; then
  echo "ERROR: checksums.json missing archive.sha256" >&2
  exit 1
fi
actual_archive="$(hash_file "$TMP_DIR/$ZIP_NAME")"
if [ "$actual_archive" != "$expected_archive" ]; then
  echo "ERROR: archive checksum mismatch" >&2
  exit 1
fi

verify_manifest_file "SKILL.md" "$TMP_DIR/SKILL.md"
verify_manifest_file "skill.json" "$TMP_DIR/skill.json"

echo "Signed release manifest, archive, SKILL.md, and skill.json verified."

Only install or extract the archive after this verification succeeds.

Scope

Builders should use this skill as the NanoClaw landing zone for runtime traffic monitoring:

• host-side HTTP proxy inspection
• optional HTTPS inspection with host-held CA material
• outbound exfiltration detection
• inbound injection detection
• redacted local threat logs
• MCP tools for status, findings, and config checks
• IPC handlers for container-safe host communication

Prefer this as an optional companion to clawsec-nanoclaw, not as a mandatory extension of the existing advisory/signature/integrity suite.

Safety Contract

• Opt-in only.
• Detect-and-log by default.
• No automatic system CA installation.
• No CA private key access from the container.
• No blocking in the first implementation.
• Redact secrets before logs or MCP responses.
• Keep all state under NANOCLAW_TRAFFIC_GUARDIAN_HOME or the host-managed NanoClaw security data directory.

Builder Entry Points

Read SPEC.md before implementing. Use the placeholder folders as follows:

Required First Implementation Behavior

1. Validate config without starting the proxy. 2. Start monitor through a host-managed lifecycle path. 3. Keep CA key material on the host side. 4. Inspect HTTP request/response text up to a bounded byte limit. 5. Support optional HTTPS MITM only when the operator supplies per-runtime trust configuration. 6. Emit JSONL findings with redacted snippets. 7. Expose MCP tools that return status and redacted findings only.

Out of Scope for v0.0.1 Implementation

• automatic system trust-store mutation
• transparent network interception
• default blocking
• sending traffic to external services
• exposing raw request/response bodies to the container

Changelog

[0.0.1-beta3] - 2026-06-10

Changed

• Re-released skill package with updated marketplace grouping and signed release trust artifacts for Vercel-compatible skill installation.

[0.0.1-beta2] - 2026-05-13

Security

• Added explicit signed release artifact verification instructions for standalone installs, including checksums.json, checksums.sig, signing-public.pem, archive hash verification, and SKILL.md/skill.json checksum checks.

Changed

• Re-release skill payload metadata after excluding test-only files from release SBOMs and archives.

[0.0.1-beta1] - 2026-05-10

• Added baseline skill metadata, frontmatter, and implementation specification.
• Reserved folder structure for NanoClaw host services, MCP tools, detector code, and tests.
• Beta release notes: this release is a scaffold/spec baseline and does not yet ship active runtime proxy interception.
• Beta release notes: host-service and MCP contracts are defined, but detection/enforcement behavior is not active by default.

NanoClaw Traffic Guardian

Baseline skill for NanoClaw runtime traffic monitoring.

This package is intentionally a spec scaffold. Builders should add the NanoClaw-specific host-service, IPC, and MCP implementation here while preserving the safety contract in SKILL.md and SPEC.md.

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill nanoclaw-traffic-guardian -a openclaw -y

Intended Capability

• detect outbound secret exfiltration in NanoClaw host-managed traffic
• detect inbound command-injection and tool-abuse payloads
• keep CA private key material outside the container
• expose redacted status/findings through MCP tools
• provide explicit host-side lifecycle controls

Builder Notes

Follow the existing clawsec-nanoclaw pattern: host services own privileged operations, while MCP tools expose bounded requests and redacted responses.

NanoClaw Traffic Guardian Specification

Goal

Provide NanoClaw with opt-in runtime traffic monitoring that observes host-managed NanoClaw traffic for exfiltration and injection signals while preserving container isolation.

Required Architecture

Implement four layers:

1. Detector core

• normalized finding schema
• pattern registry
• snippet redaction
• deduplication
• JSONL report writer

2. Host service

• proxy lifecycle
• CA key ownership
• log storage
• config validation
• IPC task handling

3. MCP tool surface

• clawsec_traffic_status
• clawsec_traffic_findings
• clawsec_traffic_check_config

4. Operator interface

• safe setup text
• explicit host/container proxy wiring guidance
• CA fingerprint display when HTTPS inspection is enabled

Finding Schema

Findings must be JSON objects with these fields:

{
  "schema_version": "clawsec-traffic-finding/v1",
  "platform": "nanoclaw",
  "direction": "outbound",
  "protocol": "http",
  "threat_type": "EXFIL",
  "pattern": "ai_api_key",
  "severity": "high",
  "source": "127.0.0.1",
  "dest": "api.example.com:443",
  "snippet": "[REDACTED]",
  "timestamp": "2026-04-26T00:00:00.000Z"
}

Minimum Detection Set

Outbound EXFIL:

• AI API keys
• AWS access key IDs
• private key PEM markers
• SSH key file paths
• sensitive Unix file paths
• dotenv and cloud credential paths
• WhatsApp session or credential path markers when NanoClaw exposes stable names

Inbound INJECTION:

• pipe-to-shell commands
• shell exec flags
• reverse shell command shapes
• destructive remove commands
• SSH authorized-key injection shapes

Safety Requirements

• Default mode is detect-and-log.
• Blocking mode must not exist in the first implementation.
• Snippets must be redacted before persistence and before MCP responses.
• Maximum scan bytes must be configurable and bounded.
• CA private key material must stay host-side.
• System trust-store instructions must require explicit operator confirmation and must never run automatically.

Tests Required Before Release

• detector unit tests for each pattern
• redaction tests proving secrets are not persisted or returned through MCP
• host-service lifecycle tests
• IPC timeout and malformed-task tests
• MCP schema tests
• proxy fixture tests for HTTP request and response inspection
• no-false-positive tests for common benign traffic