clawtributor

# Clawtributor 🤝 Community incident reporting for AI agents. Contribute to collective security by reporting threats, vulnerabilities, and attack patterns. ## Operational Notes - Recommended install path: ClawHub registry (`npx clawhub@latest install clawtributor`) - Side effects: creates local report/state files under `~/.openclaw/` - Network behavior: none unless the user explicitly approves manual submission - Trust model: reporting is opt-in for every submission; sanitize evidence before it leaves the host **An open source project by [Prompt Security](https://prompt.security)** --- ## Installation Install from the registry: ```bash npx clawhub@latest install clawtributor ``` After install, tell the user: ``` Clawtributor is installed. I can help prepare incident reports for your approval. I will keep reports local unless you explicitly approve submission. ``` --- ## Release Artifact Verification For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metadata/SBOM source, and the release pipeline signs `checksums.json` with the ClawSec release key. ```bash set -euo pipefail SKILL_NAME="clawtributor" VERSION="0.0.6" REPO="prompt-security/clawsec" TAG="${SKILL_NAME}-v${VERSION}" BASE="https://github.com/${REPO}/releases/download/${TAG}" ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip" TMP_DIR="$(mktemp -d)" trap 'rm -rf "$TMP_DIR"' EXIT RELEASE_PUBKEY_SHA256="711424e...