Add clawheart-security skill

[tjsdyy]

Submit a Skill

Thank you for contributing a skill to the Goose community!

---

📛 Skill Info

• Skill name (folder name): `clawheart-security`
• Short description (what does this skill help Goose do?): Drive ClawHeart's local AI security runtime to scan AI agent risks, audit installed skills, list MCP servers, and inventory third-party LLM providers — all via the `clawheart` CLI.
• Author / handle: @tjsdyy
• Version: `1.0`

---

📁 Structure Checklist

• My skill is in a top-level folder (`clawheart-security/`)
• The folder contains a `SKILL.md` file
• `SKILL.md` includes valid YAML frontmatter:
  • `name`
  • `description`
  • `author`
  • `version`
  • `tags` (list of strings)
• Supporting files (scripts/templates) live inside the skill folder (none needed — skill is pure instructions)

---

🔐 Security Acknowledgement

• This skill does not contain malicious behavior
• This skill does not attempt to exfiltrate secrets, tokens, or credentials
• This skill does not contain obfuscated payloads (base64 blobs, packed binaries, etc.)
• I understand that all submissions run through automated security scanning
• I understand this PR may be rejected if it fails validation or security review

---

📝 Additional Notes

This skill is a pure-instruction SKILL.md — it tells the agent which `clawheart` subcommand to call for each user intent (scan / skills audit / agents list / MCP / providers / status / onboarding), and how to render the structured JSON output. No scripts, no templates, no binaries.

About ClawHeart: ClawHeart Desktop is a local-first AI security runtime that proxies AI agent traffic, audits installed skills, and inventories agent + MCP + provider configuration on the user's machine. The CLI (`clawheart-cli`, ≤2MB) is the JSON-first entry point this skill drives.

Source: https://github.com/tjsdyy/clawheartv2 · CLI release: https://github.com/tjsdyy/clawheartv2/releases/latest

Validator locally: `node scripts/validate-skills.mjs` ✓

[github-actions]

✅ Validate Skills — PASSED

Summary: FAIL=0 · WARN=0
Changed skill dirs: clawheart-security

Output (last 200 lines)

✅ Found 8 skill directories.
✅ api-setup: structure validated
✅ beads: structure validated
✅ clawheart-security: structure validated
✅ code-review: structure validated
✅ frontend-design: structure validated
✅ goose-blog-post: structure validated
✅ rp-why: structure validated
✅ testing-strategy: structure validated

Structure validation PASSED.

[github-actions]

🛡️ Skills Security Scan — FAIL

Summary: FAIL=2 · WARN=7 · FILES=1
Changed skills scanned: clawheart-security

❌ FAIL blocks merge. Fix the items below.

❌ Failures

clawheart-security

• remote-exec:curl-pipe-shell — clawheart-security/SKILL.md:34

- If `which clawheart` fails, send the user to `https://clawheart.live` to download, or have them run `curl -fsSL https://clawheart.live/install.sh | sh`.

Guidance: Blocks download-and-execute. Vendor scripts or verify pinned downloads + checksums.

• remote-exec:curl-pipe-shell — clawheart-security/SKILL.md:95

> **macOS / Linux:** `curl -fsSL https://clawheart.live/install.sh | sh`

Guidance: Blocks download-and-execute. Vendor scripts or verify pinned downloads + checksums.

⚠️ Warnings

clawheart-security

• content:entropy-high-line — clawheart-security/SKILL.md:18

This skill lets an AI agent drive [ClawHeart](https://clawheart.live)'s local security runtime through the `clawheart` CLI. ClawHeart inspects what the user already has on their machine — AI agent configs, installed skills, MCP servers, thi…

• network:url — clawheart-security/SKILL.md:18

This skill lets an AI agent drive [ClawHeart](https://clawheart.live)'s local security runtime through the `clawheart` CLI. ClawHeart inspects what the user already has on their machine — AI agent configs, installed skills, MCP servers, thi…

Guidance: Review: URL present; confirm expected destination and purpose.

• network:url — clawheart-security/SKILL.md:93

> ClawHeart CLI isn't installed. Visit https://clawheart.live to download, or run:

Guidance: Review: URL present; confirm expected destination and purpose.

• network:url — clawheart-security/SKILL.md:97

> **Windows:** `iwr https://clawheart.live/install.ps1 -useb | iex`

Guidance: Review: URL present; confirm expected destination and purpose.

• network:url — clawheart-security/SKILL.md:113

- Source: https://github.com/tjsdyy/clawheartv2

Guidance: Review: URL present; confirm expected destination and purpose.

• network:url — clawheart-security/SKILL.md:114

- Issues: https://github.com/tjsdyy/clawheartv2/issues

Guidance: Review: URL present; confirm expected destination and purpose.

• network:url — clawheart-security/SKILL.md:115

- Site: https://clawheart.live

Guidance: Review: URL present; confirm expected destination and purpose.

---

Notes: This comment auto-updates on each push to keep PRs clean.