How do I install the Clawdstrike skill?

Run npx skillmds@latest add tomevault-io/clawdstrike in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Clawdstrike skill do?

Security review for risky code changes Use when this capability is needed. It is listed under Security on SkillMD.

Is Clawdstrike safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Clawdstrike?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Clawdstrike free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Clawdstrike?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Clawdstrike by tomevault-io — Agent Skill

Name: Clawdstrike
Author: tomevault-io

File contents

Security Review

Security Checklist

Before proceeding with risky actions, use the clawdstrike_check MCP tool to verify policy compliance:

Pre-flight check: Call clawdstrike_check with the action_type and target before executing
Secret scanning: Verify no secrets, API keys, or credentials are being written to files
Dependency audit: For new dependencies, check for known vulnerabilities
Permission scope: Ensure file operations stay within allowed paths
Shell safety: Validate shell commands against the ShellCommandGuard policy

Action Type Mapping

Use these action_type values when calling clawdstrike_check:

Scenario	action_type	target
Writing/reading files	`file`	Absolute file path
Running shell commands	`shell`	The command string
HTTP/network requests	`egress`	Domain or URL
Installing packages	`shell`	Install command
MCP tool invocation	`mcp_tool`	Tool name

Response Guidelines

When this skill is active:

Proactively call clawdstrike_check before file writes to sensitive paths
Flag potential security issues with severity levels (Critical/High/Medium/Low)
Suggest safer alternatives when an action would be blocked by policy
Reference specific guards that would evaluate the action

Recommended Tools

Use these MCP tools in order of priority when this skill activates:

Tool	When to Use
`clawdstrike_check`	Before any file write, shell command, or egress -- the primary enforcement tool
`clawdstrike_policy_eval`	To test hypothetical actions without executing them -- use for planning
`clawdstrike_policy_show`	To understand which guards are active and what the current restrictions are
`clawdstrike_scan`	To audit all MCP server configs for misconfigurations before a review
`clawdstrike_policy_lint`	To validate policy YAML files for syntax/schema errors

Guard Reference

These guards are evaluated during checks:

ForbiddenPathGuard - Blocks access to sensitive filesystem paths
PathAllowlistGuard - Enforces allowlist-based path access
SecretLeakGuard - Detects secrets/credentials in file content
ShellCommandGuard - Blocks dangerous shell commands
EgressAllowlistGuard - Controls outbound network access
PatchIntegrityGuard - Validates patch/diff safety

Source: backbay-labs/clawdstrike — distributed by TomeVault.

---name: clawdstrikedescription: Security review for risky code changes Use when this capability is needed.---# Security Review<trigger>This skill activates when the user or conversation involves:- Multi-file edits touching security-sensitive paths (auth, config, credentials, .env, keys)- Shell commands that modify system state, install packages, or change permissions- New dependency additions or version changes- Changes to CI/CD, Docker, or infrastructure configuration- File writes to sensitive directories (/etc, ~/.ssh, ~/.aws, ~/.config)- File reads of sensitive paths (private keys, credential stores, token caches, certificate files)- Any content containing these keywords: "secret", "credential", "API key", "token", "password", "private key", "certificate", ".env", "auth", "permission"</trigger>## Security ChecklistBefore proceeding with risky actions, use the `clawdstrike_check` MCP tool to verify policy compliance:1. **Pre-flight check**: Call `clawdstrike_check` with the action_type and target before executing2. **Secret scanning**: Verify no secrets, API keys, or credentials are being written to files3. **Dependency audit**: For new dependencies, check for known vulnerabilities4. **Permission scope**: Ensure file operations stay within allowed paths5. **Shell safety**: Validate shell commands against the ShellCommandGuard policy## Action Type MappingUse these action_type values when calling `clawdstrike_check`:| Scenario | action_type | target ||----------|-------------|--------|| Writing/reading files | `file` | Absolute file path || Running shell commands | `shell` | The command string || HTTP/network requests | `egress` | Domain or URL || Installing packages | `shell` | Install command || MCP tool invocation | `mcp_tool` | Tool name |## Response GuidelinesWhen this skill is active:- Proactively call `clawdstrike_check` before file writes to sensitive paths- Flag potential security issues with severity levels (Critical/High/Medium/Low)- Suggest safer alternatives when an action would be blocked by policy- Reference specific guards that would evaluate the action## Recommended ToolsUse these MCP tools in order of priority when this skill activates:| Tool | When to Use ||------|-------------|| `clawdstrike_check` | Before any file write, shell command, or egress -- the primary enforcement tool || `clawdstrike_policy_eval` | To test hypothetical actions without executing them -- use for planning || `clawdstrike_policy_show` | To understand which guards are active and what the current restrictions are || `clawdstrike_scan` | To audit all MCP server configs for misconfigurations before a review || `clawdstrike_policy_lint` | To validate policy YAML files for syntax/schema errors |## Guard ReferenceThese guards are evaluated during checks:- **ForbiddenPathGuard** - Blocks access to sensitive filesystem paths- **PathAllowlistGuard** - Enforces allowlist-based path access- **SecretLeakGuard** - Detects secrets/credentials in file content- **ShellCommandGuard** - Blocks dangerous shell commands- **EgressAllowlistGuard** - Controls outbound network access- **PatchIntegrityGuard** - Validates patch/diff safety---> Source: [backbay-labs/clawdstrike](https://github.com/backbay-labs/clawdstrike) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions

Clawdstrike