ClawSec

**Judgment:** ClawSec is a strong, specialized security-monitoring skill for AI agents that offers meaningful real-time visibility into HTTP/HTTPS traffic via a local MITM proxy. It appears well thought out, with concrete detection rules, structured logging, Docker support, and basic regression tests, making it suitable for serious development and security workflows when used by technically competent operators. **Key strengths:** - Intercepts and inspects both HTTP and HTTPS traffic from AI agents using a local CA and full MITM, giving comprehensive coverage. - Focused detection rules for common high-impact risks: API key and credential exfiltration, SSH keys, sensitive system files, and command injection / reverse shell patterns. - Outputs structured JSONL threat logs plus rotating operational logs, enabling downstream automation and SIEM integration. - Includes explicit operational guidance: start/stop/status, threat querying, Docker deployment, and configuration reference. **Risks / limitations:** - The MITM design necessarily captures plaintext sensitive data; logs (especially threats.jsonl and clawsec.log) may contain secrets and must be tightly protected and retained only as long as justified. - The detection rules are powerful but finite; they cover common patterns rather than providing comprehensive DLP or intrusion detection, so there is a risk of blind spots and a false sense of complete protection. - Installing and trusting a local CA system-wide (or across multiple runtimes) is non-trivial and, if misused, can weaken security beyond the AI monitoring use case (e.g., if the CA is broadly deployed and mishandled). - It is detection-only as described (no active blocking), so operators still need processes to respond to alerts and enforce policy. **Recommended scenarios:** - Security-conscious teams wanting to monitor and audit what their AI agents are actually doing on the network, especially when connecting to external APIs or tools. - Red teaming, penetration testing, or lab environments where AI agent exfiltration and prompt-injection behavior needs to be observed and analyzed in detail. - Development and debugging setups where engineers want visibility into agent HTTP(S) calls and potential leakage of secrets or sensitive paths. - Organizations integrating AI traffic logs into broader security monitoring pipelines (e.g., SIEM/SOC) for compliance and incident response. **Use with care:** - Restrict to environments and traffic you are authorized to inspect; treat all captured data and logs as highly sensitive. - Limit the CA trust scope where possible (per-process/environment variables rather than global system trust) and manage the CA key securely. - Communicate clearly internally that ClawSec is an additional detection layer, not a complete replacement for other security controls or code review.