prompt-security · davida-ps · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026
diff --git a/skills/clawsec-nanoclaw/CHANGELOG.md b/skills/clawsec-nanoclaw/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.0.11] - 2026-07-22
+
+### Changed
+
+- Bounded this legacy adapter to NanoClaw `>=0.1.0 <2.0.0` and marked NanoClaw v2 as incompatible.
+- Removed or explicitly scoped obsolete v2-facing installation, scheduler, IPC-layout, and key-management claims to the pre-v2 adapter.
+- Added a compatibility regression test while preserving the frozen v1 runtime behavior as migration evidence.
+
 ## [0.0.10] - 2026-06-23
 
 ### Changed

diff --git a/skills/clawsec-nanoclaw/INSTALL.md b/skills/clawsec-nanoclaw/INSTALL.md
@@ -1,24 +1,28 @@
-# ClawSec for NanoClaw - Installation Guide
+# ClawSec Legacy NanoClaw v1 Integration Guide
 
-This guide shows how to add ClawSec security monitoring to your NanoClaw deployment.
+> **Compatibility boundary:** This entire guide applies only to NanoClaw `>=0.1.0 <2.0.0`. NanoClaw v2 (`>=2.0.0`) is incompatible. Do not copy these files, use these IPC paths, or run these restart steps on v2. NanoClaw v2 requires a separate adapter for its current SQLite-backed and host/container extension model.
+
+This guide records the manual integration for compatible pre-v2 NanoClaw deployments.
 
 ## Overview
 
-ClawSec provides security advisory monitoring for NanoClaw through:
+The legacy v1 adapter provides security advisory monitoring through:
 - **MCP Tools**: Agents can check for vulnerabilities via `clawsec_check_advisories`
-- **Advisory Feed**: Automatic monitoring of https://clawsec.prompt.security/advisories/feed.json
+- **Advisory Feed**: Host-wired monitoring of https://clawsec.prompt.security/advisories/feed.json
 - **Signature Verification**: Ed25519-signed feeds ensure integrity
 - **Exploitability Context**: Advisories include exploitability score and rationale for triage
 
 ## Prerequisites
 
-- NanoClaw >= 0.1.0
+- NanoClaw >= 0.1.0 and < 2.0.0
 - Node.js >= 18.0.0
 - Write access to NanoClaw installation directory
 
-## Installation Steps
+## Legacy v1 Integration Steps
+
+Every path and code fragment below is a NanoClaw v1 layout assumption. Stop if the target version is unknown or is NanoClaw v2.
 
-### 1. Copy Skill Files
+### 1. Copy Skill Files into a Confirmed v1 Checkout
 
 Copy the `clawsec-nanoclaw` skill directory to your NanoClaw installation:
 
@@ -27,7 +31,7 @@ Copy the `clawsec-nanoclaw` skill directory to your NanoClaw installation:
 cp -r skills/clawsec-nanoclaw /path/to/your/nanoclaw/skills/
 ```
 
-### 2. Integrate MCP Tools
+### 2. Integrate v1 MCP Tools
 
 Add the ClawSec MCP tools to your NanoClaw container agent runner.
 
@@ -53,7 +57,7 @@ Each file calls `server.tool()` directly to register its tools. The `server`,
 the scope where these files are imported (they are declared as ambient globals
 in each tool file).
 
-### 3. Integrate IPC Handlers
+### 3. Integrate v1 IPC Handlers
 
 Add the host-side IPC handlers for ClawSec operations.
 
@@ -84,7 +88,7 @@ default:
 }
 ```
 
-### 4. Start Advisory Cache Service
+### 4. Start the v1 Host Advisory Cache Service
 
 Add the advisory cache manager to your host services.
 
@@ -112,7 +116,7 @@ async function main() {
 }
 ```
 
-### 5. Restart NanoClaw
+### 5. Restart the Legacy v1 Docker Compose Deployment
 
 Restart your NanoClaw instance to load the new MCP tools and services:
 
@@ -124,7 +128,7 @@ docker-compose down
 docker-compose up -d
 ```
 
-## Verification
+## Legacy v1 Verification
 
 Test that ClawSec is working:
 
@@ -219,7 +223,7 @@ To change, pass a different data directory path to `new AdvisoryCacheManager(dat
 
 ### Refresh Interval
 
-Default: 6 hours
+Example v1 host cadence: 6 hours after explicit operator wiring. The skill does not install a scheduler.
 
 To change, update the `setInterval(...)` duration (in milliseconds) in host startup.
 
@@ -244,12 +248,12 @@ Platform metadata is preserved in advisory records and can be filtered by your p
 
 ### Signature Verification
 
-All advisory feeds are Ed25519 signed. The public key is pinned in:
+The v1 advisory cache verifies Ed25519-signed feeds with the public key embedded at:
 ```
 skills/clawsec-nanoclaw/advisories/feed-signing-public.pem
 ```
 
-Feeds failing signature verification are rejected.
+Feeds failing signature verification are rejected. The v1 package-verifier handler also reads this embedded feed-verification key by default. This is not a NanoClaw v2 installer/trust contract, and it is distinct from the ClawSec GitHub Release manifest key downloaded and fingerprint-checked in `SKILL.md`.
 
 ### Cache Integrity
 
@@ -301,7 +305,7 @@ Never manually edit the cache file - it will break signature verification.
 3. Ensure host process is running
 4. Check host logs for handler errors
 
-## Uninstallation
+## Legacy v1 Uninstallation
 
 To remove ClawSec from NanoClaw:
 

diff --git a/skills/clawsec-nanoclaw/README.md b/skills/clawsec-nanoclaw/README.md
@@ -1,14 +1,15 @@
-# ClawSec for NanoClaw
+# ClawSec for NanoClaw v1 (Legacy Adapter)
 
-ClawSec now supports NanoClaw, a containerized WhatsApp bot powered by Claude agents.
+This package preserves the original ClawSec integration for pre-v2 NanoClaw deployments.
 
-## Vercel Skills Installation
+## Compatibility
 
-Install with the Vercel Skills CLI for this harness:
+- Supported NanoClaw range: `>=0.1.0 <2.0.0`.
+- NanoClaw v2 (`>=2.0.0`): **incompatible; do not install or activate this adapter**.
+- The bundled IPC, cache, scheduler, and integrity examples describe the v1 layout only.
+- NanoClaw v2 needs a separate adapter for its current host, container, SQLite IPC, and extension surfaces.
 
-```bash
-npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -a openclaw -y
-```
+This package remains available for legacy users and migration evidence. It is not a NanoClaw v2 installation path.
 
 ## What Changed
 
@@ -45,9 +46,9 @@ Advisories now support optional `platforms` field:
 - `["openclaw", "nanoclaw"]` - Affects both platforms
 - (empty/missing) - Applies to all platforms (backward compatible)
 
-## ClawSec NanoClaw Skill
+## Legacy ClawSec NanoClaw Skill
 
-ClawSec provides a complete security skill for NanoClaw deployments:
+ClawSec provides a legacy adapter for compatible pre-v2 NanoClaw deployments:
 
 **Location**: `skills/clawsec-nanoclaw/`
 
@@ -69,18 +70,11 @@ ClawSec provides a complete security skill for NanoClaw deployments:
 - **Exploitability Context**: Surfaces `exploitability_score` and rationale to reduce alert fatigue
 - **IPC Communication**: Container-safe host communication
 
-### Installation
-
-1. Copy the skill to your NanoClaw deployment:
-   ```bash
-   cp -r skills/clawsec-nanoclaw /path/to/nanoclaw/skills/
-   ```
-
-2. Follow the detailed guide at `skills/clawsec-nanoclaw/INSTALL.md`
+### Legacy v1 Integration Map
 
-### Quick Integration
+Only operators who have confirmed a target version in `>=0.1.0 <2.0.0` should use the detailed [legacy installation guide](./INSTALL.md). Do not raw-copy or import these files into NanoClaw v2.
 
-The skill integrates into three places:
+The v1 adapter historically integrates into three v1 locations:
 
 **1. MCP Tools** (container):
 ```typescript
@@ -107,49 +101,17 @@ NanoClaw consumes the same feed as OpenClaw:
 https://clawsec.prompt.security/advisories/feed.json
 ```
 
-The feed is Ed25519 signed and automatically fetched by the cache service.
-
-## Team Credits
-
-This integration was developed by a team of 8 specialized agents coordinated to adapt ClawSec for NanoClaw:
-
-- **pioneer-repo-scout** - ClawSec architecture analysis
-- **pioneer-nanoclaw-scout** - NanoClaw architecture analysis
-- **architect** - Integration design and coordination
-- **advisory-specialist** - Advisory feed integration
-- **integrity-specialist** - File integrity design
-- **installer-specialist** - Signature verification implementation
-- **tester** - Test infrastructure and validation
-- **documenter** - Documentation
-
-Total contribution: 3000+ lines of code and comprehensive design documents.
-
-## What's Included
-
-The `clawsec-nanoclaw` skill provides:
-
-- **1,730 lines** of production-ready TypeScript code
-- **MCP Tools** (350 lines): Agent-facing vulnerability checking
-- **Advisory Cache** (492 lines): Automatic feed fetching and caching
-- **Signature Verification** (387 lines): Ed25519 signature validation
-- **Advisory Matching** (289 lines): Skill-to-vulnerability correlation
-- **IPC Handlers** (212 lines): Container-to-host communication
-- **Complete Documentation**: Installation guide, usage examples, troubleshooting
+The feed is Ed25519 signed. A v1 operator must explicitly wire and start the cache service; this package does not install an automatic scheduler.
 
-## Future Enhancements
+## Legacy Implementation Status
 
-Planned features for future releases:
-- File integrity monitoring (soul-guardian adaptation for containers)
-- Real-time advisory alerts via WebSocket
-- WhatsApp-native security alert formatting
-- Behavioral analysis and anomaly detection
-- Custom/private advisory feed support
+The MCP tools, host services, IPC handlers, and integrity code are frozen v1 implementation and migration evidence. They are not a starting point for claiming NanoClaw v2 support. A future v2 core, suite, and drift guardian must use the v2-native workflow and land in separate packages and PRs.
 
 ## Documentation
 
-- [Skill Documentation](skills/clawsec-nanoclaw/SKILL.md) - Features and architecture
-- [Installation Guide](skills/clawsec-nanoclaw/INSTALL.md) - Detailed setup instructions
-- [ClawSec Main README](README.md) - Overall ClawSec documentation
+- [Skill Documentation](./SKILL.md) - Legacy v1 behavior and compatibility boundary
+- [Installation Guide](./INSTALL.md) - Legacy v1 integration instructions
+- [ClawSec Main README](../../README.md) - Overall ClawSec documentation
 - [Security & Signing](../../wiki/security-signing-runbook.md) - Signature verification details
 
 ## Support

diff --git a/skills/clawsec-nanoclaw/SKILL.md b/skills/clawsec-nanoclaw/SKILL.md
@@ -1,24 +1,25 @@
 ---
 name: clawsec-nanoclaw
-version: 0.0.10
-description: Use when checking for security vulnerabilities in NanoClaw skills, before installing new skills, or when asked about security advisories affecting the bot
+version: 0.0.11
+description: Use only with legacy NanoClaw >=0.1.0 <2.0.0 to check ClawSec advisories, package signatures, and the bundled v1 integrity adapter; NanoClaw v2 is incompatible and requires a separate adapter
 ---
 
-# ClawSec for NanoClaw
+# ClawSec for NanoClaw v1 (Legacy)
 
-Security advisory monitoring that protects your WhatsApp bot from known vulnerabilities in skills and dependencies.
+Legacy advisory, package-signature, and integrity tooling for compatible pre-v2 NanoClaw deployments.
 
-## Vercel Skills Installation
+## Compatibility Gate
 
-Install with the Vercel Skills CLI for this harness:
+- Supported NanoClaw range: `>=0.1.0 <2.0.0`.
+- NanoClaw v2 (`>=2.0.0`): **incompatible; do not install or activate this adapter**.
+- NanoClaw v2 uses different host, container, SQLite IPC, and extension surfaces. It requires a separate ClawSec adapter.
+- The v1 integration paths in this package are retained for legacy users and migration evidence only. They are not NanoClaw v2 instructions.
 
-```bash
-npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -a openclaw -y
-```
+Stop if the target version is unknown or is NanoClaw v2. Do not reinterpret the v1 IPC examples as a generic installation recipe.
 
 ## Overview
 
-ClawSec provides MCP tools that check installed skills against a curated feed of security advisories. It prevents installation of vulnerable skills, includes exploitability context for triage, and alerts you to issues in existing ones.
+The bundled v1 MCP tools check installed skills against a curated feed of security advisories, include exploitability context for triage, and report issues in existing packages. They return advisory decisions; they do not own or enforce the host installer.
 
 **Core principle:** Check before you install. Monitor what's running.
 
@@ -95,36 +96,33 @@ const advisories = await tools.clawsec_list_advisories({
 
 ## Common Patterns
 
-### Pattern 1: Safe Skill Installation
+### Pattern 1: Pre-Installation Advisory Review
 
 ```typescript
 // ALWAYS check before installing
 const safety = await tools.clawsec_check_skill_safety({
   skillName: userRequestedSkill
 });
 
-if (safety.safe) {
-  // Proceed with installation
-  await installSkill(userRequestedSkill);
-} else {
-  // Show user the risks and get confirmation
+if (!safety.safe) {
+  // Return the advisory evidence to the host installer or operator.
   await showSecurityWarning(safety.advisories);
-  if (await getUserConfirmation()) {
-    await installSkill(userRequestedSkill);
-  }
+  return { recommendation: 'do-not-install', safety };
 }
+
+// Advisory output is one input, not installation authorization.
+return {
+  recommendation: 'continue-review',
+  safety,
+  requiresSignatureVerification: true,
+  requiresCodeReview: true,
+  requiresOperatorApproval: true
+};
 ```
 
-### Pattern 2: Periodic Security Check
+### Pattern 2: Legacy v1 Host Scheduling
 
-```typescript
-// Add to scheduled tasks
-schedule_task({
-  prompt: "Check advisories using clawsec_check_advisories and alert when critical or high-exploitability matches appear",
-  schedule_type: "cron",
-  schedule_value: "0 9 * * *"  // Daily at 9am
-});
-```
+Scheduling is deployment-owned. This package does not register a NanoClaw v2 task or scheduler integration. A compatible v1 operator may wire an advisory check through the v1 host's reviewed scheduling surface after completing the manual integration in [INSTALL.md](./INSTALL.md).
 
 ### Pattern 3: User Security Query
 
@@ -153,7 +151,13 @@ await installSkill('untrusted-skill');
 const safety = await tools.clawsec_check_skill_safety({
   skillName: 'untrusted-skill'
 });
-if (safety.safe) await installSkill('untrusted-skill');
+if (!safety.safe) return { recommendation: 'do-not-install', safety };
+return {
+  recommendation: 'continue-review',
+  requiresSignatureVerification: true,
+  requiresCodeReview: true,
+  requiresOperatorApproval: true
+};
 ```
 
 ### ❌ Ignoring exploitability context
@@ -193,21 +197,21 @@ if (advisory.exploitability_score === 'high' || advisory.severity === 'critical'
 
 This signed feed is consolidated. NanoClaw receives NVD CVEs, approved community advisories, and provisional GHSA-without-CVE advisories through the same default URL.
 
-**Update Frequency**: Every 6 hours (automatic)
+**Legacy v1 example cadence**: Every 6 hours after explicit host wiring; the skill does not install a scheduler.
 
 **Signature Verification**: Ed25519 signed feeds
 **Package Verification Policy**: pinned key only, bounded package/signature paths
 
-**Cache Location**: `/workspace/project/data/clawsec-advisory-cache.json`
+**Legacy v1 cache location**: `/workspace/project/data/clawsec-advisory-cache.json`
 
 See [INSTALL.md](./INSTALL.md) for setup and [docs/](./docs/) for advanced usage.
 
 ## Real-World Impact
 
-- Prevents installation of skills with known RCE vulnerabilities
+- Helps operators identify skills with known RCE vulnerabilities before installation
 - Alerts to supply chain attacks in dependencies
 - Provides actionable remediation steps
-- Zero false positives (curated feed only)
+- Uses a curated feed while preserving severity and exploitability context for operator review
 
 ## Release Artifact Verification
 
@@ -217,14 +221,16 @@ For standalone installs, verify the signed release manifest before trusting `SKI
 set -euo pipefail
 
 SKILL_NAME="clawsec-nanoclaw"
-VERSION="0.0.10"
+VERSION="0.0.11"
 REPO="prompt-security/clawsec"
 TAG="${SKILL_NAME}-v${VERSION}"
 BASE="https://github.com/${REPO}/releases/download/${TAG}"
 ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip"
 TMP_DIR="$(mktemp -d)"
 trap 'rm -rf "$TMP_DIR"' EXIT
 
+# ClawSec GitHub Release signing trust anchor. This is not a NanoClaw v2
+# integration key and is distinct from the v1 embedded feed-verification path.
 RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"
 
 curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"