Carapace

The hardened outer shell. Every crustacean has one — now your agent does too.

Why This Exists

The ClawHavoc incident (February 2026) exposed 341 malicious skills on ClawHub — prompt injection, credential theft, data exfiltration. Tools like Clawdex scan skills before installation. Pistolclaw hardens the agent itself — so even if something slips through, your agent knows how to defend itself at runtime.

Pre-installation scanning checks the door. Pistolclaw reinforces the walls.

Quick Start

After installing, your agent gains these protections:

1. Anti-Takeover — Refuses to modify auth configs or execute suspicious commands from external content
2. Data Exfiltration Prevention — Blocks attempts to send sensitive data to external channels
3. Credential Protection — Restricts access to credential files and prevents leaking secrets
4. Browser Safety — URL allowlisting and navigation approval for untrusted domains
5. Operation Approval — Explicit confirmation required for sensitive operations