skanga

JClaw — Security skill for Claude Code

Security community

A java based "claw" agent with a focus on security and safety.

How to install JClaw

This entry records only its repository, not the path inside it, so there is no exact command to give. Open skanga/JClaw and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What JClaw does

A java based "claw" agent with a focus on security and safety.

Alternatives in Security

FastAPI Review — Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, secu 243.5k ★
Defense In Depth — Implement multi-layered testing and security best practices 98.1k ★
Google Workspace Model Armor — Filter user-generated content for safety 21.6k ★

README

JClaw - Personal AI Assistant

[![Java](https://img.shields.io/badge/Java-21+-orange.svg)](https://openjdk.org/) [![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) [![Build Status](https://img.shields.io/badge/Build-Passing-green.svg)](#) [![Tests](https://img.shields.io/badge/Tests-577%20Passing-success.svg)](pom.xml)

![Logo](images/jclaw.png "JClaw") JClaw is an ultra-lightweight Java AI assistant with tool calling, scheduled tasks, stateful sessions, and optional multi-channel delivery.

Overview

The project supports three execution modes:

CLI agent mode for one-shot or interactive terminal use.
Gateway mode for HTTP/WebSocket clients plus channel adapters.
Background mode operations (cron, heartbeat, state tracking) integrated into agent/gateway runs.

Key capabilities include:

LLM provider abstraction with a unified backend path.
Rich tool support: file, shell, web search/fetch, cron, spawn/subagent, transcription, and explicit skill activation.
Cron and heartbeat scheduling.
Multi-channel adapters for Telegram, Discord, Slack, and WhatsApp.
Dynamic skill management (install, list, search, remove, show, audit).
Skill install scanning and installed-skill auditing.
OAuth/token credential workflows.
Session persistence and resumable state for routing replies.
Security-first defaults: strict workspace sandboxing, audited tool execution, provenance-aware trust filtering, rate-limited/authenticated gateway, and safe network/file tooling. Full list in docs/SECURITY_FEATURES.md.
Explicit runtime safeguards around file boundaries, cleanup, shutdown behavior, and thread lifecycle so long-running runs remain stable.

0) 60-second quickstart

# 1) Build
mvn clean package

# 2) Create default config + workspace
java -jar target/JClaw-0.0.1.jar onboard

# 3) Try a one-shot message
java -jar target/JClaw-0.0.1.jar agent -m "What can you do?"

# 4) Check runtime sta