Clawdex by Koi

Security: harden AGENTS.md with gateway, prompt injection, and supply chain rules

## What Adds a comprehensive **Security Protocols** section to `AGENTS.md` so that AI coding agents (Copilot, Cursor, Claude Code, etc.) operating in this repo receive explicit security guardrails. Supersedes #10510 (closed with feedback — addressed here). ## Why Recent research has surfaced sig

Security: harden AGENTS.md with gateway, prompt injection, and supply chain rules

## What Adds a comprehensive **Security Protocols** section to `AGENTS.md` so that AI coding agents (Copilot, Cursor, Claude Code, etc.) operating in this repo receive explicit security guardrails. ## Why Recent research has surfaced significant attack surfaces for OpenClaw deployments: - **Gate

fix(cli): clean stale shell completion profile entries on uninstall (AI-assisted)

## Summary - Problem: `openclaw uninstall --state` removed completion cache files but did not clean shell profile entries, leaving stale `source ~/.openclaw/completions/openclaw.zsh` lines. - Why it matters: opening a new terminal after uninstall could print `no such file or directory` errors during

feat: integrate KOI Clawdex security scanner

## Summary - Add mandatory Clawdex security scanning to `research-agent` (step 5) for all plugins/MCPs before installation - Extend verification from 4 to 5 dimensions, adding Security checks across `verification-agent` and `verification-rules` - Update `SKILL.md` flow diagram with security gate nod

Onboarding: new user install & first-run experience

## Goal Make first-time setup for clawdex **fast, clear, and hard to mess up**. ## Why A great onboarding flow reduces support load and increases adoption. New users should be able to install and get a working local instance in minutes. ## Scope - Install instructions (OS matrix) - First-run wizar