Abaddon is an adversarial security auditor for OpenClaw that runs red team assessments to identify vulnerabilities, leaks, and configuration weaknesses.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install abaddon
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install abaddon using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Abaddon?
Abaddon is a specialized security extension designed for the OpenClaw ecosystem that adopts an attacker's mindset to evaluate system defenses. Unlike standard defensive tools that merely verify configurations, Abaddon proactively hunts for exposed ports, credential leaks, and improper file permissions that an adversary could exploit. It is an essential addition for developers using Openclaw Skills who require rigorous system integrity and proactive threat detection.
Operating primarily on macOS, this skill provides continuous monitoring through on-demand audits or scheduled nightly sweeps. By assigning a clear letter grade to the system's security posture, it translates complex technical vulnerabilities into actionable intelligence, ensuring that your AI agent workspace remains a hardened environment.
Abaddon Use Cases
- Automated nightly security benchmarking for macOS AI workstations.
- Auditing OpenClaw configurations to prevent prompt injection or unauthorized agent behavior.
- Detecting accidental exposure of local services via 0.0.0.0 bindings or active tunnels like ngrok.
- Scanning for plaintext API keys and secrets leaked in environment variables or shell histories.
- Validating file system permissions across sensitive workspace manifests like SOUL.md and AGENTS.md.
How Abaddon Works
- The skill initiates a scan of network interfaces and listening ports to identify unauthorized external exposure.
- It audits system-level security features including SIP, FileVault, and the status of macOS security definitions.
- A deep dive into the OpenClaw workspace is performed, checking for weak execution modes and unauthorized plugins.
- Abaddon scans the workspace for sensitive files with overly permissive access rights (e.g., 644) and flags them for remediation.
- The agent performs a memory injection scan to look for malicious attempts within the agent's long-term memory files.
- A comprehensive technical report is generated, a letter grade is assigned based on the severity of findings, and critical alerts are dispatched via Telegram.
Abaddon Setup
Step 1: Integrate the Red Team Prompt
Append the Abaddon security logic to your existing observer agent or create a standalone agent:
# For Gideon/Observer agents
cat skills/abaddon/templates/abaddon-prompt.md >> ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md
# For standalone setup
cp skills/abaddon/templates/abaddon-prompt.md ~/.openclaw/workspace/agents/abaddon/AGENT_PROMPT.md
Step 2: Configure Automation
Enable the nightly 3:45 AM audit schedule:
bash skills/abaddon/setup/cron-seed.sh
Step 3: Secure the Playbook
Ensure your security detection logic is not readable by other processes:
chmod 600 ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md
Abaddon Data Schema & Taxonomy
Abaddon organizes its audit logs and metadata within the OpenClaw memory hierarchy for easy retrieval and tracking.
| Data Type | Location / Format | Description |
|---|---|---|
| Technical Reports | memory/audits/abaddon-YYYY-MM-DD.md |
Detailed evidence and remediation steps. |
| Real-time Alerts | Telegram / JSON | Critical findings pushed to configured messaging topics. |
| Permission Baseline | openclaw.json / File System |
Enforced 444 or 600 permissions on sensitive manifests. |
| Grading Schema | A (Secure) to F (Compromised) | Standardized scoring based on Critical/High vulnerability counts. |
Abaddon Advanced Features
- Nightly automated execution synchronized with standard defensive audits.
- Direct Telegram integration for immediate DM alerts on CRITICAL security findings.
- Memory injection scanning to detect sophisticated prompt injection attempts.
- Deep integration with Openclaw Skills ecosystem for cross-agent permission hardening.
- Extensible check-list for monitoring specific developer tools like Homebrew, Ollama, and npm.
SKILL.md
Loading
Related Openclaw Skills
Typeform API Skill
A professional integration for AI agents to retrieve Typeform data, including form structures, responses, and completion insights via direct API calls.
Go Mode — Autonomous Goal Execution
Go Mode is an autonomous execution framework that transforms high-level goals into actionable, multi-step plans with built-in human oversight.
Wealth Builder
Wealth Builder is a comprehensive personal finance and investment engine designed to help users build, protect, and grow wealth through structured planning and disciplined execution.
Smart Fetch
Smart Fetch is a high-performance web ingestion tool designed to deliver token-efficient, markdown-optimized content directly to AI agents while enforcing strict safety and size constraints.
AI Cost Estimator
A comprehensive framework for calculating the total cost of ownership for AI agent deployments, including hidden engineering and maintenance expenses.
System Architecture Engine
A senior systems architect agent designed to guide developers through structured software design, evaluation, and evolution using data-driven frameworks instead of vibes.
Featured*
