A comprehensive security auditing toolkit for scanning codebases, infrastructure, and agentic AI systems for vulnerabilities and misconfigurations.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install agentic-security-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install agentic-security-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Audit Skill?
The Security Audit skill is an essential utility for developers and security engineers working within Openclaw Skills environments. It provides a dual-layered approach to security, addressing both traditional software vulnerabilities and the emerging threats unique to AI agents. By combining dependency scanning, secret detection, and static analysis with specialized AI safety checks, it ensures a hardened development lifecycle.
This skill automates the identification of high-risk patterns such as SQL injection, hardcoded API keys, and insecure file permissions. Furthermore, it incorporates advanced protections based on the latest research, including the OWASP Agentic Top 10, to defend against prompt injection, memory poisoning, and identity hijacking in multi-agent systems.
Security Audit Skill Use Cases
- Scanning project dependencies for known vulnerabilities in Node.js, Python, Go, and Rust.
- Detecting hardcoded secrets, AWS keys, and private credentials across source code and git history.
- Reviewing code for OWASP Top 10 vulnerabilities like XSS, CSRF, and command injection.
- Auditing AI agent workspace configurations and identity verification mechanisms.
- Scanning agent-facing content for prompt injection vectors and steganographic characters.
- Verifying SSL/TLS configurations and certificate chains for production endpoints.
How Security Audit Skill Works
- The skill identifies the project environment and language to select the appropriate auditing tools like npm audit or pip-audit.
- It performs a recursive filesystem scan using optimized regex patterns to locate leaked secrets and sensitive config files.
- Static analysis is executed on source code to find dangerous coding patterns and insecure library usage.
- It audits the agentic workspace, checking the permissions and integrity of critical files like SOUL.md and MEMORY.md.
- The tool verifies infrastructure security by testing SSL/TLS endpoints and auditing system file permissions.
- A detailed security report is generated, classifying issues by severity and providing clear remediation steps.
Security Audit Skill Setup
To deploy this skill within Openclaw Skills, ensure your environment has the required binaries. Install the core auditing tools using the following commands:
# Install dependency auditors
pip install pip-audit safety
# Install universal scanner
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
To run a comprehensive check, use the provided audit scripts:
# Execute standard security audit
bash security-audit.sh ./your-project
# Execute agentic-specific security audit
bash agentic-security-audit.sh ./agent-workspace
Security Audit Skill Data Schema & Taxonomy
The Security Audit skill organizes its findings and metadata to provide clear visibility into the security posture of Openclaw Skills projects.
| Category | Monitored Data | Audit Method |
|---|---|---|
| Dependencies | package-lock.json, requirements.txt, go.sum | Language-specific vuln-checkers |
| Secrets | .env, .pem, .key, Git History | Regex-based pattern matching |
| Agent Safety | SOUL.md, MEMORY.md, AGENTS.md | OWASP Agentic Top 10 Checklist |
| Infrastructure | SSL Certs, File Permissions | OpenSSL and stat-based verification |
| Code Patterns | Source code files (.js, .py, .go) | Static Analysis (Grep/AST) |
Security Audit Skill Advanced Features
- Deep Git History Scanning: Identify secrets that were deleted from the current commit but remain in the repository history.
- Agentic Prompt Injection Detection: Advanced heuristic scanning for jailbreak patterns and instruction override vectors.
- Zero-Width Character Detection: Spot hidden Unicode characters used in steganographic prompt injection attacks.
- Anti-Gaslighting Rules: Specialized configuration checks to prevent agents from succumbing to malicious user pressure.
- Automated Pre-commit Hooks: Integration scripts to block the commitment of sensitive data before it leaves the local machine.
- Semantic Reframing Analysis: Logic to detect if an agent is likely to leak PII through content-based evaluation bypasses.
SKILL.md
Loading
Related Openclaw Skills
Response Speed Test
A high-precision performance monitoring tool that provides millisecond-level measurement of the AI agent response lifecycle.
VT Sentinel Security Plugin
Integrate real-time VirusTotal malware scanning and threat protection into your AI agent workflow.
Quality-Driven Development
A sophisticated development methodology skill that enforces TDD, DDD, and the TRUST 5 quality framework to produce production-ready code.
OpenClaw Server Security & Hardening
A professional-grade security framework for hardening Linux servers and deploying protected OpenClaw agent instances.
Bazi Chart Generator
A specialized tool for generating traditional Chinese Bazi charts and 10-step Great Luck cycles based on birth data.
Yao Liu Yao Divination
A digital implementation of the traditional Chinese Liu Yao divination method for generating and interpreting hexagrams.
Featured*
