ClawVitals is a security health check skill that scans Openclaw installations to identify vulnerabilities and provide a scored safety report.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawvitals
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawvitals using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawVitals?
ClawVitals provides a critical security layer for self-hosted Openclaw installations by evaluating 9 scored stable controls and 6 experimental controls. It acts as a point-in-time auditor that scores your setup, assigns a RAG (Red, Amber, Green) status, and delivers precise remediation steps for any discovered vulnerabilities.
Built with privacy and efficiency in mind, this Openclaw Skills contribution is completely stateless and makes no direct network calls. It focuses on high-impact security areas such as gateway authentication, command-denylist effectiveness, and channel health, ensuring your AI agent operates within a hardened environment.
ClawVitals Use Cases
- Running an instant security audit on a new Openclaw installation to ensure best practices.
- Verifying that messaging channels like iMessage, Slack, or Telegram are correctly configured and healthy.
- Identifying open groups or unauthenticated gateways that could expose your system to unauthorized commands.
- Checking if your Openclaw version or Node.js runtime is outdated and requires security updates.
How ClawVitals Works
- Data Collection: The skill executes local CLI commands to gather security audits, health status, and version data.
- Control Evaluation: It analyzes the extracted JSON data against defined security controls (e.g., checking for short gateway tokens or exposed groups).
- Scoring: Based on the severity of findings (Critical, High, Medium, Low), it calculates a security score out of 100.
- Report Generation: It produces a formatted summary table including the RAG status and specific remediation advice.
- Deep Dive: Users can request a detailed report for full technical context and direct links to fix documentation.
ClawVitals Setup
To use ClawVitals, ensure you have Openclaw version 2026.3.0 or higher installed. This skill requires the Openclaw and Node.js binaries to be present in your environment.
Install the skill and run a scan immediately using your preferred messaging interface:
# Trigger a security scan
run clawvitals
# View the full detailed report with remediation steps
show clawvitals details
ClawVitals Data Schema & Taxonomy
ClawVitals organizes its findings into a structured report format. It focuses on the following data taxonomy:
| Data Component | Source Command | Extracted Fields |
|---|---|---|
| Security Audit | openclaw security audit |
findings[].checkId, findings[].detail |
| Health Check | openclaw health |
configured, probe.ok, probe.error, cliPath |
| Versions | openclaw --version, node --version |
Version strings and major version numbers |
| Update Status | openclaw update status |
availability.hasRegistryUpdate, latestVersion |
All data is processed in-memory and is not persisted locally or remotely by the skill.
ClawVitals Advanced Features
- Point-in-Time Auditing: Instant security posture snapshots without complex configuration.
- Stateless Execution: Ensures no scan history or sensitive credentials are stored, maintaining high privacy standards.
- Experimental Control Monitoring: Includes early-access checks for multi-user signals and dependency integrity.
- Automated Remediation Guidance: Provides direct links to clawvitals.io documentation for every failed security control.
- RAG Banding: Visual status indicators (Red/Amber/Green) for immediate assessment of installation safety.
SKILL.md
Loading
Related Openclaw Skills
Soul Generator
A sophisticated tool for generating custom AI persona configurations through celebrity distillation, personality typing, or manual descriptions.
Code Agent Orchestration
A professional orchestration layer for managing background AI coding sessions with advanced lifecycle control and worktree management.
Threads Automation Suite (threads-skills)
A professional automation toolkit for the Threads platform powered by Chrome CDP and Python.
MX Stocks Screener
An AI-powered financial screening tool that uses natural language to filter global stocks, funds, and bonds using the Eastmoney Miaoxiang database.
Bonds
Bonds is a localized CLI tool for managing fixed-income portfolios, tracking yields, and generating detailed financial reports.
Compliance
A security toolkit for logging, tracking, and exporting compliance-related activities with timestamped audit trails.
METADATA
Featured*
