A local cloud infrastructure and Infrastructure-as-Code (IaC) security scanner that identifies misconfigurations and compliance gaps across multiple cloud providers.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install cloudguard
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install cloudguard using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is CloudGuard?
CloudGuard is a robust security tool designed to scan codebases for insecure cloud infrastructure patterns. By leveraging up to 90 specialized regex-based patterns, it detects critical vulnerabilities such as open S3 buckets, overly permissive IAM policies, and missing encryption at rest. As a key component of the Openclaw Skills ecosystem, it provides developers with a privacy-focused solution that runs 100% locally with zero telemetry, ensuring your sensitive infrastructure definitions never leave your machine.
The tool categorizes findings into severity-graded reports, offering actionable remediation steps for every identified issue. Whether you are working with Terraform, CloudFormation, Kubernetes manifests, or Dockerfiles, CloudGuard helps teams maintain high security standards by grading infrastructure with a score from 0 to 100. This ensures that only compliant and secure code reaches your production environment.
CloudGuard Use Cases
- Scan Terraform and CloudFormation files for security misconfigurations before deployment.
- Identify publicly accessible S3 buckets and insecure bucket policies in your infrastructure code.
- Audit IAM roles for wildcard permissions and violations of the principle of least privilege.
- Check Kubernetes manifests and Dockerfiles for exposed ports and security best practices.
- Automate cloud security audits within CI/CD pipelines using structured JSON output.
How CloudGuard Works
- The user initiates a scan on a specific file or directory via the Openclaw Skills command interface.
- The engine automatically discovers Infrastructure-as-Code (IaC) and configuration files, excluding non-relevant directories like node_modules.
- Security patterns are applied to the code based on the user's license tier, checking for 30 to 90 distinct security risks.
- The scanner calculates a cloud security score and assigns a letter grade (A through F) based on finding severity.
- Detailed output is generated, mapping each finding to a file name, line number, and specific remediation advice.
CloudGuard Setup
To get started with CloudGuard in your Openclaw Skills environment, ensure you have the required dependencies installed. CloudGuard requires git, bash, python3, and jq to function.
# Install the git hooks manager dependency
brew install lefthook
# Run a one-shot cloud security scan
bash "$SKILL_DIR/scripts/dispatcher.sh" --path .
To unlock Pro or Team tier features, add your license key to the configuration file located at ~/.openclaw/openclaw.json.
CloudGuard Data Schema & Taxonomy
CloudGuard organizes its security audits into six core categories, providing a granular view of your cloud security posture.
| Category | Code | Focus Area |
|---|---|---|
| Storage Security | S3 | S3 bucket privacy, encryption, and versioning |
| IAM & Permissions | IM | Policy wildcards, MFA, and root usage |
| Network Security | NW | Security groups, VPC configurations, and exposed ports |
| Encryption | EN | Encryption at rest, KMS rotation, and SSL/TLS |
| Logging & Monitoring | LG | CloudTrail, VPC Flow Logs, and audit trails |
| Configuration | CF | Tagging, naming conventions, and resource hygiene |
Findings include a Check ID, severity level (Critical, High, Medium, Low), and a point deduction value that impacts the final security score.
CloudGuard Advanced Features
- Local git pre-commit hook integration via lefthook to block insecure infrastructure changes before they are committed.
- Comprehensive reporting capabilities with support for Markdown, HTML, and JSON output formats.
- Category-filtered scanning allowing teams to focus on specific domains like Network or Storage security.
- Offline license validation ensures that your security auditing workflow remains private and functional without internet access.
- Flexible CI/CD integration with exit codes that trigger build failures if security scores fall below a configurable threshold.
SKILL.md
Loading
Related Openclaw Skills
ConcurrencyGuard
A robust concurrency safety analyzer that detects race conditions, deadlocks, and async pitfalls across multiple languages using 90+ specialized patterns.
AI Interview Coach
An AI-powered preparation assistant that conducts mock interviews and generates targeted practice questions based on your resume.
LogSift
LogSift is a high-speed command-line tool designed to filter massive log files by keywords or specific timeframes effortlessly.
ContainerLint
ContainerLint is a local security scanner that detects Dockerfile issues, missing health checks, and orchestration anti-patterns using 90 specialized patterns.
File Organizer by Extension
A lightweight CLI tool that automatically sorts files into subdirectories based on their file extensions.
File Sorter by Extension
Automatically organizes files in a directory into extension-based folders to maintain clean and structured file systems.
Featured*
