A comprehensive security auditing toolkit designed to protect AI agent configurations from prototype pollution, secret leaks, and unauthorized execution plans.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install firm-advanced-security-pack
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install firm-advanced-security-pack using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Firm Advanced Security Pack?
The Firm Advanced Security Pack is a professional-grade security suite designed for developers using Openclaw Skills who need to harden their agent environments. This pack focuses on deep-level auditing of configuration files, addressing critical vulnerabilities such as improper secrets lifecycle management, path canonicalization errors, and insecure hook routing.
By integrating these tools into your workflow, you can ensure that your AI agents operate within a secure perimeter. The pack provides specialized detection for prototype pollution and enforces safeBins profiles, making it an essential component for enterprise-level deployments where security and compliance are paramount.
Firm Advanced Security Pack Use Cases
- Auditing external secrets lifecycle to prevent credential leakage in production environments.
- Validating execution plan freezes to prevent unauthorized runtime modifications to agent behavior.
- Detecting and mitigating prototype pollution risks within complex configuration files.
- Enforcing safeBins profiles to strictly control which executables the agent can access.
- Performing group policy default audits to maintain security compliance across multiple agent instances.
How Firm Advanced Security Pack Works
- The security pack is initialized within the agent environment requiring mcp-openclaw-extensions version 3.0.0 or higher.
- Users invoke specific audit tools by passing the path to their target configuration file.
- The skill performs a deep scan of the configuration, checking for 8 distinct security markers including path canonicalization and hook session routing.
- It evaluates the configuration against group policy defaults and safeBins profiles to identify misconfigurations.
- The tools output detailed audit results, categorizing vulnerabilities by severity (Critical or High) to guide remediation efforts.
Firm Advanced Security Pack Setup
To use this skill, ensure your environment meets the extension requirements and add the pack to your configuration.
# Ensure you have the required extensions
npm install mcp-openclaw-extensions@latest
# Add to your Openclaw configuration
# skills:
# - firm-advanced-security-pack
You can then run specific audits via the CLI or agent interface.
Firm Advanced Security Pack Data Schema & Taxonomy
The skill analyzes configuration files and returns structured security reports based on the following parameters:
| Parameter | Description |
|---|---|
config_path |
The file system path to the configuration file being audited. |
severity |
The impact level of a finding (CRITICAL for secrets/exec-freeze, HIGH for others). |
check_type |
The specific security domain being validated (e.g., prototype, lifecycle, or routing). |
status |
The pass/fail result of the specific security check. |
Firm Advanced Security Pack Advanced Features
- Execution plan freeze validation to lock down agent logic and prevent prompt injection from altering workflows.
- Advanced
$includedirective guards to prevent recursive or insecure configuration file inclusion. - Specialized hook session routing checks for complex, multi-agent communication architectures.
- Automated prototype pollution detection for JSON-based configuration schemas.
SKILL.md
Loading
Related Openclaw Skills
Firm ACP Bridge
A high-availability bridge for the Agent Client Protocol (ACP) that ensures autonomous agent sessions remain functional after crashes and prevents workspace race conditions.
Firm A2A Bridge
A bridging skill that implements the A2A Protocol RC v1.0 to enable seamless communication and task management between OpenClaw agents.
Work Application Skill
A comprehensive career management tool for generating tailored CVs, scraping job listings, and tracking the entire application lifecycle.
Veille
A modular RSS aggregator for AI agents that fetches, deduplicates, and scores news articles using LLMs.
Firm Agent Orchestration Pack
An advanced orchestration toolkit for managing multi-agent teams using Directed Acyclic Graph (DAG) task execution and real-time status monitoring.
Firm Auth Compliance Pack
A comprehensive suite of 8 auditing tools designed to enforce OAuth 2.1 compliance, GDPR data residency, and decentralized identity for AI agents.
Featured*
