A proactive security auditing tool designed to detect and remediate critical vulnerabilities in OpenClaw deployments before they are exposed to the network.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install firm-security-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install firm-security-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Firm Security Audit?
Firm Security Audit serves as a mandatory security gate for developers using Openclaw Skills. It specifically targets and resolves high-severity gaps such as SQL injection vulnerabilities, improper sandbox configurations, and ephemeral session secrets. By integrating this skill, users can harden their Gateway installations without needing to modify upstream source code, ensuring a robust and compliant AI agent environment.
Firm Security Audit Use Cases
- Validating security posture before enabling Tailscale Funnel or public network exposure.
- Automated security gating within CI/CD pipelines to block vulnerable deployments.
- Routine auditing of existing agent configurations to ensure persistent session security and rate limiting compliance.
- Generating remediation templates for Nginx, Caddy, and Docker Compose configurations.
How Firm Security Audit Works
- The skill initiates a sandbox audit to verify that non-main agent sessions are properly isolated via Docker.
- It performs a targeted security scan on API endpoints to identify potential SQL injection paths.
- Configuration checks are executed to ensure session secrets are persistent and not regenerated on every restart.
- It validates the presence of rate limiting on the WebSocket Gateway, especially when external funnels are active.
- If critical findings are detected, it automatically generates a digest and dispatches alerts to configured communication channels like Slack.
Firm Security Audit Setup
To integrate this security layer into your Openclaw Skills workspace, run the following command:
openclaw skill install firm-security-audit
Ensure that mcp-openclaw-extensions version 2.0.0 or higher is installed. You must also provide the paths to your config.yaml and .env files within the tool arguments to allow the audit engine to parse your local environment settings.
Firm Security Audit Data Schema & Taxonomy
The skill organizes its findings and remediation data into structured logs and templates:
| Data Type | Format | Storage/Usage |
|---|---|---|
| Audit Results | JSON | Logged to docs/security-audits/ for compliance tracking |
| Remediation Snippets | YAML / Nginx | Provided in-line for quick fixes to config.yaml or proxy configs |
| Severity Metadata | String | Categorized as CRITICAL, HIGH, or MEDIUM for automated escalation |
| Alert Payloads | JSON | Sent to Slack via firm_export_slack_digest |
Firm Security Audit Advanced Features
- Automated CI/CD integration using the
--fail-onflag to block builds with CRITICAL vulnerabilities. - Tailscale Funnel sensitivity: triggers aggressive rate limiting requirements when public exposure is detected.
- Dynamic remediation template generation for various reverse proxies (Nginx/Caddy).
- Multi-path scanning for deep analysis of API directory structures within Openclaw Skills deployments.
SKILL.md
Loading
Related Openclaw Skills
firm-saas-pack
A comprehensive bundle of AI-agent configurations designed to power the full lifecycle of SaaS companies from engineering to growth.
Firm Runtime Audit Pack
A comprehensive security auditing suite for validating OpenClaw runtime environments and configurations.
Firm Reliability Pack
A comprehensive reliability suite for gateway health monitoring, documentation synchronization, and architecture decision tracking.
Firm Prompt Security Pack
A specialized detection engine that scans LLM inputs for 16 distinct prompt injection and jailbreak patterns across multiple severity levels.
firm-skill-loader-pack
A specialized utility pack for on-demand skill discovery and lazy loading within the Openclaw ecosystem.
MCP Specification Compliance Audit Pack
A comprehensive suite of seven specialized audit tools designed to validate AI agent compliance with the MCP 2025-11-25 protocol specification.
Featured*
