A comprehensive security auditing tool designed to scan OpenClaw configurations for risks and apply guided hardening fixes.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install guomeiqing-security-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install guomeiqing-security-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is OpenClaw Security Audit and Hardening?
The OpenClaw Security Hardening skill is an expert-level security auditor for your AI agent environment. It systematically analyzes configuration files to identify vulnerabilities in direct messaging policies, gateway exposure, and tool permissions. By evaluating seven critical security vectors, it provides a transparent risk score and actionable remediation paths to protect your system from unauthorized access and prompt injection attacks.
This skill ensures that Openclaw Skills users can maintain high productivity without sacrificing system integrity. It offers three distinct hardening levels—Basic, Standard, and Strict—allowing developers to balance ease of use with robust defense mechanisms tailored to their specific deployment environment, whether local or public-facing.
OpenClaw Security Audit and Hardening Use Cases
- Periodic security health checks for AI agent configurations.
- Hardening a new OpenClaw installation before connecting to public channels.
- Restricting tool permissions to follow the principle of least privilege.
- Auditing file system permissions for sensitive configuration files containing API keys.
- Mitigating risks of prompt injection by verifying model security levels.
How OpenClaw Security Audit and Hardening Works
- The skill reads the central configuration file usually located at ~/.openclaw/openclaw.json and checks file system metadata.
- It performs a 7-point audit covering DM policies, gateway auth, group chat safety, tool profiles, sandbox modes, file permissions, and model robustness.
- A detailed security report is generated, assigning a score out of 100 based on PASS, WARN, or FAIL status for each category.
- Users are presented with three hardening options (Basic, Standard, Strict) based on their specific risk tolerance.
- Upon user confirmation, the skill backs up the configuration and applies precise edits to the JSON file.
- The service is restarted, and a final validation scan is performed to compare the security posture before and after hardening.
OpenClaw Security Audit and Hardening Setup
To initialize the security audit within your environment, ensure you have the Openclaw Skills framework installed and use the following commands:
# Trigger a security scan
openclaw security check
# Or use the audit command
openclaw security audit
Ensure the skill has read/write access to your .openclaw directory to perform file permission checks and configuration updates.
OpenClaw Security Audit and Hardening Data Schema & Taxonomy
The skill interacts primarily with the standard OpenClaw configuration schema. It classifies data according to the following logic:
| Feature | JSON Path | Security Goal |
|---|---|---|
| DM Policy | channels.*.dmPolicy |
Restrict unauthorized private interactions. |
| Gateway Bind | gateway.bind |
Prevent external network exposure. |
| Tool Profiles | agents.list[].tools.profile |
Enforce least privilege for execution tools. |
| Sandbox | agents.defaults.sandbox |
Isolate execution environments. |
| Permissions | stat -c '%a' |
Secure API keys and sensitive credentials. |
OpenClaw Security Audit and Hardening Advanced Features
- Multi-level hardening strategies (Basic to Strict) to match different deployment needs.
- Automated configuration backup system before any hardening execution.
- JSON integrity validation using Node.js after configuration edits.
- Contextual risk assessment linking DM policies with tool execution permissions.
- Support for multi-language triggers including Chinese and English security commands.
SKILL.md
Loading
Related Openclaw Skills
AILove Assistant
An AI dating assistant that manages proxy chats, tracks matchmaking progress, and relays deep questions between humans and candidates.
EchoTik TikTok New Product Rank
Identify trending new products across 16 TikTok Shop regional markets using daily ranking data from EchoTik.
AILove AI Dating Assistant
An AI-powered dating assistant that automates match tracking, proxy-chat summaries, and question relaying for human users.
Image Gen Cheap
A highly efficient and cost-effective AI image generation and editing tool powered by the Laozhang API, costing as little as $0.01 per image.
Safe Install Skill
A comprehensive security auditing tool designed to vet, verify, and safely deploy third-party skills within the Openclaw environment.
Amazon Review Scraper (Reveyes)
A powerful automated tool to bulk scrape Amazon product reviews, star distributions, and critical feedback summaries across 20 global marketplaces.
Featured*
