A comprehensive security scanner that audits HTTP response headers and information leaks to help harden web server configurations.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install http-sec-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install http-sec-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is HTTP Security Audit?
The HTTP Security Audit skill is a specialized diagnostic tool designed for Openclaw Skills to evaluate the defensive posture of any web application. It performs a deep inspection of HTTP response headers to identify missing or misconfigured security controls that could lead to clickjacking, cross-site scripting (XSS), or protocol downgrade attacks.
Beyond basic header validation, this skill acts as a reconnaissance prevention tool by detecting information leaks such as Server and X-Powered-By headers. It provides developers and security engineers with a standardized grading system, transforming raw header data into an actionable security report that highlights high-priority vulnerabilities like HSTS and CSP omissions.
HTTP Security Audit Use Cases
- Auditing a website's security posture to comply with industry best practices.
- Hardening a web server configuration by identifying missing defense-in-depth headers.
- Checking HSTS, CSP, and X-Frame-Options compliance during the CI/CD pipeline.
- Detecting information leaks such as technology stack versions in HTTP responses.
- Batch auditing multiple production URLs for consistent security policy application.
How HTTP Security Audit Works
- The user provides one or more target URLs to the Openclaw Skills execution environment.
- The skill initiates a secure HTTP request to the target server, capturing all returned response headers.
- The engine parses the headers against a set of 10 predefined security standards, ranging from HSTS to Cross-Origin policies.
- A scoring algorithm calculates a numerical value based on the severity of missing headers (e.g., HIGH for HSTS/CSP).
- The system checks for metadata leakage in framework-specific headers like X-AspNet-Version.
- A final report is generated, assigning a letter grade (A–F) and providing a breakdown of recommended fixes.
HTTP Security Audit Setup
First, ensure you have the required Python library installed:
pip install requests
To run a basic audit using Openclaw Skills, use the following command structure:
python3 scripts/sec_headers.py https://example.comn```
HTTP Security Audit Data Schema & Taxonomy
The skill processes header metadata and can output results in human-readable or machine-readable formats:
| Data Point | Description | Severity Impact |
|---|---|---|
| HSTS / CSP | Critical transport and content security policies | HIGH |
| X-Frame / X-Content | UI Redressing and MIME-sniffing protection | MEDIUM |
| Info Leaks | Disclosure of Server or X-Powered-By versions | RECONNAISSANCE |
Users can use the --json flag to receive a structured object containing the raw score, grade, and individual header status for programmatic integration.
HTTP Security Audit Advanced Features
- Bulk Auditing: Pass multiple URLs simultaneously for rapid cross-domain security assessments.
- Programmatic JSON Output: Seamlessly integrate security grades into automated monitoring tools or dashboards.
- Custom Timeouts: Adjust the
--timeoutparameter to handle slow-responding legacy servers or firewalled environments. - Detailed Info-Leak Detection: Specifically targets and flags software version disclosures to reduce the attack surface.
SKILL.md
Loading
Related Openclaw Skills
Return Rate Reducer
A specialized AI analyst skill designed to identify return patterns and provide actionable product page fixes to reduce e-commerce refund rates.
Git Commit Helper
An intelligent AI assistant that generates standardized Git commit messages and PR descriptions following the Conventional Commits specification.
Alibaba Cloud AI Audio LiveTranslate
A specialized skill for integrating Alibaba Cloud Model Studio Qwen LiveTranslate models into real-time speech-to-speech and speech-to-text translation pipelines.
GIS Coordinate Transformer
A professional-grade GIS utility for batch converting GeoJSON coordinates between geographic (WGS84) and projected (Web Mercator) coordinate systems.
Professional Knowledge Extraction Skill
A sophisticated knowledge extraction engine that transforms unstructured professional text into multi-layered, interactive knowledge graphs.
Quick Translation Skill
A high-performance AI translation tool supporting over 100 languages with advanced terminology recognition and style customization.
Featured*
