A local security auditing tool designed to harden Openclaw Skills against vulnerabilities, malware, and credential exposure.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install opena2a-security
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install opena2a-security using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is OpenA2A Security Hardening?
OpenA2A Security is a specialized tool for auditing and hardening OpenClaw installations. It provides a robust defense layer by scanning configurations, detecting known vulnerabilities like CVE-2026-25253, and auditing installed skills for malicious code patterns. Built by the OpenA2A team, this skill ensures that your automation environment remains secure without ever sending data to external APIs.
By integrating this into your workflow, you can proactively identify risks such as command injection, data exfiltration, and weak file permissions. It is an essential component for anyone managing sensitive Openclaw Skills who wants to maintain a high security posture through local, privacy-preserving scans that require no external API keys or third-party dependencies.
OpenA2A Security Hardening Use Cases
- Audit your OpenClaw installation for the high-severity CVE-2026-25253 WebSocket vulnerability.
- Scan newly installed Openclaw Skills for hidden malware, obfuscated code, or crypto mining scripts.
- Verify that your API keys and tokens are not stored in plaintext or exposed through world-readable permissions.
- Generate comprehensive security reports in HTML or JSON format to document compliance and hardening steps.
- Receive actionable recommendations for configuration changes to minimize the attack surface of your gateway.
How OpenA2A Security Hardening Works
- The skill utilizes the HackMyAgent engine to perform 47 specific security checks across your local environment.
- It analyzes the SKILL.md frontmatter and source code of your Openclaw Skills to detect dangerous patterns like eval() or unauthorized network calls.
- The tool audits your configuration files (config.json5) to ensure best practices like rate limiting and strong authentication are enabled.
- It checks the filesystem permissions of sensitive directories to prevent credential leaks and unauthorized access.
- Finally, it categorizes findings into severity levels (Critical to Low) and provides specific bash commands to remediate every identified risk.
OpenA2A Security Hardening Setup
To get started with OpenA2A Security for your Openclaw Skills, ensure you have Node.js and npx installed. This skill runs entirely on your local machine with no external network requirements.
# Run a full security audit of your installation
npx hackmyagent secure ~/.openclaw
# Scan a specific skill for vulnerabilities
npx hackmyagent scan --skill <skill-name>
# Check specifically for the WebSocket hijacking CVE
npx hackmyagent scan --cve ~/.openclaw
# Generate a detailed HTML security report
npx hackmyagent secure ~/.openclaw --format html --output security-report.html
OpenA2A Security Hardening Data Schema & Taxonomy
The skill organizes findings based on a structured taxonomy of risks. Results can be exported in multiple formats including text, JSON, SARIF, and HTML for easy integration into developer workflows.
| Category | Focus Area |
|---|---|
| Skill Security | Detects command injection, path traversal, and data exfiltration in Openclaw Skills code. |
| Credential Security | Identifies plaintext storage, weak permissions, and timing side-channels in auth. |
| Gateway Security | Audits WebSocket vulnerabilities (CVE-2026-25253) and SSRF risks. |
| Supply Chain | Checks for unpinned dependencies and malicious npm lifecycle scripts. |
OpenA2A Security Hardening Advanced Features
- Automated CVE-2026-25253 detection to prevent WebSocket hijacking and remote code execution.
- Deep scan capabilities for Openclaw Skills to identify obfuscated payloads and base64 encoded malicious strings.
- Support for SARIF output, allowing integration with professional static analysis (SAST) workflows and GitHub security tabs.
- Customizable auditing levels to prioritize critical configuration hardening over low-risk best practices.
- Built-in detection for ClawHavoc malicious patterns and supply chain attack vectors in third-party skills.
SKILL.md
Loading
Related Openclaw Skills
M365 Task Manager
A specialized tool for managing Microsoft 365 task workflows including Microsoft To Do and Planner via Microsoft Graph.
Chinese Memory Optimization (memory-cn)
A specialized optimization suite for OpenClaw to fix Chinese search indexing bugs and enhance long-term memory retrieval performance.
Game Quality Gates
A comprehensive framework of mandatory quality standards and checklists designed to eliminate cross-state bugs and optimize game performance across all platforms.
Debug Methodology
A rigorous, five-phase framework for AI agents to perform systematic root cause analysis and safe code deployment.
KarmaBank
A reputation-based credit system that allows AI agents to borrow USDC interest-free based on their Moltbook karma scores.
Config Guardian
A robust configuration safety tool that provides atomic updates, automated backups, and validation for OpenClaw environments.
Featured*
