A comprehensive local security assessment tool designed to audit, score, and harden your setup against vulnerabilities.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install openclaw-security-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install openclaw-security-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Scanner?
The Security Scanner is a robust auditing utility built specifically for Openclaw Skills to ensure your AI agent environment remains secure and private. It performs deep inspections of configuration files, network exposure, and OS-level hardening without ever sending data over the network. By staying local-only, this skill provides developers with a trusted way to identify critical misconfigurations, weak credentials, and exposed ports that could compromise their setup.
This utility acts as a defensive layer for your local AI workflows, providing a clear grade for your security posture. It is designed for developers who prioritize data sovereignty and want to ensure their Openclaw Skills are running in a hardened environment that follows best practices for credential hygiene and agent safety.
Security Scanner Use Cases
- Hardening a fresh installation of Openclaw Skills against external network exposure.
- Auditing agent guardrails and safety constraints within RULES.md to prevent prompt injection or unintended file access.
- Identifying plaintext secrets or weak configuration permissions in local environments before deployment.
- Generating security compliance reports for self-hosted agent installations to track setup health.
How Security Scanner Works
- Initialize the scanner locally using the provided bash script within your environment.
- The script performs a multi-point inspection of configuration files, network interfaces, and system permissions.
- Findings are categorized by severity levels ranging from CRITICAL and WARNING to PASS and INFO.
- A final security score out of 100 is generated to provide a quick assessment of the installation's posture.
- Users can optionally apply the fix flag to automatically resolve common security issues identified during the scan.
Security Scanner Setup
To begin securing your environment, navigate to the skill directory and execute the script. For a standard read-only assessment, use:
bash "$(dirname "$0")/oc-security-scan.sh"
To automatically remediate discovered issues, run:
bash "$(dirname "$0")/oc-security-scan.sh" --fix
To export findings for audit purposes or JSON-based monitoring:
bash "$(dirname "$0")/oc-security-scan.sh" --report
bash "$(dirname "$0")/oc-security-scan.sh" --json
Security Scanner Data Schema & Taxonomy
The scanner evaluates and produces data across several domains. Reports are structured to provide immediate visibility into risk levels and environmental health.
| Data Category | Checks Performed |
|---|---|
| Configuration | Bind address, token strength, config file permissions, execution security mode |
| Network Exposure | Listening ports, firewall status, public interface exposure |
| Credential Hygiene | Plaintext secrets detection, file permissions, .gitignore patterns |
| OS Hardening | Disk encryption, auto-updates, OS version, root usage |
| Agent Guardrails | RULES.md validation, memory file permissions, safety constraints |
Standard JSON output can be generated for integration with custom dashboards or log management systems.
Security Scanner Advanced Features
- Auto-remediation engine to fix configuration errors and permission issues instantly.
- JSON-formatted output for programmatic consumption and integration into DevSecOps pipelines.
- Comprehensive OS hardening checks including disk encryption and root usage audits.
- Zero-dependency architecture relying only on standard Unix tools and the core CLI.
- Integrated grading system (A-F grade) to track security improvements over time for Openclaw Skills installations.
SKILL.md
Loading
Related Openclaw Skills
ClawdHub CLI
A powerful command-line interface for the complete lifecycle management of Openclaw Skills, including discovery, installation, and publishing.
JK Archivist TikTok Skill
A text-to-slideshow engine for generating 6-slide portrait PNG assets and captions optimized for TikTok workflows.
Unit Economics
A specialized framework for calculating and optimizing the core financial health and customer profitability of solopreneur businesses.
Time Management
A tactical framework for solopreneurs to master their schedule, protect deep work, and optimize energy for maximum business growth.
CognitiveBullwhip
A diagnostic skill that identifies where small errors in AI agent systems amplify into cascading system failures.
Honcho Memory System
A production-grade memory pipeline that replaces standard embedding retrieval with reasoned, evolving understanding across multi-agent fleets.
Featured*
