A specialized security analyst skill for conducting automated SAST scans, manual code audits, and infrastructure security reviews within Openclaw Skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install pentest
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install pentest using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is security-reviewer?
The security-reviewer skill functions as a senior security analyst integrated into your development workflow. Built for the Openclaw Skills ecosystem, it specializes in identifying vulnerabilities through a combination of automated SAST tools and rigorous manual inspection. This skill is designed to find deep-seated logic flaws, authentication bypasses, and infrastructure misconfigurations that traditional scanners often miss.
By leveraging this skill, teams can implement proactive DevSecOps practices. It doesn't just find bugs; it provides a comprehensive security posture assessment by analyzing code, dependencies, and cloud configurations. Whether you are preparing for a compliance audit or hardening a new feature, this skill ensures your security standards remain high without slowing down the development process.
security-reviewer Use Cases
- Performing automated SAST scans and dependency vulnerability checks in CI/CD pipelines.
- Conducting deep-dive manual reviews of sensitive authentication and authorization modules.
- Scanning repositories for hardcoded secrets and sensitive credentials using Openclaw Skills.
- Auditing cloud infrastructure and container configurations for security best practices.
- Generating structured security reports with severity ratings and remediation guidance for stakeholders.
How security-reviewer Works
- The security-reviewer identifies the attack surface and critical paths within the project scope.
- It initiates automated scans using specialized tools for the specific language and framework.
- A manual review is conducted to analyze complex business logic, input handling, and cryptographic implementations.
- Vulnerabilities are validated through authorized active testing to ensure accuracy and reduce false positives.
- Each finding is categorized by severity (Critical, High, Medium, Low) using industry-standard metrics.
- The skill generates a comprehensive report within Openclaw Skills, detailing the location, impact, and remediation steps for every issue found.
security-reviewer Setup
To deploy the security-reviewer skill, ensure your environment has access to standard security CLI tools. You can initialize the skill through your Openclaw Skills manager:
# Install security dependencies (example for Python and JS)
pip install bandit
npm install -g eslint-plugin-security gitleaks
# Enable the skill in your configuration
openclaw add security-reviewer
security-reviewer Data Schema & Taxonomy
The security-reviewer skill structures its output into a standardized report format to ensure consistency across Openclaw Skills. Data is organized as follows:
| Component | Description |
|---|---|
| Executive Summary | High-level risk assessment and security posture overview. |
| Findings Table | A list of all identified issues with severity counts. |
| Finding Details | Granular data including file path, line number, impact, and proof of concept. |
| Remediation Plan | Actionable, prioritized steps to resolve each vulnerability. |
| Reference Map | Mapping of findings to OWASP Top 10, CWE, and compliance standards. |
security-reviewer Advanced Features
- Multi-tool orchestration involving Semgrep, Bandit, Gitleaks, and Trivy for full-stack coverage.
- Automated remediation suggestions that can be passed to other Openclaw Skills for instant patching.
- Support for custom security rulesets tailored to specific organizational compliance needs.
- Integration with cloud security hubs to audit AWS, Azure, and GCP infrastructure directly.
- Advanced reconnaissance and surface area mapping for penetration testing scenarios.
SKILL.md
Loading
Related Openclaw Skills
Pair Trade Screener
A professional statistical arbitrage tool for identifying cointegrated stock pairs and generating market-neutral trading signals through rigorous mathematical analysis.
Options Strategy Advisor
A comprehensive analytical tool for simulating options trading strategies and calculating Greeks using the Black-Scholes model.
MCP Builder
A comprehensive development workflow for building, testing, and evaluating high-quality Model Context Protocol (MCP) servers.
Market News Analyst
A professional-grade skill for analyzing financial news and quantifying its impact on global equity and commodity markets.
Portfolio Manager
A sophisticated investment management skill that integrates with Alpaca to provide real-time portfolio auditing, risk assessment, and rebalancing logic.
React Expert
A senior frontend specialist designed to architect and implement production-grade React 19 applications with TypeScript and modern state patterns.
Featured*
