An automated security tool that scans API route handlers to generate middleware-ready RBAC permission configurations.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install permission-auditor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install permission-auditor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Permission Auditor?
Permission Auditor is a specialized utility designed to bridge the gap between backend development and security implementation. It automatically analyzes your route handlers and endpoint definitions to map out your application's complete permission surface. By leveraging this tool, developers can quickly generate role-based access control configurations that integrate directly into existing middleware, ensuring that every endpoint is properly protected without the need for manual mapping.
As part of the growing ecosystem of Openclaw Skills, this tool helps maintain a robust security posture throughout the development lifecycle. It identifies admin-only routes, public endpoints, and authentication requirements by scanning code patterns, providing a high-fidelity starting point for any permission-based security strategy.
Permission Auditor Use Cases
- Retrofitting RBAC onto an existing API codebase that lacks a formal permission system.
- Auditing current routes to identify endpoints that are missing essential authentication checks.
- Accelerating the development of new microservices by auto-generating security boilerplate.
- Standardizing permission configurations across multiple projects within an enterprise organization.
How Permission Auditor Works
- The tool initiates a scan of your specified route files or controller directories to extract endpoint definitions.
- It identifies the associated HTTP methods and existing authentication middleware logic.
- An AI-driven analysis engine interprets patterns in your code to suggest appropriate role assignments for each path.
- The tool outputs a structured RBAC configuration file that can be immediately consumed by your application's security middleware.
Permission Auditor Setup
To use this tool, ensure you have Node.js 18 or higher installed on your system. No permanent installation is required; you can run it instantly using npx.
npx ai-permission <path-to-routes>
For a typical project structure, you might use:
npx ai-permission src/routes/
Permission Auditor Data Schema & Taxonomy
The Permission Auditor organizes its findings into a clear structure that maps your code to security roles. The output generally follows this logical taxonomy:
| Field | Description |
|---|---|
| Route Path | The identified endpoint URL or regex pattern. |
| HTTP Method | The verb (GET, POST, DELETE, etc.) used by the endpoint. |
| Assigned Role | The suggested RBAC role (e.g., admin, user, public) required for access. |
| Auth Status | A flag indicating whether an authentication check was detected in the source. |
This schema allows Openclaw Skills to provide actionable data that developers can pipe directly into configuration management systems.
Permission Auditor Advanced Features
- Support for glob patterns to target specific file structures like
**/*.controller.ts. - Automated detection of 'naked' routes that lack any form of authentication middleware.
- Intelligent role suggestion based on business logic and endpoint naming conventions.
- Middleware-ready JSON or YAML output for seamless integration with Express, NestJS, or Fastify.
- Zero-config execution for high-speed security audits during CI/CD or local development.
SKILL.md
Loading
Related Openclaw Skills
Performance Auditor
A powerful AI-driven performance auditing tool that generates prioritized code fixes for Lighthouse reports.
Onboard Generator
A CLI tool that scans your project to automatically generate comprehensive onboarding documentation for new developers.
Onboard Gen
Automate the creation of comprehensive developer onboarding documentation directly from your source code.
Script Generator (script-gen)
An AI-driven CLI tool that generates optimized and syntactically correct npm scripts for your package.json based on natural language descriptions.
Pitch Generator
Generate professional, structured startup pitch deck content instantly using AI.
Pitch Gen
A command-line utility that transforms startup ideas into comprehensive, investor-ready pitch deck content using AI.
Featured*
