A comprehensive multi-layered security audit system designed to prevent credential leaks and detect vulnerabilities before they reach your public repositories.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install pre-publish-security
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install pre-publish-security using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Pre-Publish Security Protocol?
The Pre-Publish Security Protocol is a robust security framework for developers who need to ensure their releases are free from sensitive data and security flaws. As a vital addition to the Openclaw Skills library, this tool provides automated scanning for GitHub and ClawHub releases, focusing on preventing the accidental exposure of PATs, API keys, and passwords. It integrates directly into your development workflow to catch issues that standard linters might miss.
This skill is particularly valuable for maintaining the integrity of open-source projects by providing a tiered approach to security. From instantaneous pre-push checks to deep historical audits, it ensures that your git history remains clean and your dependencies are secure against known CVEs.
Pre-Publish Security Protocol Use Cases
- Individual developers wanting to prevent accidental credential leaks in public repositories.
- Open-source project maintainers protecting their codebase from contributor mistakes.
- Teams publishing Openclaw Skills who need to validate technical specifications before release.
- Security auditors performing comprehensive repository reviews and vulnerability assessments.
- CI/CD pipelines requiring automated security gating based on severity levels.
How Pre-Publish Security Protocol Works
- The user installs the pre-push hook which triggers a quick scan on every push attempt.
- The system evaluates the current state using the audit-state.json file to determine if a history or dependency scan is overdue.
- Scripts scan for a wide array of patterns including secrets, documentation placeholders, and missing mandatory files like LICENSE or README.
- Vulnerability scanners like npm audit or safety check for dependency-level security risks.
- The system assigns a severity level from CRITICAL to LOW to all findings and blocks the push if critical issues are discovered.
- A detailed Markdown report is generated with actionable steps for remediation.
Pre-Publish Security Protocol Setup
To integrate this security protocol into your project, follow these steps:
- Install the necessary system dependencies:
sudo apt install jq
- Navigate to your repository and install the pre-push hook to ensure protection through Openclaw Skills:
./install-hooks.sh /path/to/your/repo
- Run an initial deep history scan to ensure no past secrets are exposed:
./audit-full.sh /path/to/repo history
- (Optional) Add a weekly scheduled scan to your cron manager:
openclaw cron add --name "weekly-repo-scan" --cron "0 3 * * 1" --message "Run schedule.sh"
Pre-Publish Security Protocol Data Schema & Taxonomy
The Pre-Publish Security Protocol manages security data through specific files and metadata to maintain high-quality Openclaw Skills standards:
| File | Purpose |
|---|---|
| audit-state.json | Tracks scan timestamps, cumulative counts, and severity findings. |
| AUDIT-SCHEDULE.md | Defines the frequency and rules for different scan types (Quick, History, Dependency). |
| agents/ | Reserved for future sub-agent definitions for specialized security tasks. |
| Exit Codes | 0 for success, 1 for CRITICAL (blocks push), 2 for HIGH (requires review). |
Pre-Publish Security Protocol Advanced Features
- Smart Frequency Management: State tracking automatically avoids redundant scans by monitoring when checks last ran.
- Severity-Based Gatekeeping: Configurable exit codes allow for granular control over what blocks a deployment versus what only issues a warning.
- Dependency CVE Scanning: Weekly automated checks for npm and Python vulnerabilities to keep the Openclaw Skills ecosystem secure.
- Automated Fix Reports: Generates actionable Markdown reports to help developers remediate issues instantly.
- Historical Audit: Deep-dives into deleted git commits to ensure secrets are purged from the entire repository history.
SKILL.md
Loading
Related Openclaw Skills
SageMaker
A sophisticated memory and growth operating system designed to give AI agents consistent layered memory and self-driven evolution patterns.
Discord Context
A technical utility that enables AI agents to bypass session-based visibility limits by fetching Discord channel and thread history directly via the Discord Bot API.
Skill Composer
A powerful workflow orchestrator that chains multiple Openclaw Skills into single-command automated processes using YAML configurations.
Baidu Web Search
A professional-grade web search skill for Openclaw Skills that provides AI agents with real-time internet access via the Baidu Qianfan API.
Silicon World
A decentralized virtual world where AI agents and humans coexist, featuring verifiable identity, social interaction, and a tokenized economy.
Spec Steering Workflow
A lightweight workflow system for managing multi-phase, interruptible AI agent tasks with robust state recovery.
Featured*
