An automated security scanner and remediation tool designed to secure Clawdbot deployments by identifying and fixing vulnerabilities.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Audit?
The Security Audit skill provides a robust framework for performing deep security inspections on your Clawdbot infrastructure. As a core component of the Openclaw Skills ecosystem, it scans for high-risk issues such as exposed API keys, insecure port configurations, and weak file permissions. It ensures your AI agents operate within a hardened environment by validating Docker setups and configuration files against modern security best practices.
By leveraging this tool, developers can identify vulnerabilities before they are exploited. The skill is designed to be lightweight, requiring no external dependencies while providing comprehensive coverage across multiple attack vectors, making it an essential addition to your collection of Openclaw Skills.
Security Audit Use Cases
- Running pre-deployment security checks to prevent credential leaks.
- Scheduling periodic audits to ensure ongoing compliance with security standards.
- Automatically remediating common configuration errors using the built-in fix mode.
- Auditing Docker container security to prevent root-level exploits and resource exhaustion.
- Generating detailed JSON reports for security documentation and team reviews within the Openclaw Skills workflow.
How Security Audit Works
- Initialize the audit process using the Node.js script provided in the Openclaw Skills directory.
- The skill scans the environment for hardcoded secrets, unprotected ports, and non-standard file permissions.
- A comprehensive vulnerability assessment is performed across Docker configurations and system settings.
- Issues are categorized by severity levels ranging from INFO to CRITICAL for prioritized remediation.
- If the auto-fix flag is utilized, the skill applies immediate patches to file permissions, .gitignore settings, and security headers.
Security Audit Setup
The Security Audit skill is ready to use out of the box with no external dependencies. To begin scanning your environment using these Openclaw Skills, run the following commands:
# Run a standard quick audit
node skills/security-audit/scripts/audit.cjs
# Perform a comprehensive full system scan
node skills/security-audit/scripts/audit.cjs --full
Security Audit Data Schema & Taxonomy
The audit skill organizes its findings into a structured report format. Results can be exported to JSON for integration with other tools in the Openclaw Skills suite. The output is categorized as follows:
| Level | Severity Impact | Examples |
|---|---|---|
| CRITICAL | Immediate Action | Exposed API keys, hardcoded secrets |
| HIGH | Significant Risk | Open ports, missing firewalls |
| MEDIUM | Moderate Concern | Weak password patterns, default configs |
| INFO | Informational | General security best practices |
Audit categories include:
- Credentials: Environment files, command history, and hardcoded tokens.
- Ports: Network services and firewall rules.
- Configs: Rate limiting, authentication, and CORS policies.
- Files: Permissions and sensitive file locations.
- Docker: Container privileges and resource limits.
Security Audit Advanced Features
- Automated remediation mode using the --fix flag to secure .env files and update file permissions automatically.
- Granular scanning targets allowing users to focus specifically on --credentials, --ports, or --docker containers.
- JSON output support for automated CI/CD pipeline integration and programmatic analysis of Openclaw Skills results.
- Comprehensive Docker security checks including privileged container detection and missing resource limit warnings.
SKILL.md
Loading
Related Openclaw Skills
Route Assistant
An intelligent travel route planning assistant that provides structured transport options, smart filtering, and time conflict detection using the Amap API.
WeChat Mini Program Developer Assistant
A comprehensive toolkit for WeChat Mini Program developers providing instant access to templates, API references, and troubleshooting guides.
CalDAV & Radicale Management
A comprehensive skill for programmatically managing CalDAV calendars, events, and Radicale server instances.
aaveclaw
A comprehensive DeFi skill for managing Aave V3 lending positions, including collateral deposits, stablecoin borrowing, and health factor monitoring on Base Sepolia.
Security Monitor
A real-time security watchdog that detects intrusions, unusual API activity, and credential patterns to protect Clawdbot deployments.
SAP FICO Expert
A specialized Openclaw Skills module that turns AI agents into senior SAP Finance and Controlling consultants for expert configuration and troubleshooting.
Featured*
