An automated security audit and workspace hardening suite designed to protect AI agents from credential leaks, PII exposure, and prompt injection attacks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-hardening
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-hardening using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Hardening?
Security Hardening is a specialized skill set designed to implement defense-in-depth principles directly within an AI agent's workspace. By leveraging this tool within the Openclaw Skills ecosystem, developers can ensure their agents operate within strict security boundaries, preventing the accidental exposure of API keys, tokens, and personally identifiable information.
The skill synthesizes best practices in cybersecurity to transform a standard agent into a security-aware assistant. It moves beyond simple scanning by providing actionable remediation reports and hardening configuration files like AGENTS.md and SOUL.md with permanent security standing orders.
Security Hardening Use Cases
- Detecting leaked API keys, GitHub tokens, and private SSH keys within workspace files.
- Auditing configuration files for sensitive PII such as names, emails, and physical addresses before public sharing.
- Hardening agent instructions to mitigate the risk of prompt injection and social engineering attacks.
- Implementing automated periodic security checkups via heartbeat or cron integrations.
How Security Hardening Works
- The agent performs a Credential Scan using optimized regex patterns to identify secrets like 'sk-...' or 'ghp_...' across all workspace files.
- A Privacy Audit is executed to locate PII that should be replaced with placeholders or moved to private memory zones.
- Config Hardening updates core agent files with a Security Standing Order to prevent unauthorized external data disclosure.
- Prompt Injection Review analyzes instructions for vulnerable patterns, adding boundaries to ignore embedded commands in external content.
- A File Exposure Review checks the .gitignore and cloud sync settings to ensure sensitive directories aren't unintentionally public.
- A Remediation Report is generated in the memory directory, detailing findings by severity (Critical, High, Warning) with specific fix steps.
Security Hardening Setup
To begin securing your workspace, deliver the skill instructions to your agent and run an initial audit. You can manually check for credentials using the following command:
grep -rn -E "(sk-[a-zA-Z0-9]{20,}|AKIA[A-Z0-9]{16}|ghp_[a-zA-Z0-9]{36}|xoxb-|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----)" .
Ensure your AGENTS.md is updated with a Security Standing Order block to establish permanent safety boundaries.
Security Hardening Data Schema & Taxonomy
The skill organizes its security findings and configuration updates as follows:
| Data Component | Format | Purpose |
|---|---|---|
memory/security-audit-{{DATE}}.md |
Markdown | Stores comprehensive audit logs, findings, and remediation status. |
AGENTS.md |
Markdown | Updated with security directives and external action policies. |
HEARTBEAT.md |
Markdown | Used to schedule recurring security scans (e.g., every 7 days). |
Custom Patterns |
YAML | Optional configuration for organization-specific secret detection. |
Security Hardening Advanced Features
- Heartbeat Integration: Automate your security posture with weekly recurring audits scheduled in the agent's heartbeat file.
- Multi-Mode Enforcement: Choose between Strict, Standard, or Relaxed modes depending on the agent's level of external access.
- Pre-publish Gates: Integrate security checks into your deployment workflow to scan files before they are pushed to GitHub or ClawHub.
- Custom Pattern Support: Define proprietary regex patterns to detect internal project codenames or specific corporate credential formats.
SKILL.md
Loading
Related Openclaw Skills
Project Tracker
An automated system for tracking multiple projects with status dashboards, milestone monitoring, and intelligent stalled-project detection.
Memory OS (Persistent AI Agent Memory)
A complete persistent memory system that eliminates context amnesia by giving AI agents long-term recall, identity files, and daily logs.
Inbox Triage
A professional email management skill for AI agents that scans inboxes, categorizes messages by urgency, and prepares draft replies using CLI-based email tools.
Content Calendar
A structured AI-driven system to plan, schedule, and track content pipelines across newsletters, blogs, and social media without spreadsheet chaos.
Solopreneur Assistant
An AI-powered Chief of Staff designed to handle operational overhead, revenue tracking, and strategic decision-making for solo business owners.
CodeSmith
A senior-level engineering mentor package for Openclaw Skills that automates full-stack development, CI/CD pipelines, and GitHub workflows.
Featured*
