An essential security hardening and vulnerability scanning skill designed to protect codebases, servers, and databases against OWASP Top 10 risks and data compliance failures.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-plus
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-plus using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Plus?
Security Plus is a comprehensive, production-grade security enhancement skill designed to secure applications from development to deployment. By integrating this intelligence into your development workflow, you ensure complete alignment with OWASP Top 10 (2021) guidelines, automatic secrets detection, and compliance readiness for standards like GDPR, HIPAA, and SOC2.
This extension empowers developers and automated agents to shift security left. It provides built-in reference configurations, automated vulnerability scanning (SAST/DAST), dependency checks, and actionable guides to harden servers, applications, and database configurations. By using Openclaw Skills like Security Plus, teams can enforce robust defense-in-depth strategies and prevent costly security misconfigurations before code reaches production.
Security Plus Use Cases
- Mitigating OWASP Top 10 risks (such as SQL Injection, Broken Access Control, and SSRF) in modern web applications.
- Integrating automated Static (SAST) and Dynamic (DAST) Application Security Testing tools like Semgrep, Bandit, and OWASP ZAP into developer workflows.
- Scanning codebases for hardcoded credentials, API keys, or private certificates to prevent security leaks.
- Hardening production infrastructure, databases, and application header configurations using industry-vetted checklists.
- Preparing application architecture and data handling processes for strict compliance audits including GDPR, HIPAA, and SOC2.
How Security Plus Works
- Analyze Security Context: The skill scans the active environment, identifying technologies, frameworks, and deployment setups requiring protection.
- Run Vulnerability Scans: Executes targeted SAST, DAST, and dependency analysis using integrated tools like Snyk, Semgrep, and npm audit to detect vulnerabilities early.
- Detect Secret Leaks: Monitors commits and files using pre-commit hooks and scanning utilities (e.g., gitleaks, detect-secrets) to capture exposed credentials.
- Apply Hardening Guides: Provides context-aware configurations for server, application, and database hardening (such as setting up HTTP headers and SSH keys).
- Evaluate Compliance & Checklists: Steps through compliance frameworks (GDPR/HIPAA/SOC2) and the development checklist to ensure secure software delivery.
Security Plus Setup
Prerequisites
Install scanning tools globally or within your project environment. Below are commands to configure the primary scanners:
# Install Python-based scanners
pip install bandit safety pre-commit detect-secrets
# Install Snyk CLI and Node security auditors
npm install -g snyk
Configure Pre-Commit Hooks for Secrets Detection
Add the following configuration to your .pre-commit-config.yaml to prevent secret leaks during commits:
repos:
- repo: https://github.com/Yelp/detect-secrets
rev: v1.4.0
hooks:
- id: detect-secrets
args: ['--baseline', '.secrets.baseline']
Initialize the pre-commit configuration:
pre-commit install
detect-secrets scan > .secrets.baseline
Security Plus Data Schema & Taxonomy
The Security Plus framework categorizes security vulnerabilities, mitigations, and compliance tasks systematically. This structure organizes tools and rules across the development lifecycle:
| Category | Core Focus | Supported Tools / Specifications |
|---|---|---|
| SAST | Code scanning & pattern matching | Semgrep, Bandit, SonarQube |
| DAST | Dynamic runtime testing | OWASP ZAP, Nikto |
| Dependency Scanning | Open-source vulnerabilities | Snyk, npm audit, safety, bundler-audit |
| Secrets Detection | Preventing token and key exposure | gitleaks, detect-secrets, truffleHog |
| Infrastructure (IaC) | Container and IaC scanning | Trivy, Clair, Checkov, tfsec |
| Hardening Guides | System and network security configurations | SSH keys, Firewalls, Security Headers, Database configs |
Security Plus Advanced Features
- Pre-commit Automation: Out-of-the-box support for detect-secrets and Yelp's pre-commit validation to block compromised commits.
- Multi-layered SAST/DAST Pipeline: Unified integration patterns for orchestrating static code scans alongside container/infrastructure scans via Trivy and Checkov.
- Multi-Framework Compliance Mapping: Direct mapping of security actions to industry compliance requirements such as GDPR, HIPAA, and SOC2.
- Robust RegEx Entropy Checkers: Standardized, production-tested regular expressions to instantly detect AWS keys, GitHub tokens, and private keys within Openclaw Skills integrations.
SKILL.md
Loading
Related Openclaw Skills
Weather Query
A fast and smart weather querying tool supporting multilingual inputs to retrieve global weather information for AI agents.
python-plus
An advanced development skill equipping AI agents with modern, asynchronous, type-safe, and highly optimized Python engineering capabilities.
Git Plus
An enhanced Git skill supporting advanced branching strategies, custom automated Git hooks, monorepo architectures, and robust CI/CD workflow integrations.
docker-plus
An advanced containerization extension delivering secured Docker templates, multi-stage build optimization, and battle-tested production blueprints.
Monitoring Plus
Monitoring Plus delivers an advanced, end-to-end observability suite featuring pre-configured Prometheus metrics, Grafana visualization dashboards, Loki log aggregation, and SLO/SLI tracking.
MCP Server Plus
MCP Server Plus is an advanced toolkit designed to streamline the creation, deployment, and monitoring of high-performance Model Context Protocol (MCP) servers.
Featured*
