A comprehensive security auditing extension that scans code, configurations, and AI operations for vulnerabilities and logic flaws.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-review
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-review using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Review?
The Security Review extension for Openclaw Skills provides a robust, automated layer of defense for modern development workflows. It goes beyond simple linting by analyzing code against the OWASP Top 10, auditing cloud configurations for secret leaks, and evaluating the safety of AI-specific interactions. By integrating this skill, developers can ensure that every commit and configuration change is scrutinized for security risks.
This skill is particularly valuable for teams working with sensitive data, cryptocurrency assets, or AI-driven systems. It bridges the gap between development and security operations, offering actionable insights that help prevent common attacks like SQL injection, cross-site scripting, and unauthorized access before they reach production.
Security Review Use Cases
- Scanning source code for OWASP Top 10 vulnerabilities during the development cycle.
- Auditing environment variables and wrangler.toml files for hardcoded secrets or insecure production modes.
- Monitoring DeFi operations and smart contract interactions for rugpull risks and flash loan attacks.
- Protecting AI agents from prompt injection, system prompt leakage, and instruction-override attacks.
How Security Review Works
- The skill remains active in the background, monitoring for security-related keywords or specific file modifications.
- When a trigger is detected, such as a change to authentication logic or API endpoints, the skill initiates a review.
- Users can specify the intensity level: Quick (pattern matching), Standard (OWASP compliance), or Deep (attacker-perspective analysis).
- The engine performs a multi-layered scan covering code integrity, cryptographic security, and AI prompt safety.
- A structured JSON or Markdown report is generated, categorizing findings by severity from Critical to Info.
Security Review Setup
To enable security auditing in your environment, install the skill via the CLI:
openclaw install security-review
Ensure that your workspace includes relevant configuration files (like package.json or Dockerfile) so the Openclaw Skills engine can accurately assess your environment context.
Security Review Data Schema & Taxonomy
The skill generates a detailed security report organized into the following schema:
| Section | Data Points |
|---|---|
| Summary | Critical, High, Medium, Low, and Info counts |
| Findings | Severity, Category, Title, Description, Location (File/Line), Recommendation |
| Recommendations | Prioritized list of mitigation steps based on threat level |
| Metadata | Review level (Quick/Standard/Deep) and timestamp |
Security Review Advanced Features
- Auto-triggering on sensitive file changes including Dockerfile, package.json, and environment variables.
- Integration with moltbook-security for specialized prompt injection and role-change attack defense.
- Real-time wallet security monitoring when used alongside metamask-wallet integrations.
- Deep Review mode for verifying complex business logic vulnerabilities and composite attack scenarios.
SKILL.md
Loading
Related Openclaw Skills
Secret Rotator
A secure security utility designed to inventory, analyze the age of, and provide rotation workflows for API keys and environment secrets.
Rey Screenshot
An autonomous screenshot and visual capture engine designed for AI agents to create documentation and social media content effortlessly.
Screen Recorder
A powerful CLI-based screen recording utility for X11 and Wayland environments powered by ffmpeg.
SaaS Builder
A comprehensive framework for planning, developing, and launching Micro-SaaS products focused on niche markets and recurring revenue.
AI Self-Identity Management
A framework for managing an AI agent's evolving personality and core values through exclusive human-led supervision.
Uptime Monitor
A lightweight, dependency-free tool for monitoring website availability, latency, and HTTP status codes using curl.
Featured*
