A comprehensive security scanner designed to identify vulnerabilities, exposed secrets, and risky file permissions in Openclaw Skills projects.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-sentinel
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-sentinel using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Sentinel?
Security Sentinel acts as a proactive defense layer for developers working with Openclaw Skills. It automates the tedious task of checking for known vulnerabilities in third-party dependencies while simultaneously hunting for hardcoded credentials that could lead to data breaches. By integrating this skill, teams can maintain a high security posture without manually auditing every file or dependency update.
The tool is specifically designed to fit into the modern developer workflow, providing immediate feedback on the security health of the workspace. It ensures that common pitfalls, such as world-writable environment files or outdated packages, are caught before they can be exploited in a production or shared environment.
Security Sentinel Use Cases
- Pre-deployment security audits for Openclaw Skills to prevent accidental data leaks.
- Identifying hardcoded API keys, Feishu app secrets, or private keys before pushing code to version control.
- Checking for critical vulnerabilities in Node.js dependencies during the development lifecycle.
- Verifying file system permissions for sensitive configuration files like .env and package.json to ensure local security.
How Security Sentinel Works
- Initiates an npm audit to evaluate the dependency tree against known CVE databases to find vulnerable packages.
- Recursively scans workspace files using sophisticated regex patterns to find potential secrets, passwords, and private keys.
- Inspects file system metadata to ensure sensitive files are not world-writable, preventing unauthorized local access or modifications.
- Compiles all findings into a structured report and exits with a status code 1 if any high-risk issues are identified.
Security Sentinel Setup
To integrate this security tool into your project, ensure you are in the root directory of your Openclaw Skills workspace and run the following command:
node skills/security-sentinel/index.js
You can also include it as a module in your own scripts to automate security checks programmatically by importing the sentinel scanner directly into your JavaScript logic.
Security Sentinel Data Schema & Taxonomy
The skill organizes its findings into a structured report. Below is the metadata taxonomy for the scan results:
| Property | Description |
|---|---|
| status | Indicates if risks were detected (e.g., 'risk_detected') |
| vulnerabilities | A list of dependency issues identified by npm audit |
| secrets | Specific file paths and line matches for detected credentials |
| permissions | Files found with insecure (world-writable) permission settings |
The report excludes paths like node_modules, .git, and .openclaw/cache by default to ensure focus on project-specific source code.
Security Sentinel Advanced Features
- Custom scan control using the --skip-audit flag to bypass dependency checks when speed is prioritized over depth.
- Integration-ready exit codes that allow the skill to break CI/CD pipelines if high-risk issues are found.
- The --no-fail option for monitoring use cases where reporting is required without stopping the execution flow of Openclaw Skills.
- Programmatic API support allowing other agents to trigger security scans and react to results dynamically within a complex workflow.
SKILL.md
Loading
Related Openclaw Skills
Read Optimizer
A high-performance file reading utility designed to minimize token consumption through targeted sampling and pattern matching.
Quote Generator
A utility for injecting inspirational or technical quotes into agent responses and logs to enhance personality.
QR Code Generator
A versatile utility to transform text and URLs into scan-ready QR codes for mobile devices and terminal interfaces.
Innovation Catalyst
Analyzes AI system states to identify performance plateaus and generate strategic proposals for continuous evolution.
Linear Todos
A sophisticated CLI tool for managing Linear tasks through natural language commands and automated priority scheduling.
Semver Helper
A comprehensive guide and decision tool for implementing Semantic Versioning 2.0.0 in software projects.
METADATA
Featured*
