An automated security and privacy auditing skill that performs deep SAST analysis to identify vulnerabilities and PII leaks in codebases.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install securityreview
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install securityreview using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Shield: SAST & Privacy Auditor?
Security Shield is a professional-grade security analysis tool designed for AI agents to conduct Static Application Security Testing (SAST). Acting as a senior security engineer, this skill meticulously scans repositories for modern vulnerabilities, ranging from hardcoded secrets to complex LLM-specific safety risks. It follows a strict Fail Securely principle, ensuring that all external inputs are treated as malicious until validated and sanitized.
By integrating this skill into your Openclaw Skills library, developers can automate the detection of broken access control, injection flaws, and privacy violations. The tool is engineered to provide high-fidelity reporting, minimizing false positives by focusing exclusively on executable code and direct evidence, ensuring that every finding is actionable and impactful for the engineering team.
Security Shield: SAST & Privacy Auditor Use Cases
- Automated security reviews of new code submissions or pull requests to detect vulnerabilities early.
- Identifying hardcoded API keys, secrets, or database credentials before they are committed to version control.
- Conducting privacy taint analysis to prevent PII leakage to system logs or unauthorized third-party APIs.
- Detecting injection vulnerabilities including SQLi, XSS, SSRF, and Command Injection in web applications.
- Auditing LLM prompt construction to prevent prompt injection and insecure handling of model outputs.
How Security Shield: SAST & Privacy Auditor Works
- The skill initializes a read-only investigation of the repository structure using optimized CLI tools like grep and ls.
- It methodically scans source files against a comprehensive internal knowledge base of SAST vulnerabilities and insecure patterns.
- A privacy taint analysis is performed to trace sensitive data from sources (e.g., user input, DBs) to insecure sinks like logs or external SDKs.
- Identified issues are passed through a rigorous five-point high-fidelity filter to ensure they are actionable and present in executable code.
- A detailed security report is generated, categorized by severity (Critical to Low) with clear remediation steps.
- The findings are stored in the .shield_security directory and presented directly in the chat interface for immediate developer review.
Security Shield: SAST & Privacy Auditor Setup
To activate this skill within your Openclaw Skills environment, no complex installation is required. Ensure your agent has permission to execute read-only CLI commands.
# Trigger a comprehensive security scan of your current workspace
/security:full-analyze
The skill will automatically create a .shield_security/ directory in your project root to store persistent audit artifacts and historical reports.
Security Shield: SAST & Privacy Auditor Data Schema & Taxonomy
The skill organizes its findings using a structured taxonomy to ensure clarity and compliance:
| Component | Description |
|---|---|
| .shield_security/ | Dedicated workspace directory for storing vulnerability reports and scan metadata. |
| Vulnerability Report | A detailed breakdown containing vulnerability name, type, severity, and exact source/sink locations. |
| Privacy Taint Map | A logical map tracing PII (emails, tokens) from entry points to potential exposure sinks. |
| Severity Rubric | A standardized assessment matrix (Critical, High, Medium, Low) based on exploit impact and complexity. |
Security Shield: SAST & Privacy Auditor Advanced Features
- Automated LLM Safety Auditing: Specialized checks for prompt injection and unsafe execution of LLM-generated code.
- High-Fidelity Signal Filtering: A mandatory 5-point checklist system designed to eliminate false positives and noise.
- Privacy Taint Analysis: Advanced tracking of Personally Identifiable Information (PII) across complex variable assignments.
- Artifact Persistence: Local storage of security findings within the workspace for long-term compliance and remediation tracking.
- Framework-Specific Detection: Targeted rules for modern stacks, including React dangerouslySetInnerHTML and Node.js child_process monitoring.
SKILL.md
Loading
Related Openclaw Skills
Parakeet MLX
A high-performance command-line tool for private, local speech-to-text transcription optimized for Apple Silicon.
EvoAgentX Workflow Integration
A powerful bridge connecting the EvoAgentX framework to Openclaw Skills for creating agentic workflows that automatically improve through evolutionary optimization.
Jira Integration for AI Agents
Seamlessly manage Jira issues, transitions, and worklogs through a powerful CLI-driven interface.
Google Workspace BYoK
A secure, developer-centric integration for managing Google Calendar and Gmail using private Google Cloud Platform credentials across multiple accounts.
Security Analysis
A professional security auditing tool designed to identify vulnerabilities, instruction injections, and data exfiltration risks within codebases and agent configurations.
ClawdBites: Instagram Recipe Extractor
A sophisticated extraction engine that converts Instagram reels into structured recipes using caption parsing, local audio transcription, and vision analysis.
Featured*
