xfire leverages multiple AI agents in an adversarial debate to find and verify security vulnerabilities in your codebase.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install xfire-security-review
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install xfire-security-review using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is xfire - Multi-Agent Adversarial Security Review?
xfire is a sophisticated security auditing tool designed to eliminate blind spots by employing a multi-agent adversarial approach. By sending code to three distinct AI models—Claude, Codex, and Gemini—it ensures independent findings that are then rigorously cross-examined through a prosecution, defense, and judge pipeline. This process filters out false positives and ensures that only the most critical, verified vulnerabilities make it into the final report.
As one of the most robust Openclaw Skills available, xfire transforms how developers approach automated security reviews. It goes beyond simple pattern matching by using large language models to understand intent, trust boundaries, and complex logic flaws that traditional static analysis tools often miss.
xfire - Multi-Agent Adversarial Security Review Use Cases
- Automated security reviews of GitHub Pull Requests to prevent vulnerabilities from reaching production.
- Deep audits of entire codebases to identify hidden architectural security flaws.
- Analyzing local diffs or staged changes immediately before committing code.
- Integrating security gates into CI/CD pipelines using SARIF output for GitHub Code Scanning.
- Threat modeling new features by inferring intent and identifying potential attack vectors.
How xfire - Multi-Agent Adversarial Security Review Works
- Context Building: The tool parses the target code, repository history, and dependencies to create a comprehensive analysis context.
- Intent Inference: A fast AI model identifies the repository's core purpose and security boundaries to guide the deeper audit.
- Independent Review: Multiple agents (Claude, Codex, Gemini) perform parallel, independent security audits of the provided context.
- Adversarial Debate: Every potential finding is debated through a structured prosecution and defense phase to test its validity.
- Verdict: A judge agent issues a final ruling on the validity and severity of each finding.
- Reporting: Findings are deduplicated and exported in Markdown, JSON, or SARIF formats for human review or automated ingestion.
xfire - Multi-Agent Adversarial Security Review Setup
To begin using this skill, ensure you have Python 3.11+ installed and then follow these steps:
# Install the package
pip install xfire
# Initialize configuration in your current repository
xfire init
# Configure your AI agent credentials
xfire auth login --provider claude
# Test connectivity to the AI models
xfire test-llm
xfire - Multi-Agent Adversarial Security Review Data Schema & Taxonomy
xfire organizes its analysis using structured configuration files and persistent data stores to maintain context across Openclaw Skills workflows:
| Component | Description |
|---|---|
| .xfire/config.yaml | Primary configuration for agent roles, sensitive paths, and severity gates. |
| XFIRE_CACHE_DIR | Directory for storing repository context and intent persistence to speed up subsequent scans. |
| XFIRE_AUTH_PATH | Secure store for agent credentials and authentication tokens. |
| SARIF / JSON Reports | Standardized output including CWE mappings, severity levels, and confidence scores. |
xfire - Multi-Agent Adversarial Security Review Advanced Features
- Adversarial debate logic that utilizes a Prosecution-Defense-Judge pipeline to minimize false positives.
- Repository baselining to provide AI agents with a deep understanding of the application's architecture and security controls.
- Baseline-aware incremental scanning that focuses only on changes made since the last successful security audit.
- Multi-model reasoning support, allowing the system to use high-reasoning models for complex logic analysis.
- Extensive CI/CD support with native GitHub Actions integration and SARIF formatted results for automated security dashboards.
SKILL.md
Loading
Related Openclaw Skills
1Password
A secure automation skill for managing 1Password CLI operations and secret injection within AI agent workflows.
Agent Address Protocol (AAP)
A standardized messaging and discovery protocol that allows AI agents to communicate, collaborate on tasks, and share information across different providers.
Playwright Commander
An advanced browser automation skill providing programmatic control over web interfaces using the Playwright framework.
Anemone Browser
A managed headful Chrome browser solution designed for Openclaw agents to bypass bot detection through VNC takeover and session isolation.
Grupo Venus
A technical integration for AI agents to retrieve, parse, and interpret astrological data from the Grupo Venus platform.
LWS: Lightweight Wallet Signer CLI
A minimal, offline-first CLI tool for cross-chain wallet generation and message signing across EVM, Solana, Bitcoin, and more.
Featured*
