An automated security scanner designed to prevent credential leaks and sensitive data exposure within Openclaw Skills development workflows.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install zero2ai-security-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install zero2ai-security-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Zero2AI Security Audit?
Zero2AI Security Audit is a specialized security utility for developers building and distributing Openclaw Skills. It functions as a critical gatekeeper for your codebase, scanning git commits, repositories, and skill directories to identify hardcoded secrets, API keys, tokens, and sensitive environment data.
By integrating this audit into your local development lifecycle, you can ensure that high-risk vulnerabilities—such as exposed AWS keys, private JWT blocks, or absolute file paths—are caught before they are ever committed or published. This tool is essential for maintaining professional security standards when contributing to the ecosystem of Openclaw Skills.
Zero2AI Security Audit Use Cases
- Scanning staged git changes to prevent accidental secret commits.
- Validating the last commit before pushing code to remote repositories.
- Performing a final security check before running clawhub publish to share Openclaw Skills.
- Auditing local directories for absolute user paths or committed node_modules that bloat packages.
How Zero2AI Security Audit Works
- The auditor is triggered via the scripts/audit.py command with specific flags for staged files, the last commit, or a directory path.
- The system scans the targeted files against a comprehensive pattern library for high, medium, and low-severity findings.
- It evaluates findings based on severity: High findings (like API keys) trigger an immediate hard block.
- The tool returns specific exit codes (0 for clean, 1 for findings) to allow for integration with git hooks or CI/CD pipelines.
- Developers use the feedback to rotate exposed secrets, move credentials to environment variables, and clean up directory paths.
Zero2AI Security Audit Setup
Navigate to your skill directory and use Python 3 to run the auditing script. Ensure you have the necessary permissions to execute scripts within your workspace.
# Audit only staged changes before committing
python3 scripts/audit.py --staged
# Audit a specific skill directory before publishing
python3 scripts/audit.py /path/to/your/skill
Zero2AI Security Audit Data Schema & Taxonomy
The audit tool categorizes findings into a three-tier severity system to help developers prioritize fixes for their Openclaw Skills:
| Severity | Detection Patterns | Required Action |
|---|---|---|
| HIGH | API keys, passwords, JWT tokens, AWS/WooCommerce keys, .env files | Hard block; rotate secret immediately. |
| MEDIUM | Absolute home/root paths, committed node_modules | Fix before publishing; use relative paths. |
| LOW | Hardcoded IP addresses, long base64 strings | Manual review and investigation. |
Zero2AI Security Audit Advanced Features
- Automated pre-publish checklist verification for Openclaw Skills.
- Support for git-state awareness including --staged and --last-commit flags.
- Detailed exit code mapping for integration into automated deployment scripts.
- Pattern-based detection for a wide range of provider-specific credentials including TikTok Dev and AWS IAM.
SKILL.md
Loading
Related Openclaw Skills
Video Caption Overlay
A professional Python-based utility to render animated, pill-style captions onto short-form videos using MoviePy and PIL.
Veo 3 Video Generation
A sophisticated CLI-based tool for generating, polling, and stitching AI-generated video segments using Google Veo 3 models via the Gemini API.
AI UGC Video Pipeline
A comprehensive AI-driven workflow that transforms product descriptions into polished UGC video ads with talking heads and cinematic B-roll.
skill-tiktok-ads-video
A Python-based automation tool for generating TikTok-style short-form videos with animated pill captions and product presets.
USDC Escrow
A trustless USDC escrow framework enabling secure agent-to-agent payments and automated dispute resolution on the Base network.
ZeroDust Chain Exit
A powerful utility to sweep 100% of native gas tokens from EIP-7702 compatible chains, leaving exactly zero balance.
Featured*
