Firm Gateway Hardening Pack

Gateway authentication hardening and credentials audit pack. Validates device auth, Baileys credentials, webhook HMAC signatures, log configuration, and work...

Security Scan

The skill's purpose (gateway hardening) matches its instructions at a high level, but it relies on external tooling (mcp-openclaw-extensions) without an install spec, doesn't declare the config paths or credentials it will read, and comes from an unknown source — these inconsistencies warrant caution.

Purpose & Capability

The name/description describe gateway hardening and the SKILL.md lists five audit tools that fit that purpose. However, the SKILL.md enumerates CLI commands (openclaw_gateway_auth_check, openclaw_credentials_check, etc.) but the skill's manifest does not declare any required binaries or config paths. The metadata does list a dependency on mcp-openclaw-extensions >= 3.0.0 which likely provides those commands — that is plausible, but the relationship is not made explicit in install instructions.

Instruction Scope

Runtime instructions ask the agent to run the named checks against a user-supplied config_path (e.g., /path/to/config.json). The SKILL.md does not enumerate what files, directories, or environment variables those tools will access, nor does it limit the paths. Because the checks target credentials, webhook HMACs, and workspace integrity, the tools will likely read secrets or sensitive config data. The instructions are high-level and give the agent broad discretion to run these tools against arbitrary files, which expands the attack surface if the underlying tooling is untrusted.

Install Mechanism

This is an instruction-only skill with no install spec and no code files. The metadata 'requires' mcp-openclaw-extensions >= 3.0.0 but no mechanism is provided to obtain or verify that dependency. That is reasonable for an instruction-only wrapper if the environment already provides the extension, but it creates supply-chain uncertainty: it's unclear how/where mcp-openclaw-extensions will be installed or validated.

Credentials

The skill performs credential and webhook signature audits but declares no required environment variables or config paths. Tools that audit Baileys credentials and webhook HMACs typically need access to secret keys or credential files; the absence of declared secrets/config paths is disproportionate and leaves it unclear what the agent will access at runtime. This mismatch means sensitive data could be read without being explicitly requested in the manifest.

Persistence & Privilege

The skill does not request always:true and is user-invocable only. Model invocation is not disabled (default) but that is normal. The skill does not request system-wide config changes or persistent privileges in its manifest.

What to consider before installing

This pack broadly matches its stated goal (gateway hardening) but has several red flags you should consider before installing or running it: (1) Source and homepage are missing — you cannot verify the author or review code. (2) It depends on mcp-openclaw-extensions but provides no install or verification steps for that dependency — confirm the origin and integrity of that package. (3) The SKILL.md tells the agent to run tools against a config_path you supply, but the manifest doesn't declare which files or secrets the tools will read; expect the tools to access credential files and webhook secrets. (4) Run these checks in a safe/test environment first and inspect the underlying tool implementations (mcp-openclaw-extensions or the binaries that provide the named commands) before using them on production configs. Providing the skill author, source repository, or a verifiable install mechanism (and a list of exact config paths or env vars the tools will read) would increase confidence; without that, treat the skill as untrusted and proceed cautiously.

⚠️ Contenu généré par IA — validation humaine requise avant utilisation.

Purpose

Hardens the OpenClaw Gateway by auditing authentication configuration, credentials storage, webhook signatures, logging, and workspace file integrity.

Tools (5)

Tool	Description	Severity
openclaw_gateway_auth_check	Validate Gateway device auth is enabled	CRITICAL
openclaw_credentials_check	Audit Baileys credentials storage security	HIGH
openclaw_webhook_sig_check	Verify HMAC signature on webhooks	HIGH
openclaw_log_config_check	Check log configuration (no sensitive data)	MEDIUM
openclaw_workspace_integrity_check	Verify workspace file integrity	MEDIUM

Usage

skills:
  - firm-gateway-hardening-pack

# Run full gateway hardening audit:
openclaw_gateway_auth_check config_path=/path/to/config.json
openclaw_credentials_check config_path=/path/to/config.json
openclaw_webhook_sig_check config_path=/path/to/config.json

Requirements

• mcp-openclaw-extensions >= 3.0.0