OpenClaw Security Handbook (CN)
v1.0.0基于 ZAST.AI 安全手册的 OpenClaw 安全审计与加固技能。运行全面安全诊断（内置 audit + 手册补充项），生成结构化报告，提供交互式修复引导，支持定时审计调度。触发场景：安全审计、安全加固、漏洞检查、security audit、hardening、暴露检查。
⭐ 0· 35·0 current·0 all-time
by@ruijh
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual behavior: it runs `openclaw security audit --json`, parses results, performs local checks under ~/.openclaw, and offers remediation guidance. The files included (report generator and checklist/fix docs) are consistent with a security handbook/diagnostic skill.
Instruction Scope
The SKILL.md and scripts instruct the agent to read many local files (configs, sessions, logs, memory, installed skills), run local network/port checks, and inspect a sandbox docker container. This is expected for a security audit, but these actions will access potentially sensitive data (API keys, session logs, MEMORY.md). The skill emphasizes user confirmation before destructive changes, which is appropriate.
Install Mechanism
No install spec; instruction-only skill with two helper scripts. Nothing is downloaded or written by an automated installer. The publish script calls packaging/publishing tools on-demand and prompts for confirmation.
Credentials
The skill declares no required env vars or credentials, and its checks operate on local OpenClaw files only (proportional). One caution: the provided fix examples include commands that append tokens to ~/.openclaw/.env (echo >>), which would store secrets in plaintext if used; the docs also advise not to write plaintext, a slight contradiction that the user should review before running.
Persistence & Privilege
always:false and no system-wide modifications by default. Some recommended manual remediation steps (chattr, iptables, rm -rf, revoking keys) require elevated privileges or are destructive, but SKILL.md states these need explicit user confirmation.
Assessment
This skill is internally consistent for performing a local OpenClaw security audit, but it will read sensitive local files (logs, session files, MEMORY.md, installed skill sources) to look for secrets and risky code. Before running: 1) ensure you trust the skill and run it on a machine where exposing those files to the agent is acceptable (prefer a disposable VM); 2) review the included scripts and the commands in references/fix-commands.md — especially any commands that write tokens to ~/.openclaw/.env or delete directories; 3) do not blindly accept automatic fixes for operations that modify tokens/configs or remove files — back up before applying fixes; 4) the publish script will attempt to package/publish only if you run it and confirm. If you want minimal risk, run the audit commands manually and inspect the generated JSON/report rather than allowing automated fix actions.Like a lobster shell, security has layers — review code before you run it.
latestvk9779zvzpgz94x3m3at4kn6k6s841jkq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.