Audit OpenClaw Security
v2.0.1Audit and harden OpenClaw deployments and interpret `openclaw security audit` findings. Use when the user wants to secure OpenClaw, review gateway exposure/a...
⭐ 0· 822·2 current·2 all-time
byTristan Manchester@tristanmanchester
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included assets: SKILL.md, host/audit collection script, reporter, and redaction tool. No unrelated credentials, binaries, or external services are requested. The files and guidance align with an OpenClaw-focused security audit.
Instruction Scope
SKILL.md confines actions to diagnostics and read-only checks and instructs redaction before sharing. It supports two modes: assisted (user runs commands) and agent-run (Mode B) where the bundled scripts may be executed locally. The collection script intentionally avoids --fix operations and copying credential files, but it does read listings, run status probes, and stat the state/config file; these are expected for an audit but will reveal host metadata and config snippets. The script will attempt non-interactive sudo for some firewall commands (skips if not allowed).
Install Mechanism
No install step or remote downloads. The skill is instruction-first with bundled scripts (no external URLs). Running the scripts executes local commands but nothing in the bundle pulls external code or writes unexpected binaries to disk.
Credentials
No required environment variables or credentials are declared. The collector respects OPENCLAW_STATE_DIR if present (a reasonable convenience). The redaction utility explicitly tries to mask tokens and secrets before sharing. The env/config accesses are limited and relevant to OpenClaw auditing.
Persistence & Privilege
The skill is not always-enabled and does not request elevated long-term privileges. It does not modify other skills or global agent configs. Autonomous invocation is allowed (platform default) but not combined with broad credentials or persistence in this bundle.
Assessment
This bundle is coherent for performing an OpenClaw audit. Before using: 1) Confirm you own or have explicit permission to audit the target host (SKILL.md guardrail #1). 2) Prefer Mode A (ask the user to run commands) if you do not want the agent to execute local shell commands. 3) If you allow the agent to run Mode B, run it in a constrained environment (dedicated user/container) because the scripts collect host/network and OpenClaw state metadata. 4) Always review redacted outputs before sharing externally; the redact tool is best-effort and may miss edge cases. 5) Do not provide raw gateway tokens, API keys, or credential files — the skill explicitly discourages that.Like a lobster shell, security has layers — review code before you run it.
latestvk9776twzb0z5sxezv64qpq9ts982qs1h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.