SX-security-audit

What This Skill Does

The SX-security-audit skill is a comprehensive security tool designed for OpenClaw users to perform deep, multi-layered audits of their development and production environments. It acts as an automated security scanner that identifies vulnerabilities in file permissions, environment variables, dependencies, network configurations, and source code. By analyzing everything from Git security and Shell histories to macOS-specific system integrity (SIP, Gatekeeper), it provides actionable insights into your infrastructure's health.

The skill features a robust scanning engine that detects sensitive information like hardcoded API keys (AWS, Slack, OpenAI, etc.), insecure shell commands, and high-entropy strings. Furthermore, it integrates supply chain security by scanning project dependencies (via npm audit) and ensures configuration compliance with custom policies defined in .security-audit.json files. Detailed reports can be generated in JSON or Markdown and automatically dispatched to Feishu for team visibility.

Installation

To install this skill, run the following command in your terminal: clawhub install openclaw/skills/skills/13256659129/sx-security-audit-1-0-0

Use Cases

• Pre-deployment Check: Verify your repository for leaked secrets and insecure dependencies before pushing to production.
• System Hardening: Audit existing workspace permissions and network ports to ensure no services are unnecessarily exposed to the outside world.
• Incident Response: Quickly audit system variables and shell histories if you suspect an environment might be compromised.
• Continuous Monitoring: Schedule audits as part of your CI/CD pipeline to maintain compliance and secure coding practices across team members.

Example Prompts

1. "Perform a full system security audit and summarize the high-risk findings."
2. "Check for any hardcoded keys or insecure file permissions in this project directory."
3. "Run a security scan on my dependencies and network ports, then send the results to my Feishu webhook."

Tips & Limitations

• Configuration: Use a .security-audit.json file in your project root to exclude noisy folders like node_modules or dist to speed up the scan and reduce false positives.
• Permissions: Ensure the tool has appropriate read access to your system directories, especially when checking .ssh or system configurations.
• macOS Limitations: Certain system-level checks like SIP or Gatekeeper status are only functional when the audit is executed on a macOS environment.
• Secret Detection: While the tool uses advanced entropy analysis and regex, always review the results manually to filter out potential false positives or benign high-entropy strings.