security-guardian

What This Skill Does

The Security Guardian skill serves as an automated security auditor for OpenClaw projects. It focuses on two critical areas of software safety: proactive credential hygiene and container vulnerability management. By scanning your codebase, the skill identifies hardcoded secrets such as API keys and OAuth tokens before they can be committed or deployed. Additionally, it integrates with Trivy to inspect Docker images for known CVEs, providing an essential layer of defense for containerized environments. It identifies risks, provides actionable reports, and assists in the remediation process by recommending the migration of sensitive data to secure vaults like mema-vault.

Installation

To install this skill, ensure that you have access to the OpenClaw environment and use the following command in your terminal: clawhub install openclaw/skills/skills/1999azzar/security-guardian Note: For the container vulnerability scanning component, ensure that the trivy binary is pre-installed on your host machine to allow the shell scripts to execute successfully.

Use Cases

• Pre-Commit Auditing: Scan your local workspace before pushing code to identify accidental hardcoded keys.
• CI/CD Pipeline Security: Integrate the scanning scripts into your deployment flow to verify that container images meet organizational security standards.
• Legacy Codebase Cleanup: Use the tool to perform a deep sweep of an imported repository to find and vault long-forgotten secrets.

Example Prompts

1. "Security Guardian, please scan my current project directory for any hardcoded secrets and give me a summary of where they are located."
2. "I need to prepare for deployment. Can you run a container vulnerability scan on my latest image, web-app-v2:latest, and identify any critical CVEs?"
3. "After scanning for secrets, please help me transition the found API keys to the mema-vault and replace them with environment variables."

Tips & Limitations

To maximize the effectiveness of Security Guardian, ensure your workspace is limited to the relevant project directories to prevent the tool from traversing system files or irrelevant build artifacts. While the tool is highly effective at finding standard patterns for API keys and tokens, it should be treated as a secondary line of defense; always utilize .gitignore and pre-commit hooks as your primary security measures. Be aware that the container scan relies on external vulnerability databases and may require periodic updates to the underlying trivy binary to stay current with the latest threats.