abaddon

What This Skill Does

Abaddon is the premier adversarial security auditing tool for OpenClaw environments on macOS. Unlike standard defensive monitoring, which merely checks if systems are currently locked, Abaddon proactively adopts an attacker's mindset. It performs deep, systemic audits to uncover vulnerabilities that an adversary would realistically exploit to gain persistence, lateral movement, or unauthorized access. The tool evaluates critical vectors including network exposure (listening ports, remote access tunnels), macOS system integrity (SIP, FileVault, Gatekeeper status), and OpenClaw-specific configuration posture. It rigorously audits file permissions, ensures sensitivity-laden files like AGENT_PROMPT.md and openclaw.json are properly secured (e.g., 600 or 444), and performs a comprehensive scan for plaintext API keys or secrets embedded within your workspace or git history. The output is a transparent, letter-graded report (A-F) that provides actionable remediation steps for every finding.

Installation

To install the skill, execute: clawhub install openclaw/skills/skills/enochosbot-bot/abaddon.

Once installed, follow these steps to secure your deployment:

1. Integrate the prompt into your agent: Run cat skills/abaddon/templates/abaddon-prompt.md >> ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md. If you lack a primary observer agent, initialize a standalone Abaddon agent.
2. Configure automated monitoring: Execute bash skills/abaddon/setup/cron-seed.sh to inject the nightly 3:45 AM CST assessment into your environment.
3. Secure the configuration: Run chmod 600 ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md to ensure your detection playbooks remain unreadable to unauthorized local actors.

Use Cases

Abaddon is essential for power users running OpenClaw with sensitive API keys, private LLM agents, or persistent local automations. It serves as your "Security-in-Depth" layer. Use it to:

• Regularly audit your attack surface to ensure no rogue plugins or tunnels have been installed.
• Validate that your secrets, such as API tokens, haven't leaked into configuration files or shell histories.
• Ensure system-level protections like XProtect and Gatekeeper are active.
• Receive automated notifications via Telegram when critical security posture regressions are detected.

Example Prompts

• "run full assessment"
• "Abaddon, show me the red team audit for today"
• "run red team scan and report back to the security channel"

Tips & Limitations

To maximize the effectiveness of Abaddon, ensure it has the appropriate access levels defined in your agent profile. Note that while Abaddon is highly capable at identifying misconfigurations, it is a diagnostic tool; it flags vulnerabilities but does not automatically "fix" system settings (like changing folder permissions) to avoid causing instability in your OpenClaw workflow. Always review the detailed memory/audits/abaddon-YYYY-MM-DD.md report before executing recommended remediations. Finally, ensure your Telegram integration is configured if you wish to receive the critical security alerts in real-time.