security-audit

What This Skill Does

The security-audit skill is a robust diagnostic tool designed specifically for OpenClaw AI agents to evaluate the security posture of Clawdbot deployments. It acts as an automated security engineer, performing multi-layered scans to detect vulnerabilities such as exposed API keys, insecurely configured ports, weak environment variables, and risky file permissions. Beyond simple detection, it includes an intelligent auto-fix mechanism that remediates common security oversights—such as tightening file access control or enabling essential security headers—without requiring manual intervention. The skill categorizes findings into a clear severity matrix ranging from Critical to Informational, providing actionable intelligence to ensure your infrastructure remains hardened against common attack vectors.

Installation

Installation is streamlined for macOS environments. Users should follow the instructions provided in the terminal, ensuring the environment is prepared for the audit. After installation, the tool runs directly via the Node.js runtime, ensuring native system access for accurate audits of local files and network configurations.

Use Cases

This skill is essential in several scenarios:

1. Pre-Deployment Hardening: Run a full audit before pushing new services to production to ensure no developer keys or secrets have been leaked.
2. Compliance Audits: Periodically scan your configuration files and file system permissions to ensure they meet your organization's internal security policy.
3. Incident Response: If you suspect a configuration drift or a potential breach, the audit skill can quickly identify which ports or services have been exposed unexpectedly.

Example Prompts

1. "OpenClaw, please run a full security audit on my current deployment and save the results as a JSON report."
2. "Perform a quick scan of my environment. If you find any exposed API keys or open ports that shouldn't be exposed, use the auto-fix feature to secure them."
3. "Can you check for any specific docker security vulnerabilities and verify that our configuration files are not world-readable?"

Tips & Limitations

To maximize the utility of the security audit, ensure that your OpenClaw agent has the necessary filesystem permissions to scan your sensitive directories. While the auto-fix mode is highly efficient, always review the generated audit-report.json before and after running remediation scripts in a high-stakes production environment. Note that this skill focuses on infrastructure and configuration security; it is not a substitute for comprehensive penetration testing or application-level logic auditing.