Security Audit
Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.
chandrasekar-r
@chandrasekar-r
What This Skill Does
Scans Clawdbot deployments for exposed credentials, open ports, weak configurations, and vulnerabilities. Supports targeted scans (credentials, ports, configs, permissions, Docker) and includes an auto-fix mode that remediates common issues like insecure file permissions and missing .gitignore.
Replaces manual security reviews and ad-hoc vulnerability checks by providing a single command that scans and optionally fixes common security gaps in Clawdbot setups.
When to Use It
- Run a quick audit before deploying a new Clawdbot instance
- Scan for exposed API keys or tokens in environment files and code
- Check for unexpected open ports or missing firewall rules
- Validate Clawdbot configuration against security best practices
- Audit Docker containers for privileged mode or missing resource limits
- Generate a full JSON report for compliance or CI/CD pipeline integration
Install
$ openclaw skills install @chandrasekar-r/security-auditSecurity Audit Skill
When to use
Run a security audit to identify vulnerabilities in your Clawdbot setup before deployment or on a schedule. Use auto-fix to remediate common issues automatically.
Setup
No external dependencies required. Uses native system tools where available.
How to
Quick audit (common issues)
node skills/security-audit/scripts/audit.cjs
Full audit (comprehensive scan)
node skills/security-audit/scripts/audit.cjs --full
Auto-fix common issues
node skills/security-audit/scripts/audit.cjs --fix
Audit specific areas
node skills/security-audit/scripts/audit.cjs --credentials # Check for exposed API keys
node skills/security-audit/scripts/audit.cjs --ports # Scan for open ports
node skills/security-audit/scripts/audit.cjs --configs # Validate configuration
node skills/security-audit/scripts/audit.cjs --permissions # Check file permissions
node skills/security-audit/scripts/audit.cjs --docker # Docker security checks
Generate report
node skills/security-audit/scripts/audit.cjs --full --json > audit-report.json
Output
The audit produces a report with:
| Level | Description |
|---|---|
| 🔴 CRITICAL | Immediate action required (exposed credentials) |
| 🟠 HIGH | Significant risk, fix soon |
| 🟡 MEDIUM | Moderate concern |
| 🟢 INFO | FYI, no action needed |
Checks Performed
Credentials
- API keys in environment files
- Tokens in command history
- Hardcoded secrets in code
- Weak password patterns
Ports
- Unexpected open ports
- Services exposed to internet
- Missing firewall rules
Configs
- Missing rate limiting
- Disabled authentication
- Default credentials
- Open CORS policies
Files
- World-readable files
- Executable by anyone
- Sensitive files in public dirs
Docker
- Privileged containers
- Missing resource limits
- Root user in container
Auto-Fix
The --fix option automatically:
- Sets restrictive file permissions (600 on .env)
- Secures sensitive configuration files
- Creates .gitignore if missing
- Enables basic security headers
Related skills
security-monitor- Real-time monitoring (available separately)
Top skills in this category
Skill Vetter
@spclaudehomeSecurity-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
Multi Search Engine
@gpyangyoujunMulti search engine integration with 16 engines (7 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra...
MoltGuard - Security & Antivirus & Guardrails
@thomaslwangMoltGuard — OpenClaw security guard by OpenGuardrails. Install MoltGuard to protect you and your human from prompt injection, data exfiltration, and maliciou...
1password
@steipeteSet up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
Apple Reminders
@steipeteManage Apple Reminders via the `remindctl` CLI on macOS (list, add, edit, complete, delete). Supports lists, date filters, and JSON/plain output.