القائمة
Proactive security monitoring, threat scanning, and auto-remediation for OpenClaw deployments
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/GeorgeDoors888/GB-Power-Market-JJ --skill openclaw-security-monitorيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
超级简历 WonderCV 出品，3000 万用户信赖。简历分析、段落改写、JD 岗位匹配、自动匹配职位、PDF 导出、AI 求职导师（面试准备/薪资谈判/职业规划/多版本简历策略）。 触发条件：用户提供简历、要求简历点评/打分/反馈、希望改写某个简历部分、 希望将简历与岗位 JD 匹配、咨询求职建议或面试准备，或提到 CV/简历/求职。 不触发条件：用户讨论普通写作（非简历）、询问其他文档， 或讨论与求职和职业发展无关的话题。
Order food/drinks (点餐) on an Android device paired as an OpenClaw node. Uses in-app menu and cart; add goods, view cart, submit order (demo, no real payment).
调用久吾智能体API进行文本或文件分析处理。支持两种调用方式：(1) 文本内容分析 - 传入name(智能体名称)、docno(文档编号)、content(文本内容)；(2) 文件分析 - 传入name、docno和files(文件列表)进行智能评审。适用于合同评审、需求评审、文档审查等场景。当用户要求评审合同、分析条款、审查文档、需求评审、合同条款分析、或需要对文本和文件进行AI智能分析时触发。
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | openclaw-security-monitor |
| description | Proactive security monitoring, threat scanning, and auto-remediation for OpenClaw deployments |
| tags | ["security","scan","remediation","monitoring","threat-detection","hardening"] |
| version | 4.2.1 |
| author | Adrian Birzu |
| user-invocable | true |
| disable-model-invocation | true |
Real-time security monitoring with threat intelligence from ClawHavoc research, daily automated scans, web dashboard, and Telegram alerting for OpenClaw.
Note: Replace <skill-dir> with the actual folder name where this skill is installed (commonly openclaw-security-monitor or security-monitor).
Run a comprehensive 59-point security scan:
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/scan.sh
Exit codes: 0=SECURE, 1=WARNINGS, 2=COMPROMISED
Display a security overview with process trees via witr.
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/dashboard.sh
Monitor network connections and check against IOC database.
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/network-check.sh
Scan-driven remediation: runs scan.sh, skips CLEAN checks, and executes per-check remediation scripts for each WARNING/CRITICAL finding. Includes 59 individual scripts covering file permissions, exfiltration domain blocking, tool deny lists, gateway hardening, sandbox configuration, credential auditing, ClawJacked protection, SSRF hardening, PATH hijacking cleanup, log poisoning remediation, /agent/act hardening, SHA-1 cache key migration, Google Chat webhook hardening, WebSocket identity enforcement, MCP tool poisoning quarantine, SANDWORM_MODE worm cleanup, and rules file Unicode sanitization.
# Full scan + remediate (interactive)
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh
# Auto-approve all fixes (explicit opt-in)
OPENCLAW_ALLOW_UNATTENDED_REMEDIATE=1 \
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --yes
# Dry run (preview)
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --dry-run
# Remediate a single check
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --check 7 --dry-run
# Run all 59 remediation scripts (skip scan)
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --all
Flags:
--yes / -y — Skip confirmation prompts only when OPENCLAW_ALLOW_UNATTENDED_REMEDIATE=1--dry-run — Show what would be fixed without making changes--check N — Run remediation for check N only (skip scan)--all — Run all 59 remediation scripts without scanning firstExit codes: 0=fixes applied, 1=some fixes failed, 2=nothing to fix
Scan all locally installed ClawHub skills for security issues. Checks each skill against:
ioc/malicious-publishers.txt)ioc/malicious-skill-patterns.txt)ioc/c2-ips.txt)ioc/malicious-domains.txt)ioc/file-hashes.txt)bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/clawhub-scan.sh
Exit codes: 0=all clean, 1=warnings found, 2=critical findings
Register a Telegram chat for daily security alerts.
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/telegram-setup.sh [chat_id]
URL: http://<vm-ip>:18800
Read-only dark-themed browser dashboard that displays scan results from log files, IOC stats, installed skills list, and scan history. Does not execute any shell commands or child processes — all scans and remediation are triggered via CLI scripts.
launchctl list | grep security-dashboard
launchctl unload ~/Library/LaunchAgents/com.openclaw.security-dashboard.plist
launchctl load ~/Library/LaunchAgents/com.openclaw.security-dashboard.plist
Threat intelligence files in ioc/:
c2-ips.txt - Known command & control IP addressesmalicious-domains.txt - Payload hosting and exfiltration domainsfile-hashes.txt - Known malicious file SHA-256 hashesmalicious-publishers.txt - Known malicious ClawHub publishersmalicious-skill-patterns.txt - Malicious skill naming patternsOptional cron job at 06:00 UTC with Telegram alerts. Not auto-installed — requires explicit user action:
crontab -l | { cat; echo "0 6 * * * $HOME/.openclaw/workspace/skills/<skill-dir>/scripts/daily-scan-cron.sh"; } | crontab -
Based on research from 40+ security sources including:
Source repository: github.com/adibirzu/openclaw-security-monitor — all source code is publicly auditable.
Detection signatures in repository: This project contains threat-signature patterns (IP addresses, domain names, hash values) because it scans skills for risky content. These strings are used for grep/regex matching only and are not executable instructions.
Required binaries: bash, curl, node (for dashboard), lsof (for network checks). Optional: witr (process trees), docker (container audits), openclaw CLI (config checks).
Environment variables: OPENCLAW_TELEGRAM_TOKEN (optional, for daily scan alerts), OPENCLAW_HOME (optional, overrides default ~/.openclaw directory). Both are declared in the frontmatter metadata above.
What the scanner reads: scan.sh reads files within ~/.openclaw/ (configs, skills, credentials, logs) to detect threats. It pattern-matches against .env, .ssh, and keychain paths for detection only — it never exfiltrates, transmits, or modifies data. The scanner is read-only.
What remediation does: remediate.sh can modify file permissions, block domains in /etc/hosts, adjust OpenClaw gateway config, quarantine MCP configs, and remove malicious skills. Always run --dry-run first to preview changes. Unattended mode (--yes) requires explicit OPENCLAW_ALLOW_UNATTENDED_REMEDIATE=1 — without this env var, --yes is silently ignored.
IOC updates: update-ioc.sh fetches threat intelligence from this project's GitHub repository. In interactive mode it shows pending changes and asks for confirmation before writing. --auto mode (for cron) writes without prompting. Validates incoming IOC file format (field counts). Untrusted upstream repos require explicit OPENCLAW_ALLOW_UNTRUSTED_IOC_SOURCE=1.
No auto-installed persistence: The installer does NOT create cron jobs, LaunchAgents, symlinks, or background services. Cron and LaunchAgent setup are documented as optional manual steps that the user must explicitly run themselves.
Dashboard binding: The web dashboard is read-only (no shell commands, no child processes) and defaults to 127.0.0.1:18800 (localhost only). It reads log files and IOC stats only.
# From GitHub
git clone https://github.com/adibirzu/openclaw-security-monitor.git \
~/.openclaw/workspace/skills/<skill-dir>
chmod +x ~/.openclaw/workspace/skills/<skill-dir>/scripts/*.sh
The OpenClaw agent auto-discovers skills from ~/.openclaw/workspace/skills/ via SKILL.md frontmatter. After cloning, the /security-scan, /security-remediate, /security-dashboard, /security-network, and /security-setup-telegram commands will be available in the agent.