Skip to main content Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/Aradotso/security-skills --skill openclaw-security-watchdogThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository
Related occupations SOC
Based on SOC occupation classification
name openclaw-security-watchdog description OpenClaw security scanning skill that performs comprehensive system security audits and generates human-friendly reports triggers ["run security scan","perform security audit","check system security","execute security inspection","do a security check","scan for security issues","run openclaw security watchdog","perform system security audit"]
OpenClaw Security Watchdog
Skill by ara.so — Security Skills collection.
OpenClaw Security Watchdog is an automated security scanning tool that performs comprehensive system security audits across 14 critical security dimensions. It generates human-readable reports with clear risk indicators (✅/⚠️/🚨) and can integrate with threat intelligence databases.
Installation
Prerequisites:
Node.js v18 or higher
OpenClaw CLI installed
Install via OpenClaw (Recommended):
Manual Installation:
git clone https://github.com/CTCT-CT2/openclaw-security-watchdog.git
cd openclaw-security-watchdog
npm install
Triggering the Scan
Once installed as an OpenClaw skill, trigger it conversationally:
Execute security inspection
Help me check system security
OpenClaw will automatically recognize and execute the security watchdog skill.
Scan Modes
Full Scan (Recommended)
Runs all 14 security checks
Queries threat intelligence databases (optional)
Sends anonymized metadata for analysis
Provides comprehensive risk scoring
Local-Only Mode
Zero network traffic
All data stays on local machine
No threat intelligence lookups
Privacy-first approach
Security Check Coverage The tool scans 14 critical areas:
Core Runtime Environment Health - Checks Node.js/system integritySensitive Directory Tamper Detection - Monitors critical system pathsGateway Process Memory Isolation - Validates credential isolationConfiguration Integrity & Permission Baseline - Audits config file permissionsComponent Supply Chain Integrity - Validates package checksumsRemote Access & Brute Force Monitoring - SSH/RDP attack detectionNetwork Exposure & Anomalous Processes - Open ports and suspicious processesAutomated Tasks & Backdoor Detection - Cron/scheduled task analysisPrivilege Escalation & Unauthorized Commands - Sudo abuse detectionOutbound Connections & Data Exfiltration - Network traffic analysisSystem Credentials & Sensitive File Access - Access log auditingHardcoded Secrets & Mnemonic Leak Scanning - Secret detection in codeSudo Privilege Audit - Privilege escalation trackingMalicious Component Threat Intelligence - Known malware detection
Code Examples
Basic Scan Execution (JavaScript) const SecurityWatchdog = require ('openclaw-security-watchdog' );
const scanner = new SecurityWatchdog ({
mode : 'full' ,
reportPath : '~/.openclaw/security-reports/' ,
enableThreatIntel : true
});
async function runSecurityScan (try {
const results = await scanner.scan ();
console .log (`Security Score: ${results.score} /100` );
console .log (`Passed: ${results.passed} /${results.total} ` );
console .log (`Warnings: ${results.warnings} ` );
console .log (`Critical: ${results.critical} ` );
results.checks .forEach (check =>console .log (`${check.icon} ${check.name} : ${check.status} ` );
if (check.findings .length > 0 ) {
console .log (` Findings: ${check.findings.join(', ' )} ` );
}
});
await scanner.generateReport (results);
} catch (error) {
console .error ('Scan failed:' , error);
}
}
runSecurityScan ();
Scheduled Scanning const cron = require ('node-cron' );
const SecurityWatchdog = require ('openclaw-security-watchdog' );
cron.schedule ('0 2 * * *' , async () => {
const scanner = new SecurityWatchdog ({ mode : 'full' });
const results = await scanner.scan ();
if (results.critical > 0 ) {
await scanner.sendAlert (results, {
channel : 'email' ,
recipients : [process.env .SECURITY_ALERT_EMAIL ]
});
}
});
Custom Check Integration const SecurityWatchdog = require ('openclaw-security-watchdog' );
const scanner = new SecurityWatchdog ();
scanner.addCheck ({
name : 'Custom API Key Validation' ,
category : 'secrets' ,
async execute (const apiKeys = await this .scanForPattern (/api[_-]?key\s*[:=]\s*['"][^'"]{20,}['"]/gi );
return {
status : apiKeys.length === 0 ? 'pass' : 'fail' ,
findings : apiKeys,
severity : 'high' ,
recommendation : 'Move API keys to environment variables'
};
}
});
scanner.scan ();
Filtering Scan Results const scanner = new SecurityWatchdog ();
const results = await scanner.scan ();
const criticalIssues = results.checks .filter (
check =>severity === 'critical' && check.status === 'fail'
);
const permissionIssues = results.checks .filter (
check =>category === 'permissions'
);
await scanner.generateReport (results, {
filter : check =>severity === 'high' || check.severity === 'critical'
});
Configuration Create ~/.openclaw/security-watchdog.json:
{
"mode" : "full" ,
"reportPath" : "~/.openclaw/security-reports/" ,
"enableThreatIntel" : true ,
"excludePaths" : [
"/tmp" ,
"/var/cache"
] ,
"checksToRun" : [
"runtime-health" ,
"directory-tamper" ,
"memory-isolation" ,
"config-integrity" ,
"supply-chain" ,
"remote-access" ,
"network-exposure" ,
"scheduled-tasks" ,
"privilege-escalation" ,
"outbound-connections" ,
"credential-access" ,
"secret-scanning" ,
"sudo-audit" ,
"threat-intel"
] ,
"alerting" : {
"enabled" : true ,
"thresholds" : {
"critical" : 1 ,
"high" : 3
} ,
"channels" : [ "email" , "slack" ]
} ,
"threatIntelSources" : [
"https://threat-intel.openclaw.io/api/v1/lookup"
]
}
Environment Variables
export OPENCLAW_THREAT_INTEL_API_KEY=your_api_key_here
export SECURITY_ALERT_EMAIL=security@example.com
export SECURITY_ALERT_SLACK_WEBHOOK=https://hooks.slack.com/services/YOUR/WEBHOOK/URL
export OPENCLAW_REPORT_ENCRYPTION_KEY=your_encryption_key_here
Report Output Reports are saved to ~/.openclaw/security-reports/ with timestamp:
security-report-2026-05-06-14-30-00.json
security-report-2026-05-06-14-30-00.html
security-report-2026-05-06-14-30-00.txt
Accessing Report Programmatically const fs = require ('fs' );
const path = require ('path' );
const reportPath = path.join (
process.env .HOME ,
'.openclaw/security-reports/security-report-latest.json'
);
const report = JSON .parse (fs.readFileSync (reportPath, 'utf8' ));
console .log (`Overall Security Score: ${report.score} /100` );
console .log (`Risk Level: ${report.riskLevel} ` );
Common Patterns
Pre-Deployment Security Gate
const SecurityWatchdog = require ('openclaw-security-watchdog' );
async function securityGate (const scanner = new SecurityWatchdog ({ mode : 'local' });
const results = await scanner.scan ();
if (results.critical > 0 ) {
console .error ('❌ Critical security issues found. Deployment blocked.' );
process.exit (1 );
}
if (results.score < 80 ) {
console .warn ('⚠️ Security score below threshold. Review required.' );
process.exit (1 );
}
console .log ('✅ Security scan passed. Proceeding with deployment.' );
}
securityGate ();
Continuous Monitoring const SecurityWatchdog = require ('openclaw-security-watchdog' );
const EventEmitter = require ('events' );
class SecurityMonitor extends EventEmitter {
constructor (super ();
this .scanner = new SecurityWatchdog ({ mode : 'full' });
}
startMonitoring (intervalMinutes = 60 ) {
setInterval (async () => {
const results = await this .scanner .scan ();
if (results.critical > 0 ) {
this .emit ('criticalThreat' , results);
}
if (results.score < this .lastScore - 10 ) {
this .emit ('scoreDropped' , results);
}
this .lastScore = results.score ;
}, intervalMinutes * 60 * 1000 );
}
}
const monitor = new SecurityMonitor ();
monitor.on ('criticalThreat' , results =>console .error ('🚨 Critical threat detected!' , results);
});
monitor.startMonitoring ();
Troubleshooting
Permission Errors
sudo chmod +r /var/log/auth.log
sudo chmod +r /etc/ssh/sshd_config
sudo openclaw scan
Missing Dependencies
npm install
node --version
Threat Intelligence Timeout
const scanner = new SecurityWatchdog ({
threatIntel : {
timeout : 30000 ,
retries : 3
}
});
Report Generation Fails
const fs = require ('fs' );
const reportDir = path.join (process.env .HOME , '.openclaw/security-reports' );
if (!fs.existsSync (reportDir)) {
fs.mkdirSync (reportDir, { recursive : true });
}
Large Codebases (Slow Scanning)
const scanner = new SecurityWatchdog ({
excludePaths : [
'node_modules' ,
'.git' ,
'dist' ,
'build' ,
'coverage'
],
maxFileSize : 1048576 ,
parallelScans : 4
});
Privacy Considerations
Check names and results (pass/fail)
Anonymized device identifier (SHA-256 hash)
Summary statistics only
File contents
Passwords or API keys
Log file contents
IP addresses
Usernames
Zero network requests
All data remains on device
No telemetry or analytics
