security-audit
Sapphire security audit and remediation for runtime, hooks, scheduler, and repo hygiene
Source facts
- Repository
- arigatoexpress/Sapphire
- Last source activity
- February 12, 2026 at 01:41
- Detected SKILL.md language
- English
- Stars
- 1
- Forks
- 0
Install options
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Review the source files
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Showing SKILL.md
SKILL.md
Source instructions · Read-only preview- name
- security-audit
- description
- Sapphire security audit and remediation for runtime, hooks, scheduler, and repo hygiene
- metadata
- {"openclaw":{"emoji":"🛡️","requires":{"bins":"[Truncated]"},"always":true}}
# Security Audit (Sapphire Focus)
## Scope
- `Sapphire` (`arigatoexpress/Sapphire`) only
- Cloud ingress, hooks, scheduler, secrets, and deployment config
## Audit Steps
1. Secret and config hygiene.
```bash
git -C {repo_path} grep -rn --no-color -E '(ghp_[A-Za-z0-9]{36}|AIza[0-9A-Za-z\-_]{20,}|-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----)' -- ':!*.md' ':!*.lock'
```
2. Verify hook and gateway auth boundaries in config.
3. Verify scheduler latest run statuses are healthy.
4. Verify deploy scripts keep security-critical defaults intentional.
## Required Checks
- No raw secrets committed.
- Hook endpoints require valid hook token.
- Telegram allowlists are present and explicit.
- Runtime checks (`verify-autonomy`) show no scheduler permission failures.
## Guardrails
- Treat auth regressions as HIGH severity.
- Any token/channel policy change requires follow-up readiness check (`autonomy_readiness_check.sh`).
View on GitHub