Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities does my Clawdbot have". This skill uses Clawdbot's internal capabilities and file system access to inspect configuration, detect misconfigurations, and recommend remediations. It is designed to be extensible - new checks can be added by updating this skill's knowledge.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities does my Clawdbot have". This skill uses Clawdbot's internal capabilities and file system access to inspect configuration, detect misconfigurations, and recommend remediations. It is designed to be extensible - new checks can be added by updating this skill's knowledge.
This skill empowers Clawdbot to audit its own security posture using first-principles reasoning. Rather than relying on a static script, Clawdbot learns the framework and applies it dynamically to detect vulnerabilities, understand their impact, and recommend specific remediations.
Core Philosophy
"Security through transparency and self-awareness." — Inspired by ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ
Clawdbot should know its own attack surface. This skill embeds that knowledge directly.
Security Principles
Running an AI agent with shell access requires caution. Focus on three areas:
Who can talk to the bot — DM policies, group allowlists, channel restrictions
Where the bot is allowed to act — Network exposure, gateway binding, proxy configs
What the bot can touch — Tool access, file permissions, credential storage
Start with the smallest access possible and widen it as you gain confidence.
Trust Hierarchy
Apply appropriate trust levels based on role:
Level
Entity
Trust Model
1
Owner
Full trust — has all access
2
AI
Trust but verify — sandboxed, logged
3
Allowlists
Limited trust — only specified users
4
Strangers
No trust — blocked by default
Audit Commands
Use these commands to run security audits:
clawdbot security audit — Standard audit of common issues
clawdbot security audit --deep — Comprehensive audit with all checks
Model Guidance: Use latest generation models for agents with filesystem or network access. If using small models, disable web search and browser tools.
8. File Permissions & Local Disk Hygiene 🟡 Medium
What to check:
Directory permissions (should be 700)
Config file permissions (should be 600)
Symlink safety
How to detect:
stat -c "%a" ~/.clawdbot
ls -la ~/.clawdbot/*.json
Vulnerability: Loose permissions allow other users to read sensitive configs.
Vulnerability: Leaked credentials in the codebase can lead to compromise.
Audit Functions
The --fix flag applies these guardrails:
Changes groupPolicy from open to allowlist for common channels
Resets logging.redactSensitive from off to tools
Tightens local permissions: .clawdbot directory to 700, config files to 600
Secures state files including credentials and auth profiles
High-Level Audit Checklist
Treat findings in this priority order:
🔴 Lock down DMs and groups if tools are enabled on open settings
🔴 Fix public network exposure immediately
🟠 Secure browser control with tokens and HTTPS
🟠 Correct file permissions for credentials and config
🟡 Only load trusted plugins
🟡 Use modern models for bots with tool access
Access Control Models
DM Access Model
Mode
Description
pairing
Default - unknown senders must be approved via code
allowlist
Unknown senders blocked without handshake
open
Public access - requires explicit asterisk in allowlist
disabled
All inbound DMs ignored
Slash Commands
Slash commands are only available to authorized senders based on channel allowlists. The /exec command is a session convenience for operators and does not modify global config.
Threat Model & Mitigation
Potential Risks
Risk
Mitigation
Execution of shell commands
blocked_commands, restrict_tools
File and network access
sandbox, workspaceAccess: none/ro
Social engineering and prompt injection
wrap_untrusted_content, mentionGate
Browser session hijacking
Dedicated profile, token auth, HTTPS
Credential leakage
logging.redactSensitive: tools, env vars
Incident Response
If a compromise is suspected, follow these steps:
Containment
Stop the gateway process — clawdbot daemon stop
Set gateway.bind to loopback — "bind": "127.0.0.1"
Disable risky DMs and groups — Set to disabled
Rotation
Change the gateway auth token — clawdbot doctor --generate-gateway-token
Rotate browser control and hook tokens
Revoke and rotate API keys for model providers
Review
Check gateway logs and session transcripts — ~/.clawdbot/logs/
Review recent config changes — Git history or backups
Re-run the security audit with the deep flag — clawdbot security audit --deep
═══════════════════════════════════════════════════════════════
🔒 CLAWDBOT SECURITY AUDIT
═══════════════════════════════════════════════════════════════
Timestamp: $(date -Iseconds)
┌─ SUMMARY ───────────────────────────────────────────────
│ 🔴 Critical: $CRITICAL_COUNT
│ 🟠 High: $HIGH_COUNT
│ 🟡 Medium: $MEDIUM_COUNT
│ ✅ Passed: $PASSED_COUNT
└────────────────────────────────────────────────────────
┌─ FINDINGS ──────────────────────────────────────────────
│ 🔴 [CRITICAL] $VULN_NAME
│ Finding: $DESCRIPTION
│ → Fix: $REMEDIATION
│
│ 🟠 [HIGH] $VULN_NAME
│ ...
└────────────────────────────────────────────────────────
This audit was performed by Clawdbot's self-security framework.
No changes were made to your configuration.
Extending the Skill
To add new security checks:
Identify the vulnerability - What misconfiguration creates risk?
Determine detection method - What config key or system state reveals it?
Define the baseline - What is the secure configuration?
Write detection logic - Shell commands or file parsing
Document remediation - Specific steps to fix
Assign severity - Critical, High, Medium, Low
Example: Adding SSH Hardening Check
## 14. SSH Agent Forwarding 🟡 Medium
**What to check:** Is SSH_AUTH_SOCK exposed to containers?
**Detection:**
```bash
env | grep SSH_AUTH_SOCK
Vulnerability: Container escape via SSH agent hijacking.
Severity: Medium
## Security Assessment Questions
When auditing, ask:
1. **Exposure:** What network interfaces can reach Clawdbot?
2. **Authentication:** What verification does each access point require?
3. **Isolation:** What boundaries exist between Clawdbot and the host?
4. **Trust:** What content sources are considered "trusted"?
5. **Auditability:** What evidence exists of Clawdbot's actions?
6. **Least Privilege:** Does Clawdbot have only necessary permissions?
## Principles Applied
- **Zero modification** - This skill only reads; never changes configuration
- **Defense in depth** - Multiple checks catch different attack vectors
- **Actionable output** - Every finding includes a concrete remediation
- **Extensible design** - New checks integrate naturally
## References
- Official docs: https://docs.clawd.bot/gateway/security
- Original framework: [ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ on X](https://x.com/DanielMiessler/status/2015865548714975475)
- Repository: https://github.com/TheSethRose/Clawdbot-Security-Check
- Report vulnerabilities: security@clawd.bot
---
**Remember:** This skill exists to make Clawdbot self-aware of its security posture. Use it regularly, extend it as needed, and never skip the audit.
