openclaw-shield

name	openclaw-shield
description	Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.
metadata	{"openclaw":{"emoji":"🛡️","homepage":"https://github.com/autonomous-intelligence/openclaw-shield"}}

OpenClaw Shield — Security Audit

Audit any OpenClaw config for security vulnerabilities, misconfigurations, and best-practice violations. Produces a structured JSON report with risk scores, findings, and remediation steps.

When to Use

• User asks to check/audit/review their OpenClaw security
• User wants to harden their config before deploying
• User is setting up a new OpenClaw instance
• User asks about secret leakage or API key exposure in their config
• Before publishing or sharing any config file

Quick Audit (live config)

node scripts/shield-audit.sh

Or directly:

node SKILL_DIR/bin/shield.js audit ~/.openclaw/openclaw.json --summary

What It Checks (11 categories)

1. Gateway Auth — missing/weak auth, insecure UI settings
2. Network Exposure — bind address, Tailscale funnel, wildcard proxies
3. Channel Security — wildcard allowFrom, missing allowlists
4. DM Policy — open DM policy without pairing
5. Subagent Permissions — wildcard allowAgents, circular delegation chains, self-delegation
6. — over-privileged agents with tools.profile: "full"