Skip to main content Skills Marktplatz Entdecken und erkunden Sie KI-Skills, die von der Community erstellt wurden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Prompt-Details anzeigen Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/johnalbertini14-glitch/openclaw-skills --skill openclaw-security-monitorDer Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
ZIP herunterladen Herunterladen... Mehr aus diesem Repository Verwandte Berufe SOC
Basierend auf der SOC-Berufsklassifikation
name openclaw-security-monitor description Proactive security monitoring, threat scanning, and auto-remediation for OpenClaw deployments tags ["security","scan","remediation","monitoring","threat-detection","hardening"] version 3.2.0 author Adrian Birzu user-invocable true
Security Monitor
Real-time security monitoring with threat intelligence from ClawHavoc research, daily automated scans, web dashboard, and Telegram alerting for OpenClaw.
Commands
Note: Replace <skill-dir> with the actual folder name where this skill is installed (commonly openclaw-security-monitor or security-monitor).
/security-scan
Run a comprehensive 32-point security scan:
Known C2 IPs (ClawHavoc: 91.92.242.x, 95.92.242.x, 54.91.154.110)
AMOS stealer / AuthTool markers
Reverse shells & backdoors (bash, python, perl, ruby, php, lua)
Credential exfiltration endpoints (webhook.site, pipedream, ngrok, etc.)
Crypto wallet targeting (seed phrases, private keys, exchange APIs)
Curl-pipe / download attacks
Sensitive file permission audit
Skill integrity hash verification
SKILL.md shell injection patterns (Prerequisites-based attacks)
Memory poisoning detection (SOUL.md, MEMORY.md, IDENTITY.md)
Base64 obfuscation detection (glot.io-style payloads)
External binary downloads (.exe, .dmg, .pkg, password-protected ZIPs)
Gateway security configuration audit
WebSocket origin validation (CVE-2026-25253)
Known malicious publisher detection (hightower6eu, etc.)
Sensitive environment/credential file leakage
DM policy audit (open/wildcard channel access)
Tool policy / elevated tools audit
Sandbox configuration check
mDNS/Bonjour exposure detection
Session & credential file permissions
Persistence mechanism scan (LaunchAgents, crontabs, systemd)
Plugin/extension security audit
Log redaction settings audit
Reverse proxy localhost trust bypass detection
Exec-approvals configuration audit (CVE-2026-25253 exploit chain)
Docker container security (root, socket mount, privileged mode)
Node.js version / CVE-2026-21636 permission model bypass
Plaintext credential detection in config files
VS Code extension trojan detection (fake ClawdBot extensions)
Internet exposure detection (non-loopback gateway binding)
MCP server security audit (tool poisoning, prompt injection) bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/scan.sh
Exit codes: 0=SECURE, 1=WARNINGS, 2=COMPROMISED
/security-dashboard Display a security overview with process trees via witr.
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/dashboard.sh
/security-network Monitor network connections and check against IOC database.
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/network-check.sh
/security-remediate Scan-driven remediation: runs scan.sh, skips CLEAN checks, and executes per-check remediation scripts for each WARNING/CRITICAL finding. Includes 32 individual scripts covering file permissions, exfiltration domain blocking, tool deny lists, gateway hardening, sandbox configuration, credential auditing, and more.
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --yes
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --dry-run
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --check 7 --dry-run
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --all
--yes / -y — Skip confirmation prompts (auto-approve all fixes)--dry-run — Show what would be fixed without making changes--check N — Run remediation for check N only (skip scan)--all — Run all 32 remediation scripts without scanning first Exit codes: 0=fixes applied, 1=some fixes failed, 2=nothing to fix
/security-setup-telegram Register a Telegram chat for daily security alerts.
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/telegram-setup.sh [chat_id]
Web Dashboard URL : http://<vm-ip>:18800
Dark-themed browser dashboard with auto-refresh, on-demand scanning, donut charts, process tree visualization, network monitoring, and scan history timeline.
Service Management launchctl list | grep security-dashboard
launchctl unload ~/Library/LaunchAgents/com.openclaw.security-dashboard.plist
launchctl load ~/Library/LaunchAgents/com.openclaw.security-dashboard.plist
IOC Database Threat intelligence files in ioc/:
c2-ips.txt - Known command & control IP addressesmalicious-domains.txt - Payload hosting and exfiltration domainsfile-hashes.txt - Known malicious file SHA-256 hashesmalicious-publishers.txt - Known malicious ClawHub publishersmalicious-skill-patterns.txt - Malicious skill naming patterns
Daily Automated Scan Cron job at 06:00 UTC with Telegram alerts. Install:
crontab -l | { cat ; echo "0 6 * * * $HOME /.openclaw/workspace/skills/<skill-dir>/scripts/daily-scan-cron.sh" ; } | crontab -
Threat Coverage Based on research from 40+ security sources including:
Installation
git clone https://github.com/adibirzu/openclaw-security-monitor.git \
~/.openclaw/workspace/skills/<skill-dir>
chmod +x ~/.openclaw/workspace/skills/<skill-dir>/scripts/*.sh
The OpenClaw agent auto-discovers skills from ~/.openclaw/workspace/skills/ via SKILL.md frontmatter. After cloning, the /security-scan, /security-remediate, /security-dashboard, /security-network, and /security-setup-telegram commands will be available in the agent.
