| name | openclaw-security-auditor |
| description | OpenClaw Security Auditor (OSA) - Comprehensive security auditing tool for OpenClaw deployments. Provides 60-second security diagnosis, risk scoring (0-100), bilingual reports (Chinese/English), and automated fix suggestions. Use when users request security audits, vulnerability scanning, configuration validation, or security hardening for their OpenClaw installations. |
| license | MIT |
OpenClaw Security Auditor Skill
Overview
This skill provides comprehensive security auditing capabilities for OpenClaw deployments. It can scan OpenClaw configurations, identify security vulnerabilities, provide risk scores, and suggest remediation steps.
When to Use This Skill
- User requests security audit or vulnerability assessment
- User wants to check OpenClaw security configuration
- User needs security hardening recommendations
- User asks about OpenClaw security best practices
- User wants to validate their OpenClaw configuration
- User mentions "security", "audit", "vulnerability", "hardening" in context of OpenClaw
Core Capabilities
Security Scanning
- 47-point security check: Covers 7 major security domains
- Gateway Configuration: Binding modes, authentication, tokens
- Session Security: dmScope, pairing strategies, timeouts
- Tool Permissions: exec profiles, allowed tools, filesystem access
- Channel Security: dmPolicy, mention requirements, allowlists
- Network Security: Firewall status, port exposure
- Logging Security: Log levels, sensitive data handling
- Skill Security: Auto-install policies, source restrictions
Risk Assessment
- 0-100 Security Score: Comprehensive risk scoring system
- Three Security Modes: Conservative, Balanced (recommended), Aggressive
- Severity Classification: Critical, High, Medium, Low, Info levels
- Bilingual Reporting: Chinese/English dual-language output
Automated Remediation
- Fix Suggestions: Specific commands for each identified issue
- Mode Recommendations: Guidance on appropriate security modes
- Configuration Templates: Best practice configuration examples
Usage Workflow
Step 1: Security Scan
Run comprehensive security scan on OpenClaw configuration:
from scripts.security_scanner import SecurityScanner
from scripts.report_generator import ReportGenerator
scanner = SecurityScanner(config_path="~/.openclaw/openclaw.json", mode="balanced")
results = scanner.scan()
Step 2: Generate Report
Generate bilingual security report:
reporter = ReportGenerator(results, mode="balanced")
bilingual_report = reporter.generate("bilingual")
with open("~/.openclaw/security-audit-report.md", "w") as f:
f.write(bilingual_report)
Step 3: Provide Recommendations
Based on scan results, provide specific remediation steps:
- Critical Issues: Immediate fixes required
- High Issues: Fix as soon as possible
- Medium/Low Issues: Optimization suggestions
- Security Mode Selection: Recommend appropriate mode based on use case
Available Scripts
Core Scripts
scripts/security_scanner.py - Main security scanning enginescripts/report_generator.py - Multi-format report generationscripts/config_fixer.py - Automated configuration fixingscripts/i18n.py - Bilingual translation support
Utility Scripts
scripts/scan_current.py - Quick scan of current configurationscripts/fix_security.py - Apply security fixes interactivelyscripts/debug_session.py - Debug session configuration issues
Reference Documentation
Security Best Practices
references/security-modes.md - Detailed security mode configurationsreferences/config-guide.md - OpenClaw security configuration guidereferences/vulnerability-db.md - Common OpenClaw security vulnerabilities
API Documentation
references/api-reference.md - Complete API reference for security auditorreferences/integration-guide.md - CI/CD and automation integration guide
Output Formats
Report Types
- Markdown: Human-readable bilingual reports
- JSON: Machine-readable format for automation
- HTML: Visual web-based reports
Report Structure
Each report includes:
- Security score and risk level
- Summary of passed/failed checks
- Detailed issue descriptions with severity levels
- Specific fix commands and recommendations
- Security mode guidance
Security Mode Guidance
Conservative Mode (Production)
- Use Case: Production environments, sensitive data
- Score Target: 95+
- Key Settings: loopback binding, token auth, minimal permissions
Balanced Mode (Development) ⭐
- Use Case: Personal development, small teams
- Score Target: 75-90
- Key Settings: loopback binding, reasonable permissions, standard logging
Aggressive Mode (Testing)
- Use Case: Isolated test environments only
- Score Target: 40-60
- Key Settings: Full permissions, minimal restrictions
Example Usage
Basic Security Audit
User: "Can you audit my OpenClaw security configuration?"
Assistant:
1. Load security_scanner.py script
2. Run scan on ~/.openclaw/openclaw.json
3. Generate bilingual report
4. Present security score and key findings
5. Provide specific fix recommendations
Mode Recommendation
User: "What security mode should I use for my development setup?"
Assistant:
1. Explain three security modes
2. Recommend Balanced mode for development
3. Provide configuration examples
4. Show expected security score range
Vulnerability Remediation
User: "How do I fix the security issues in my OpenClaw setup?"
Assistant:
1. Run security scan to identify specific issues
2. Categorize issues by severity
3. Provide step-by-step fix commands
4. Verify fixes with re-scan if requested
Limitations and Considerations
Scope Limitations
- Only scans OpenClaw configuration files
- Does not perform network penetration testing
- System-level security (firewall, OS hardening) requires manual intervention
- Cannot modify configurations without user approval
Safety Considerations
- Always backup configuration before applying fixes
- Test fixes in non-production environments first
- Some fixes require system administrator privileges
- Conservative mode may break existing functionality
Integration Capabilities
CI/CD Integration
- JSON output format for automated security gates
- Exit codes based on security score thresholds
- Integration with GitHub Actions, GitLab CI, etc.
Monitoring Integration
- Scheduled security scans
- Trend analysis and reporting
- Alert notifications for critical issues
Getting Started
To use this skill, simply ask for a security audit of your OpenClaw configuration. The skill will automatically:
- Locate your OpenClaw configuration file
- Perform comprehensive security scanning
- Generate detailed bilingual report
- Provide actionable security recommendations
The skill is designed to be safe and non-destructive - it only reads configuration files and provides recommendations, never makes automatic changes without explicit user approval.
