メニュー
References Serverless OpenClaw security model. Covers Bridge 6-layer defense, IDOR prevention, secret management, Cognito authentication, and IAM least privilege. Use as a security checklist when writing or reviewing code.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
References Serverless OpenClaw architecture. Covers network design, CDK stack structure, DynamoDB data model, API protocols, and container design.
References cold start optimization history and techniques. Covers Docker image optimization, Fargate CPU tuning, SOCI lazy loading, and Lambda Bedrock discovery fix. Use when optimizing startup performance.
Loads Serverless OpenClaw project context. Provides background knowledge needed for development including project overview, tech stack, architecture decisions, and data models.
References Serverless OpenClaw cost optimization guidelines. Validates that no resources exceeding the cost target ($1/month) are created during implementation. Use when writing CDK stacks or making infrastructure changes.
Deploys Serverless OpenClaw CDK stacks to AWS. Handles SecretsStack parameter injection, full/individual stack deployment, and Docker image push.
Development workflow guide. Covers build, test, lint, format commands, package structure, Git hooks, TDD methodology, and coding conventions. Use when setting up dev environment, running tests, or following project conventions.
| name | security |
| description | References Serverless OpenClaw security model. Covers Bridge 6-layer defense, IDOR prevention, secret management, Cognito authentication, and IAM least privilege. Use as a security checklist when writing or reviewing code. |
| allowed-tools | Read, Glob, Grep |
Authentication, Bridge defense, IDOR prevention, secret management, IAM roles:
/healthhttps.createServer)--bind localhost to block external accessUSER openclaw)/health returns only { "status": "ok" } (no internal info exposure)openclaw.jsonconfig.auth = { method: "env" }delete config.auth?.apiKey applieddelete config.gateway?.auth?.token appliedsub or connectionId reverse lookup)jwt.sub?token={jwt} → verified in ws-connectX-Telegram-Bot-Api-Secret-Token verification + pairing checkSee architecture.md §security for full Lambda security details.
S3:GetObject/PutObject on sessions/* prefix onlySSM:GetParameter on secrets/* prefix only (no wildcard)DynamoDB:GetItem/PutItem/DeleteItem on TaskState table onlycloudwatch:PutMetricData for custom metrics (namespace-restricted)SessionLock prevents concurrent Lambda invocations accessing same sessionHOME=/tmp, env vars only (never write API keys to files)