Agent skill · security · aaaaqwq
openclaw-shield
Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.
Why this skill is useful
Adds a comprehensive security audit engine with executable scripts for vulnerability detection and configuration hardening that the AI cannot generate on its own.
What it needs
Requires node installed locally. About 1k tokens when loaded. Last updated 2026-08-06. 83 stars on the source repository.
What this skill does
OpenClaw Shield — Security Audit Audit any OpenClaw config for security vulnerabilities, misconfigurations, and best-practice violations. Produces a structured JSON report with risk scores, findings, and remediation steps. When to Use User asks to check/audit/review their OpenClaw security User wants to harden their config before deploying User is setting up a new OpenClaw instance User asks about secret leakage or API key exposure in their config Before publishing or sharing any config file Quick Audit (live config) Or directly: What It Checks (11 categories) 1. Gateway Auth — missing/weak auth, insecure UI settings 2. Network Exposure — bind address, Tailscale funnel, wildcard proxies 3. Channel Security — wildcard allowFrom, missing allowlists 4. DM Policy — open DM policy without pairing 5. Subagent Permissions — wildcard allowAgents, circular delegation chains, self-delegation 6. Tool Permissions — over-privileged agents with tools.profile: "full" 7. Secret Leakage — API keys, tokens, private keys in plaintext config 8. Sandbox/Execution — missing workspace isolation, no execution policies 9. Plugin Config — enabled plugins without channel config 10. Heartbeat Exposure — sensitive data in heartbeat prompts 11. Remote Config — unencrypted WebSocket, exposed remote URLs/tokens Usage Audit a config file Audit from stdin Sanitize a config (strip secrets) Programmatic use Output Returns JSON with: risklevel, overallscore (0-100), vulnerabilities[], vulnerabilitycount, bestpracticescompliance, actionrecommended, safetodeploy, audittimestamp. Workflow for Agent 1. Load the user's config: cat ~/.openclaw/openclaw.json 2. Run: node SKILLDIR/bin/shield.js audit ~/.openclaw/openclaw.json --summary 3. Present findings to user with prioritized recommendations 4. Offer to sanitize before sharing: node SKILLDIR/bin/shield.js sanitize <file>
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aaaaqwq/ai-shield-audit