Agent skill · security · sundial-org
clawdbot-security
Security audit and hardening for Clawdbot/Moltbot installations. Detects exposed gateways, fixes permissions, enables authentication, and guides firewall/Tailscale setup.
Why this skill is useful
Adds executable scripts for security auditing and hardening that are specific to Clawdbot installations, which the AI wouldn't generate on its own.
What it needs
Requires npm installed locally. About 2k tokens when loaded. Last updated 2026-03-07. 639 stars on the source repository.
What this skill does
Clawdbot Security Audit Comprehensive security scanner and hardening guide for Clawdbot/Moltbot installations. Why this matters: 1,673+ Clawdbot gateways were found exposed on Shodan. If you installed Clawdbot on a server or VPS, you might be one of them. --- Quick Start --- What Gets Checked 1. Gateway Binding Safe: bind: "loopback" (127.0.0.1) DANGER: bind: "lan" or bind: "0.0.0.0" 2. File Permissions Config directory: 700 (owner only) Config file: 600 (owner read/write only) Credentials: 700 (owner only) 3. Authentication Token auth or password auth should be enabled Without auth, anyone who finds your gateway has full access 4. Node.js Version Minimum: 20.x Recommended: 22.12.0+ Older versions have known vulnerabilities 5. mDNS Broadcasting Clawdbot uses Bonjour for local discovery On servers, this should be disabled 6. External Accessibility (--deep) Checks if your gateway port is reachable from the internet Uses your public IP to test --- Manual Hardening Steps Step 1: Bind to Localhost Only Step 2: Lock File Permissions Step 3: Enable Authentication Then set the token: Step 4: Disable mDNS Step 5: Set Up Firewall (UFW) Step 6: Set Up Tailscale (Recommended) --- What Gets Exposed When Vulnerable When a Clawdbot gateway is exposed: ❌ Complete conversation histories (Telegram, WhatsApp, Signal, iMessage) ❌ API keys (Claude, OpenAI, etc.) ❌ OAuth tokens and bot credentials ❌ Full shell access to the host machine ❌ All files in the workspace Prompt injection attacks can extract this data with a single email or message. --- Checklist [ ] Gateway bound to loopback only [ ] File permissions locked down (700/600) [ ] Authentication enabled (token or password) [ ] Node.js 22.12.0+ [ ] mDNS disabled on servers [ ] Firewall configured (UFW) [ ] Tailscale for remote access (not port forwarding) [ ] SSH key-only auth (no passwords) --- Installation --- Built by LXGIC Studios - @lxgicstudios
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sundial-org/clawdbot-security