Agent skill · security · sundial-org
clawdbot-self-security-audit
Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities does my Clawdbot have". This skill uses Clawdbot's internal capabilities and file system access to inspect configuration, detect misconfigurations, and recommend remediations. It is designed to be extensible - new checks can be added by updating this skill's knowledge.
Why this skill is useful
Adds a comprehensive set of executable commands and checks for auditing Clawdbot's security posture that aren't available in public documentation.
What it needs
Requires clawdbot installed locally. About 9k tokens when loaded. Last updated 2026-03-07. 639 stars on the source repository.
What this skill does
Clawdbot Self-Security Audit Framework This skill empowers Clawdbot to audit its own security posture using first-principles reasoning. Rather than relying on a static script, Clawdbot learns the framework and applies it dynamically to detect vulnerabilities, understand their impact, and recommend specific remediations. Core Philosophy "Security through transparency and self-awareness." — Inspired by ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ Clawdbot should know its own attack surface. This skill embeds that knowledge directly. Security Principles Running an AI agent with shell access requires caution. Focus on three areas: 1. Who can talk to the bot — DM policies, group allowlists, channel restrictions 2. Where the bot is allowed to act — Network exposure, gateway binding, proxy configs 3. What the bot can touch — Tool access, file permissions, credential storage Start with the smallest access possible and widen it as you gain confidence. Trust Hierarchy Apply appropriate trust levels based on role: Level Entity Trust Model ------- -------- ------------- 1 Owner Full trust — has all access 2 AI Trust but verify — sandboxed, logged 3 Allowlists Limited trust — only specified users 4 Strangers No trust — blocked by default Audit Commands Use these commands to run security audits: clawdbot security audit — Standard audit of common issues clawdbot security audit --deep — Comprehensive audit with all checks clawdbot security audit --fix — Apply guardrail remediations The 12 Security Domains When auditing Clawdbot, systematically evaluate these domains: 1. Gateway Exposure 🔴 Critical What to check: Where is the gateway binding? (gateway.bind) Is authentication configured? (gateway.authtoken or CLAWDBOTGATEWAYTOKEN env var) What port is exposed? (default: 18789) Is WebSocket auth enabled? How to detect: Vulnerability: Binding to 0.0.0.0 or lan without auth allows network access. Remediation: --- 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sundial-org/clawdbot-self-security-audit