Agent skill · security · sundial-org
dont-hack-me
別駭我！基本安全檢測 — Security self-check for Clawdbot/Moltbot. Run a quick audit of your clawdbot.json to catch dangerous misconfigurations — exposed gateway, missing auth, open DM policy, weak tokens, loose file permissions. Auto-fix included. Invoke: "run a security check" or "幫我做安全檢查".
Why this skill is useful
Adds an executable script for security auditing that identifies and auto-fixes common misconfigurations in Clawdbot/Moltbot.
What it needs
Requires jq installed locally. About 5k tokens when loaded. Last updated 2026-03-07. 639 stars on the source repository.
What this skill does
dont-hack-me Security self-check skill for Clawdbot / Moltbot. Reads ~/.clawdbot/clawdbot.json and checks 7 items that cover the most common misconfigurations. Outputs a simple PASS / FAIL / WARN report. How to run Say any of: "run a security check" "check my security settings" "audit my clawdbot config" "am I secure?" Checklist — step by step When this skill is triggered, follow these steps exactly: Step 0 — Read the config Use the read tool to open ~/.clawdbot/clawdbot.json. Parse the JSON content. If the file does not exist or is unreadable, report an error and stop. Also run a shell command to get the file permissions: (On Linux: stat -c '%a' ~/.clawdbot/clawdbot.json) Step 1 — Gateway Bind Path: gateway.bind Expected: "loopback" or "localhost" or "127.0.0.1" or "::1" PASS if the value is one of the above or the key is absent (default is "loopback") FAIL if the value is "0.0.0.0", "::", or any non-loopback address Severity: CRITICAL — a non-loopback bind exposes your agent to the network Step 2 — Gateway Auth Mode Path: gateway.auth.mode Expected: "token" or "password" PASS if the value is "token" or "password", or the key is absent (default is "token") FAIL if the value is "off" or "none" Severity: CRITICAL — without auth anyone who can reach the gateway can control your agent Step 3 — Token Strength Path: gateway.auth.token Expected: 32 or more characters PASS if the token is >= 32 characters WARN if the token is 16–31 characters FAIL if the token is < 16 characters or empty SKIP if auth mode is "password" (passwords are user-chosen, don't judge length) Severity: HIGH — short tokens are vulnerable to brute-force Step 4 — DM Policy (per channel) Path: channels.<name>.dmPolicy for each channel Expected: "pairing" — or if "open", there must be a non-empty allowFrom array PASS if dmPolicy is "pairing", or if allowFrom has at least one entry FAIL if dmPolicy is "open" and allowFrom is missing or empty SKIP if no channels are configured Severity: HIGH — an open DM p …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sundial-org/dont-hack-me