Index of every page on this site: llms.txt
All skills
tristanmanchester avatar

/audit-openclaw-security

@3323bc9
by Tristan Manchestertristanmanchester/agent-skills3 stars
2
Run it yourself

Audit an OpenClaw deployment's gateway exposure, authentication, channel access, tool permissions, and secret handling. Use for OpenClaw security reviews or interpreting openclaw security audit results, not unrelated host hardening.

Use this Skill: https://skilld.dev/gh/tristanmanchester/agent-skills/audit-openclaw-security

Nothing lands on disk. Nothing to clean up.

Fork this Skill

Edit a local copy. It keeps the author and licence.

CHANGELOG.md

≈326 tokens on demand. Your agent reads this file only when SKILL.md points to it.

audit-openclaw-security v2

This bundle updates the original skill for current OpenClaw and current Agent Skills / OpenClaw skill-loader expectations.

Main changes

  • migrated SKILL.md frontmatter to an OpenClaw-compatible form:
    • single-line frontmatter keys
    • inline JSON metadata
    • {baseDir} references for bundled scripts
  • retuned the description so it is specific about both:
    • what the skill does
    • when it should trigger
  • updated the audit workflow for current OpenClaw commands:
    • openclaw status --deep
    • openclaw gateway probe --json
    • openclaw channels status --probe
    • openclaw backup create --verify
  • expanded the current audit-check glossary and check-id map
  • added current reverse-proxy, Control UI origin, and Tailscale Serve/Funnel guidance
  • added current session.dmScope guidance for shared inbox and multi-account setups
  • refreshed platform playbooks
  • upgraded bundled scripts for agentic use:
    • --help support
    • safer config redaction flow
    • richer rendered report with environment clues and merged audit findings

Bundle versioning

  • Canonical skill name remains audit-openclaw-security so the directory still matches the name field.
  • Bundle metadata version is now 2.1.0.
  • Validated against OpenClaw 2026.3.8.

Source: SKILL.md on GitHub

Skill behaviors

skilld matched fixed text patterns in SKILL.md and file names. Patterns miss obfuscated code.

skilld run checks every file with the same patterns. It asks for approval before it loads a Skill with a behavior marked Needs approval.

Third-party checks

1 alert1mo5 checks · Risk MEDIUM
  • Gen Agent Trust Hub1mo

    The skill is a comprehensive security auditing tool for OpenClaw deployments. It correctly includes safety features such as a redaction script to prevent the accidental sharing of secrets and emphasizes a read-only approach. It does utilize sudo to inspect firewall rules and employs dynamic module loading to handle configuration files, which are behaviors that warrant user awareness during execution.

  • Socket1mo

    No alerts

  • Snyk1mo

    Risk: LOW · No issues

  • Runlayer7mo

    11/14 files flagged

  • ZeroLeaks6mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 3323bc9. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 weeks ago.

Steadyupdated last month

Capability

metadata
{
  "version": "3.0.0",
  "reviewed": "2026-09-13"
}
Other metadata
compatibility
OpenClaw CLI and a local shell for collection; Python 3.10+ for helpers. JSON5 redaction requires json5 or pyjson5.

README badge

README badge for tristanmanchester/agent-skills/audit-openclaw-security