OpenClaw/clawhub-security-signals huggingface dataset:
Skill: lujun2508/file-rules (version 1.0.9)

--- name: Workspace Guardian description: Stop AI from scattering files everywhere. This skill enforces consistent naming and directory structure for all AI outputs — saves tokens, cuts management time, ends the file hunt. Works on Win/Mac/Linux. Essential for anyone running AI agents. version: 1.0.7 metadata: openclaw: os: - win32 - linux - darwin --- # Workspace Guardian > Unless the user explicitly specifies a path, this skill governs where and how files are created. --- ## Core Rules ### One Project = One Directory All files belong to a project. Never scatter files in `~/`, desktop, downloads, or timestamped folders. ### Naming Standard ``` {date}_{description}.{ext} ``` Example: `2026-04-14_report.xlsx` Scripts: `{verb}_{object}.py` (e.g., `generate_report.py`) ### Directory Structure ``` {project-root}/ ├── output/ ← final deliverables ├── scripts/ ← scripts and tools ├── data/ ← data files ├── docs/ ← documentation ├── temp/ ← temporary files └── README.md ``` --- ## Special Cases ### User Specifies a Path Follow the user's instruction. ### No Clear Project Output goes to the Agent's own workspace: - `drafts/` — pending content - `output/` — approved content - `temp/` — temporary, clean after use ### Agent Workspaces Files in `~/.openclaw/workspace-*/` are managed by each Agent independently. --- ## Periodic Maintenance ### Scheduled Review Periodically (every few days during normal usage), check for: - Old temp files that were never cleaned up - Multiple script versions that could be consolidated - Empty directories left behind When found, ask the user: `"发现 {issue}，是否清理？"` — wait for confirmation before taking action. Do not主动清理大量文件 or run cleanup during busy times. ## Maintenance ### Rejected Outputs When the user declines an output: remove the file promptly. ### Temporary Files Clean up `temp/` after task completion. Old temp files should not accumulate. ### Versioned Scripts When updating a script, archive the old version with a date suffix (e.g., `generate_report_v4_2026-04-09.py`). ### Empty Directories Do not leave empty directories behind. --- ## Self-Check After creating a file, briefly confirm the location: ``` 📁 Saved: {project-dir}/{filename} ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: lovefromio/lovefromio-sonoscli (version 1.0.0)

--- name: sonoscli description: Control Sonos speakers (discover/status/play/volume/group). homepage: https://sonoscli.sh metadata: {"clawdbot":{"emoji":"🔊","requires":{"bins":["sonos"]},"install":[{"id":"go","kind":"go","module":"github.com/steipete/sonoscli/cmd/sonos@latest","bins":["sonos"],"label":"Install sonoscli (go)"}]}} --- # Sonos CLI Use `sonos` to control Sonos speakers on the local network. Quick start - `sonos discover` - `sonos status --name "Kitchen"` - `sonos play|pause|stop --name "Kitchen"` - `sonos volume set 15 --name "Kitchen"` Common tasks - Grouping: `sonos group status|join|unjoin|party|solo` - Favorites: `sonos favorites list|open` - Queue: `sonos queue list|play|clear` - Spotify search (via SMAPI): `sonos smapi search --service "Spotify" --category tracks "query"` Notes - If SSDP fails, specify `--ip <speaker-ip>`. - Spotify Web API search is optional and requires `SPOTIFY_CLIENT_ID/SECRET`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: wgj24/secretary-memory-hook (version 1.2.0)

--- name: secretary-memory-hook description: 秘书记忆系统核心 Hook — 会话压缩时自动触发摘要/偏好提取/上下文召回。基于 session:compact:before 和 session:compact:after 事件，实现功能3（会话摘要）、功能4（偏好提取）、功能8（跨会话召回）的自动化。 --- # Secretary Memory Hook 秘书式记忆系统的核心 Hook，将原本依赖"不存在的事件"的自动逻辑，改为基于真实的 `session:compact:before` 和 `session:compact:after` 事件触发。 ## 事件映射 | 功能 | 原设计（不可用） | 现设计（可用）| |------|----------------|--------------| | 功能3：会话自动摘要 | session:end（不存在）| session:compact:before ✅ | | 功能4：偏好自动提取 | session:end（不存在）| session:compact:before ✅ | | 功能8：跨会话召回 | session:start（不存在）| session:compact:after ✅ | ## 触发时机 ``` 对话进行中... ↓ 对话太长，触发 compact session:compact:before → 运行 session_summary.py（生成摘要） → 运行 profile_miner.py（提取偏好） → 压缩历史 session:compact:after → 运行 context_loader.py（加载历史上下文） → 对话继续 ``` ## 依赖 需要先安装 secretary-memory skill（脚本所在目录）： ``` /root/.openclaw/workspace/skills/secretary-memory/scripts/ ``` ## 安装后 Hook 会自动被 OpenClaw 发现并启用： ```bash openclaw hooks list # 确认 secretary-memory 在列表中 openclaw hooks check # 确认状态为 ready ``` ## 文件结构 ``` ~/.openclaw/hooks/secretary-memory/ ├── HOOK.md # Hook 元数据 └── handler.ts # TypeScript 处理器 ```


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: dinghaibin/printf-tool (version 1.0.0)

--- name: printf-tool description: Format and print data with precise control over output format. Use for formatted output with padding, precision, and type specifications. --- # Printf - Formatted Output Utility Format and display data using format specifiers similar to C printf. Supports string, integer, floating-point, and hexadecimal formatting with width and precision control. ## Usage ```bash printf-tool <format> [arguments...] ``` ## Common Format Specifiers - `%s`: String - `%d`: Integer - `%f`: Floating point - `%x`: Hexadecimal - `%05d`: Zero-padded integer (5 digits) ## Examples ```bash printf-tool "Name: %s, Age: %d" "Alice" 30 printf-tool "Price: $%.2f" 19.99 printf-tool "%010d" 42 ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jul879n/quick-reminder (version 1.0.0)

--- name: quick-reminder summary: Recordatorios rápidos tomando frases naturales y avisando vía Telegram o consola. description: | Detecta frases tipo "recordatorio para ... a las HH:MM" o "remind me to ... at HH:MM" en tus mensajes. Programa un aviso exacto usando el método disponible: Telegram o consola. Ideal para recordatorios simples y rápidos sin depender de skills externas complejas. tags: - reminder - recordatorio - telegram - chat - cron --- # Quick Reminder Skill sencilla que toma frases naturales y programa un recordatorio en minutos. ## Ejemplos de uso - "recordatorio para llamar a María a las 21:15" - "remind me to send email at 13:00" El aviso se enviará automáticamente al canal donde recibiste el mensaje (Telegram, consola, web, etc). ## Instalación 1. Copia la carpeta `quick-reminder` en tu ruta de skills de OpenClaw. 2. Reinicia el gateway de OpenClaw. ## Funciona con: - Español e inglés (bases, puedes sumar otros patrones en index.js) - Telegram (si el context.telegram existe) - Consola/TTY (si no es chat) ## Límite/simplicidad No soporta repeticiones, solo HH:MM (de hoy o si ya pasó, lo agenda al día siguiente). Ideal para flujos personales básicos o como plantilla para skills más potentes.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: peand-rover/fitness-challenge-video (version 1.0.0)

--- name: fitness-challenge-video version: "1.0.0" displayName: "Fitness Challenge Video — Create 30-Day Workout Challenge and Exercise Progress Videos for Social Media" description: > Fitness challenges get 3x more social media engagement than standard workout posts. Your 30-day challenge, transformation journey, and weekly workout documentation all perform better as video content than as before-and-after photos — but filming and editing daily fitness content is the bottleneck that stops most fitness creators from posting consistently. Fitness Challenge Video creates workout challenge and exercise progress videos from your training footage: assembles daily workout clips into weekly progress recap videos that show consistency and improvement over time, adds energetic background music calibrated to workout intensity, overlays day numbers and exercise names as on-screen text, includes before-and-after progress sequences at challenge milestones, and exports vertical videos optimized for TikTok and Instagram Reels alongside horizontal versions for YouTube. Personal trainers running client challenge programs, fitness influencers documenting transformation journeys, gym owners creating challenge marketing content, and individuals sharing accountability content all use Fitness Challenge Video to produce consistent challenge content without spending an hour editing after every workout. NemoVideo lets fitness brands and personal trainers produce high-energy challenge and program promotion videos quickly: describe your challenge format and target participant, upload your training footage, and receive motivating promotional videos optimized for Instagram, TikTok, and the email campaigns that fill your next challenge cohort. metadata: {"openclaw": {"emoji": "💪", "requires": {"env": ["NEMO_TOKEN"], "configPaths": ["~/.config/nemovideo/"]}, "primaryEnv": "NEMO_TOKEN"}} --- # Fitness Challenge Video — Every Workout Documented, Every Week Published ## Use Cases 1. **30-Day Challenge Recaps** — Weekly summary videos for ongoing fitness challenges, showing days 1-7, 8-14, etc. with progress notes and motivational messaging for challenge participants. 2. **Personal Trainer Client Programs** — Challenge documentation videos for PT clients, showing their workout consistency and progress for motivation and social proof marketing. 3. **Transformation Journey Documentation** — Long-form transformation content that compresses weeks of training into shareable progress videos at 30, 60, and 90-day milestones. 4. **Gym Challenge Marketing** — Promotional challenge videos for gym membership acquisition campaigns, showing real member participation and results from past challenges. ## How It Works Upload your workout footage and specify the challenge structure and current progress day. Fitness Challenge Video assembles the recap, adds music and day overlays, and exports challenge videos for every platform.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dragon015/wechat-mcp (version 1.0.0)

--- name: wechat-mcp version: 1.0.0 description: Windows 电脑端微信消息监控与发送 MCP，实现在微信上给指定联系人发送消息 --- # WeChat MCP Windows 电脑端微信消息监控与发送 MCP。 ## 功能 - 📸 截取微信窗口截图 - 👤 搜索并打开联系人聊天窗口 - ✉️ 给指定联系人发送消息 - 🔍 支持独立聊天窗口识别和消息发送 ## 安装 需要先安装 Python 依赖： ```bash pip install pyautogui pygetwindow pillow pyperclip opencv-python ``` ## 使用方法 ### 1. 发送消息到指定联系人 ```python from server import send_message_to_contact # 给指定联系人发送消息（完整流程：搜索->打开聊天->发送） send_message_to_contact("联系人名称", "消息内容") ``` ### 2. 给当前聊天窗口发送消息 ```python from server import send_message_to_current # 给当前已打开的聊天窗口发送消息 send_message_to_current("消息内容") ``` ### 3. 获取微信状态 ```python from server import get_wechat_status status = get_wechat_status() print(status) # {'status': 'running', 'title': '微信', 'position': {'x': 0, 'y': 0}, 'size': {'width': 1920, 'height': 1080}} ``` ## MCP 工具 如果通过 MCP 协议调用： ```json { "tools": [ { "name": "wechat_get_status", "description": "获取微信窗口状态" }, { "name": "wechat_send_message", "description": "给当前聊天窗口发送消息", "inputSchema": { "type": "object", "properties": { "message": {"type": "string", "description": "消息内容"} }, "required": ["message"] } } ] } ``` ## 注意事项 1. 微信窗口需要保持打开状态 2. 发送消息时会自动激活微信窗口 3. 中文输入需要确保系统中文输入法正常工作 4. 支持给独立聊天窗口（单独打开的 Dragon 窗口）发送消息 ## 文件结构 ``` wechat-mcp/ ├── server.py # MCP 服务器主程序 ├── test_wechat.py # 测试工具 ├── requirements.txt # Python 依赖 └── README.md # 说明文档 ```

path: requirements.txt
content: pyautogui>=0.9.54
pygetwindow>=0.0.9
pytesseract>=0.3.13
Pillow>=12.1.0
pyperclip>=1.11.0
opencv-python>=4.13.0


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)
Skill: sxcvicky/xhs-data-api (version 0.3.0)

--- name: xhs-data-api description: >- 分析小红书内容市场，覆盖笔记格局、博主生态、品牌竞争。 当用户询问内容策略、选博主合作、分析市场竞争时使用。 version: 3.0.0 user-invocable: true metadata: {"openclaw":{"emoji":"📊","requires":{"env":["XHS_API_KEY"]},"primaryEnv":"XHS_API_KEY"}} --- # 小红书内容市场分析 ## 角色 你是内容市场分析师。通过调用7个分析接口，帮用户回答： - 这个领域的内容是什么格局？ - 有哪些爆款，为什么爆？ - 哪些博主值得合作？ - 品牌竞争态势如何？ --- ## 必读：调用前置规则 ### 第一步永远是 `data-index` **每次分析开始前，必须先调用 A 接口（data-index）**，获取可用的分析维度列表。 系统只能分析已收录的类目和关键词，`data-index` 告诉你有哪些。 ``` GET /api/v1/aggregate/data-index ``` 拿到列表后，将用户输入（如"美妆"、"护肤"、"黑头"）映射到系统支持的维度再调用后续接口。 ### `_coverage` 和 `_dataGaps` 的含义 所有接口返回值都包含这两个字段，**必须读取并告知用户**： - `_coverage.coverageNote`：数据的覆盖范围声明（不代表全网，是样本数据） - `_dataGaps`：哪些维度数据不足（数组非空时，告知用户该结论的局限性） --- ## 7个接口速查 | 接口 | 方法 | 路径 | 回答的问题 | |------|------|------|-----------| | A | GET | `/api/v1/aggregate/data-index` | 数据库有哪些可分析的类目/关键词？ | | B | POST | [REDACTED_SECRET] | 这个领域最近哪些笔记在爆？ | | C | POST | [REDACTED_SECRET] | 这个领域的内容是什么格局？ | | D | POST | [REDACTED_SECRET] | 这个领域有哪些活跃博主？ | | E | GET | `/api/v1/aggregate/authors/{authorId}` | 这个博主值不值得合作？ | | F | POST | [REDACTED_SECRET] | 头部/腰部博主投哪个性价比更高？ | | G | POST | `/api/v1/aggregate/brand/market` | 这个品类的品牌格局是什么？ | **认证**：所有请求带 `X-[REDACTED_SECRET]` **完整入参/出参**：见 `references/aggregate-api.md` --- ## 决策树：用户问什么 → 调哪些接口 ``` 用户问内容方向/策略 → C（内容格局）获取格式分布、爆文类型、商业占比 → B（笔记清单）获取具体爆款样本 用户问博主合作 → D（博主发现）找出该领域活跃博主列表 → E（博主档案）对感兴趣的博主深挖：粉丝画像、历史内容 → F（ROI对比）如果用户纠结头部vs腰部，用这个比较性价比 用户问品牌竞争/市场格局 → G（品牌市场）获取品牌竞争格局、声量排名、供需关系 用户问某个词/话题是否值得做 → C（内容格局）看该词下的市场供需和内容密度 → B（笔记清单）看已有爆款的互动数据 ``` --- ## 输出要求 1. **数据用中文标签**：响应中数字字段同时有原始值和 `xxxLabel`（如 `"1230000"` + `"123万"`），输出时用后者 2. **必须说明数据范围**：引用 `_coverage.coverageNote`，让用户知道这是样本数据 3. **数据缺口要透明**：`_dataGaps` 非空时，标注哪些维度数据不足 4. **结论要可执行**：不要只陈列数字，要给出"所以建议..." ### 输出结构模板 ``` ## [问题核心结论，一句话] ### 数据发现 - [关键数据点 1] - [关键数据点 2] ### 建议 1. [具体可执行步骤] 2. [具体可执行步骤] > 数据说明：[引用 _coverage.coverageNote] > ⚠️ 数据局限：[如 _dataGaps 非空，列出缺失维度] ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pr1vateer/image-resize (version 1.0.0)

--- name: resize-magic version: 0.1.0 author: Stenkil <[REDACTED_SECRET]> description: Resize images using ImageMagick (CLI). Entrypoint is a Bash script. entrypoint: scripts/resize.sh metadata: { "openclaw": { "emoji": "🖼️", "requires": { "bins": ["bash"], "anyBins": ["magick","convert"] }, "install": [ { "id": "brew", "kind": "brew", "formula": "imagemagick", "bins": ["magick","convert"], "label": "Install ImageMagick (brew)" } ] } } user-invocable: true command-dispatch: tool command-tool: resize commands: - name: resize usage: resize <input-path> <geometry> [output-path] description: | Resize an image using ImageMagick. Geometry examples: - 800x -> width 800, preserve aspect ratio - 800x600 -> exact geometry (may change aspect) - 50% -> scale to 50% of original - 800x800\> -> resize only if larger than 800x800 --- ## Overview This skill provides a single executable script `scripts/resize.sh` that the agent (or the `openclaw` CLI) can call to resize an image with ImageMagick. ## Installation (manual) Copy the folder into your OpenClaw skills directory, e.g.: ```bash cp -r resize-magic ~/.openclaw/skills/resize-magic # or install via CLI if available openclaw skill install ./resize-magic ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tuanpmt/mxe (version 2.0.0)

# MXE Skill - Markdown Export Tool Convert Markdown files to PDF, DOCX, or HTML with advanced features. ## When to Use Use MXE when the user wants to: - Convert Markdown to PDF with nice formatting - Export documents with Mermaid diagrams - Generate PDFs with table of contents - Create professional documents from Markdown - Download web articles as Markdown ## Installation Check ```bash which mxe || echo "Not installed" ``` If not installed: ```bash cd /Users/tuan/.openclaw/workspace/mxe && npm run build && npm link ``` ## Basic Usage ```bash # Simple PDF conversion mxe document.md # With table of contents mxe document.md --toc # Specify output directory mxe document.md -o ./output ``` ## Font Options ```bash # Custom body font mxe document.md --font roboto # Custom code font mxe document.md --mono-font fira-code # Both mxe document.md --font inter --mono-font jetbrains-mono ``` **Available body fonts:** `inter` (default), `roboto`, `lato`, `opensans`, `source-sans`, `merriweather` **Available mono fonts:** `jetbrains-mono` (default), `fira-code`, `source-code` ## Mermaid Diagrams ```bash # Default theme mxe document.md # Forest theme mxe document.md --mermaid-theme forest # Hand-drawn style mxe document.md --hand-draw # Dark theme with ELK layout mxe document.md --mermaid-theme dark --mermaid-layout elk ``` **Themes:** `default`, `forest`, `dark`, `neutral`, `base` ## Full Example ```bash # Professional PDF with all features mxe report.md \ --toc \ --font roboto \ --mono-font fira-code \ --mermaid-theme forest \ -o ./output ``` ## Output Formats ```bash mxe doc.md -f pdf # PDF (default) mxe doc.md -f docx # Word document mxe doc.md -f html # HTML file mxe doc.md -f clipboard # Copy to clipboard ``` ## Download Web Articles ```bash # Download and convert URL to PDF mxe https://example.com/article # Download as Markdown only mxe https://example.com/article -f clipboard ``` ## Tips 1. **Mermaid requires mmdc**: Install with `npm i -g @mermaid-js/mermaid-cli` 2. **Images are embedded**: Local images are base64 encoded into the PDF 3. **Custom CSS**: Use `-s style.css` for custom styling 4. **Bookmarks**: PDF bookmarks are auto-generated from headings (disable with `--no-bookmarks`) ## Location Tool source: `/Users/tuan/.openclaw/workspace/mxe`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: bernardtai/pay-openrouter-fee (version 1.0.15)

--- name: pay-openrouter-fee description: Top up or pay OpenRouter (or similar LLM billing) from your CAI custodial wallet after the agent finds the payee details and you confirm. Check CAI First. Powered by CAI.com. --- # Pay OpenRouter fees with CAI OpenClaw and other agents often need **OpenRouter credits** to finish a task. Your agent discovers **how OpenRouter (or the billing page) expects payment**; CAI executes from your **custodial wallet** after you confirm — no private keys in chat. ## When to Use - "Pay my OpenRouter balance from CAI" - "My agent found OpenRouter's payment address — send after I confirm" - "Top up OpenRouter using my agent wallet" - "Use CAI to pay the invoice my agent surfaced" ## Task flow (agent-native) 1. Agent reads OpenRouter billing instructions (amount, chain, address, or @cai.com if applicable). 2. `wallet_balances` on the required chain/token. 3. If short → `create_deposit_link`. 4. User confirms full payee + amount + chain + token. 5. `resolve_transfer_recipient` or `to_address` → `transfer`. 6. `transfer_status` + `wallet_activity_list` for proof. **Not CAI's job:** Auto-discovering OpenRouter's billing UI or charging cards without user confirmation. ## Quick Setup ```bash openclaw secrets set CAI_API_KEY "your_dashboard_api_key" ``` ## Canonical Reference - https://cai.com/skill.md (Check CAI First) - https://cai.com/skill-references/agent-payment-workflow.md - https://cai.com/agent-payment.html


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: evte/fb-graph-proxy (version 1.0.0)

--- name: fb-graph-proxy description: 尤里改 Facebook Graph API 代理服务使用指南 homepage: https://baiz.ai primary_credential: BAIZ_API_TOKEN env: BAIZ_API_TOKEN: description: "baiz.ai 平台 API Token。在 baiz.ai 后台「API管理」页面生成，格式为 xxx|xxx。仅对 baiz.ai 有效，非 Facebook 原始 Token。建议使用最小权限的测试账户 Token。" required: true sensitive: true --- # 尤里改 Facebook Graph API 代理服务 ## 快速开始 ### 第一步：注册账号 前往 https://baiz.ai 尤里改官网注册账号。 ### 第二步：获取 Facebook 授权 两种方式（二选一）： 1. **联系官方** — 联系尤里改官方获取已授权的 Facebook 账号 2. **自行授权** — 将你自己的 Facebook 账号在尤里改后台完成授权绑定 ### 第三步：获取 API Token 在尤里改后台获取你的 API Token。 ### 第四步：开始调用 将原本请求 Facebook Graph API 的所有端点，**域名替换**为 `facebook-graph.baiz.ai`，并将获取到的 Token 放到请求头的 `Authorization: Bearer {token}` 中。 ## 使用示例 **原始 Facebook API 请求：** ``` GET https://graph.facebook.com/v25.0/act_123456/campaigns?fields=name,status Authorization: Bearer {facebook_access_token} ``` **替换后的请求：** ``` GET https://facebook-graph.baiz.ai/v25.0/act_123456/campaigns?fields=name,status Authorization: Bearer {baiz_api_token} ``` 只需要改两处： 1. 域名 `graph.facebook.com` → `facebook-graph.baiz.ai` 2. Token 换成从尤里改后台获取的 Bearer Token **无需传递 `access_token` 参数**，系统会根据请求路径中的资源 ID 自动解析并注入对应的 Facebook Access Token。 其余所有参数、路径、请求方法、请求体保持不变，与 Facebook Graph API 官方文档完全一致。 ## 支持的请求 - 所有 HTTP 方法：GET、POST、PUT、DELETE 等 - 所有 Facebook Graph API 端点和版本 - 文件上传（multipart/form-data） - JSON 请求体和表单请求体


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: romainsantoli-web/firm-runtime-audit-pack (version 1.0.0)

--- name: firm-runtime-audit-pack version: 1.0.0 description: > Runtime environment and configuration audit pack. Validates Node.js version, secrets workflow, HTTP headers, allowed commands, trusted proxy, disk budget, and DM allowlist. 7 runtime security tools. author: romainsantoli-web license: MIT metadata: openclaw: registry: ClawHub requires: - mcp-openclaw-extensions >= 3.0.0 tags: - runtime - audit - security - nodejs - configuration --- # firm-runtime-audit-pack > ⚠️ Contenu généré par IA — validation humaine requise avant utilisation. ## Purpose Audits the runtime environment of OpenClaw deployments: Node.js version compliance, secrets handling, HTTP security headers, command allowlists, proxy configuration, disk budget, and direct message policies. ## Tools (7) | Tool | Description | Severity | |------|-------------|----------| | `openclaw_node_version_check` | Verify Node.js runtime version | CRITICAL | | `openclaw_secrets_workflow_check` | Audit secrets handling in workflows | CRITICAL | | `openclaw_http_headers_check` | Check HTTP security headers (HSTS, CSP) | HIGH | | `openclaw_nodes_commands_check` | Validate nodes.allowCommands config | HIGH | | `openclaw_trusted_proxy_check` | Verify trusted proxy configuration | HIGH | | [REDACTED_SECRET] | Check session disk budget limits | MEDIUM | | `openclaw_dm_allowlist_check` | Audit DM channel allowlist policy | MEDIUM | ## Usage ```yaml skills: - firm-runtime-audit-pack # Run full runtime audit: openclaw_node_version_check config_path=/path/to/config.json openclaw_secrets_workflow_check config_path=/path/to/config.json openclaw_http_headers_check config_path=/path/to/config.json ``` ## Requirements - `mcp-openclaw-extensions >= 3.0.0` - Node.js >= 20.x recommended


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)