Skill: iaadoa/security-audit-openclaw (version 1.0.2)

--- name: openclaw-security version: 1.0.2 description: | ⚠️ HIGH PRIVILEGE SECURITY AUDIT SKILL Performs comprehensive security auditing for OpenClaw deployments. Requires system-level access for legitimate security scanning purposes. All operations are read-only and local-only. Covers: environment isolation, privilege checks, port exposure, skill trust sources, version checks, process monitoring, sensitive directory changes, cron jobs, SSH audits, file integrity baselines, yellow-line operation audits, disk usage, environment variable leak detection, DLP scanning (private key/mnemonic detection), skill/MCP integrity tracking, and disaster recovery backups. Use when: security audits, firewall/SSH/update hardening, risk posture review, exposure assessment, or periodic security checks on machines running OpenClaw (laptop, workstation, Pi, VPS). --- # OpenClaw Security Audit Comprehensive security auditing for OpenClaw deployments. This skill performs automated security checks and generates reports. > **⚠️ Security Notice**: This skill requires elevated system access for legitimate security auditing purposes. See [SECURITY.md](./SECURITY.md) for detailed security declarations and data handling policies. ## Quick Start Run the security audit script: ```bash python3 scripts/openclaw_security_audit.py ``` This generates: - **Brief summary** printed to stdout - **Detailed report** saved to `/tmp/openclaw-security-reports/report-{DATE}.txt` ## What It Checks | Check | Description | |-------|-------------| | Environment Isolation | Detects Docker/container/VM environments | | Privilege Check | Verifies OpenClaw isn't running as root | | Port Exposure | Checks if Gateway port 18789 is exposed | | Skill Trust | Lists installed skills and their sources | | Version Check | Compares current vs latest OpenClaw version | | Process & Network | Captures listening ports and top processes | | Sensitive Directories | Counts file changes in /etc, ~/.ssh, etc. | | System Cron | Lists system timers and cron jobs | | OpenClaw Cron | Retrieves internal OpenClaw scheduled tasks | | SSH Audit | Recent logins and failed SSH attempts | | File Integrity | SHA256 hash and permission checks | | Yellow Line Audit | Compares sudo logs with memory records | | Disk Usage | Root partition usage and large files | | Environment Variables | Scans Gateway process for sensitive vars | | DLP Scan | Detects plaintext private keys/mnemonics (read-only) | | Skill/MCP Integrity | Tracks file hash changes over time | | Disaster Recovery | Auto-commits OpenClaw state to Git (opt-in) | ## Security & Privacy ### Data Handling - **All scans are local-only** - No data leaves your machine - **Read-only operations** - No system modifications (except opt-in features) - **Opt-in external features** - Git backup and Telegram notifications are disabled by default ### Sensitive Operations See [SECURITY.md](./SECURITY.md) for detailed explanations of: - DLP scanning (private key/mnemonic detection) - Environment variable auditing - Git disaster recovery ### Required Permissions This skill requires system access for: - Running system commands (`ss`, `top`, `systemctl`, etc.) - Reading OpenClaw configuration files - Inspecting Gateway process environment - Scanning workspace files for credential leaks ## Output Format ### Brief Format (stdout) ``` OpenClaw Daily Security Brief (2026-03-11) [OK] Environment Isolation: Running in isolated environment [OK] Privilege Check: Complies with least privilege principle [WARNING] Port Exposure: Port 18789 listening on all interfaces, recommend binding to 127.0.0.1 ... Warning Items: [WARNING] Port Exposure: Port 18789 listening on all interfaces, recommend binding to 127.0.0.1 ``` ### Detailed Report Full report saved to `/tmp/openclaw-security-reports/report-{DATE}.txt` ## Configuration ### Optional Features (Disabled by Default) To enable external operations, set the following environment variables: #### Git Disaster Recovery ```bash export SECURITY_AUDIT_ENABLE_GIT=1 ``` Enables automatic Git commit and push of OpenClaw state to your configured remote. #### Telegram Notifications ```bash export SECURITY_AUDIT_ENABLE_TELEGRAM=1 export TELEGRAM_BOT_TOKEN="your-bot-token" export TELEGRAM_CHAT_ID="your-chat-id" ``` Sends audit summary to Telegram after each run. ### Scheduling To run daily via OpenClaw cron: ```bash openclaw cron add --name "daily-security-audit" --schedule "0 9 * * *" --command "python3 ~/.openclaw/workspace/skills/openclaw-security/scripts/openclaw_security_audit.py" ``` ## Version History | Version | Date | Changes | |---------|------|---------| | 1.0.2 | 2026-03-16 | Made Git backup and Telegram opt-in features (disabled by default) | | 1.0.1 | 2026-03-16 | Added SECURITY.md, enhanced documentation | | 1.0.0 | 2026-03-13 | Initial release |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)