Security Agent

Scan all open ports on localhost and detect unexpected listeners across all services

Scan all service logs for error spikes, failed auth attempts, and suspicious access patterns

Check all running processes on the system for anomalies, unknown services, and resource abuse

After each daily scan, analyze findings, update the baseline, suppress dismissed issues, and improve future heuristics

Audit Docker containers for security misconfigurations, exposed ports, and resource abuse

Scan all project files for exposed secrets, tokens, and credentials — including git history

Scan all npm packages across all services for known CVEs and outdated critical packages

Audit OpenClaw browser extension security — tab access scope, CDP connections, and skills with sensitive permissions

Monitor active outbound connections from all services and flag unexpected destinations