How do I install the Security Guide skill?

Run npx skillmds@latest add jnmetacode/security-guide in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Guide safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Guide?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Guide free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Guide?

jnMetaCode (@jnmetacode) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Guide by jnmetacode — Agent Skill

Name: Security Guide
Author: jnMetaCode

File contents

ShellWard Security Deployment Guide / 安全部署指南

When the user invokes this skill, provide a complete security deployment checklist based on the following best practices. Check the current system state using available tools and give actionable recommendations.

Security Checklist

1. Network Control / 网络控制

Check if OpenClaw gateway port (19000/19001) is exposed to public network
Recommend binding to 127.0.0.1 or using a reverse proxy with authentication
Suggest firewall rules: ufw allow from 127.0.0.1 to any port 19000
For cloud servers: check security group rules

2. Container Isolation / 容器隔离

Recommend running OpenClaw in Docker with restricted capabilities:

docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE \
  --read-only --tmpfs /tmp \
  -u 1000:1000 \
  openclaw

Suggest resource limits: --memory=2g --cpus=1
Mount only necessary directories

3. Credential Management / 凭证管理

Scan for plaintext secrets in .env, .bashrc, environment variables
Recommend using a secret manager (Vault, doppler, etc.)
Check file permissions on sensitive files (should be 0600)
Suggest chmod 600 ~/.env ~/.ssh/* ~/.aws/credentials

4. Audit Logging / 审计日志

Verify ShellWard audit log is active at ~/.openclaw/shellward/audit.jsonl
Show recent security events
Recommend log rotation and backup strategy
Suggest sending critical events to external SIEM

5. Plugin Security / 插件安全

List all installed plugins and check for known risks
Disable auto-update for plugins
Only install from trusted sources
Scan plugin code for suspicious patterns

6. Patch Management / 补丁管理

Check current OpenClaw version
Report known vulnerabilities for current version
Recommend upgrade path
Check Node.js version (must be >= 22.12)

Available Commands

Remind the user about ShellWard's quick commands:

/security — Full security status overview
/audit [count] [filter] — View audit log
/harden — Scan for issues, /harden fix to auto-fix
/scan-plugins — Scan plugins for security risks
/check-updates — Check versions and vulnerabilities

Response Style

Be concise and actionable
Use the user's language (detect from their message)
Prioritize critical issues first
For each issue, provide the exact command to fix it
Ask for confirmation before executing destructive operations

---name: security-guidedescription: OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation---# ShellWard Security Deployment Guide / 安全部署指南When the user invokes this skill, provide a complete security deployment checklist based on the following best practices. Check the current system state using available tools and give actionable recommendations.## Security Checklist### 1. Network Control / 网络控制- Check if OpenClaw gateway port (19000/19001) is exposed to public network- Recommend binding to 127.0.0.1 or using a reverse proxy with authentication- Suggest firewall rules: `ufw allow from 127.0.0.1 to any port 19000`- For cloud servers: check security group rules### 2. Container Isolation / 容器隔离- Recommend running OpenClaw in Docker with restricted capabilities: ``` docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE \ --read-only --tmpfs /tmp \ -u 1000:1000 \ openclaw ```- Suggest resource limits: `--memory=2g --cpus=1`- Mount only necessary directories### 3. Credential Management / 凭证管理- Scan for plaintext secrets in .env, .bashrc, environment variables- Recommend using a secret manager (Vault, doppler, etc.)- Check file permissions on sensitive files (should be 0600)- Suggest `chmod 600 ~/.env ~/.ssh/* ~/.aws/credentials`### 4. Audit Logging / 审计日志- Verify ShellWard audit log is active at ~/.openclaw/shellward/audit.jsonl- Show recent security events- Recommend log rotation and backup strategy- Suggest sending critical events to external SIEM### 5. Plugin Security / 插件安全- List all installed plugins and check for known risks- Disable auto-update for plugins- Only install from trusted sources- Scan plugin code for suspicious patterns### 6. Patch Management / 补丁管理- Check current OpenClaw version- Report known vulnerabilities for current version- Recommend upgrade path- Check Node.js version (must be >= 22.12)## Available CommandsRemind the user about ShellWard's quick commands:- `/security` — Full security status overview- `/audit [count] [filter]` — View audit log- `/harden` — Scan for issues, `/harden fix` to auto-fix- `/scan-plugins` — Scan plugins for security risks- `/check-updates` — Check versions and vulnerabilities## Response Style- Be concise and actionable- Use the user's language (detect from their message)- Prioritize critical issues first- For each issue, provide the exact command to fix it- Ask for confirmation before executing destructive operations

Frequently asked questions

Security Guide