How do I install the Openclaw Shield skill?

Run npx skillmds@latest add modbender/openclaw-shield in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Openclaw Shield safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Openclaw Shield?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Openclaw Shield free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Openclaw Shield?

modbender (@modbender) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Openclaw Shield by modbender — Agent Skill

Name: Openclaw Shield
Rating: 4.2 (5 reviews)
Author: modbender

Openclaw Shield

Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.

modbender Updated Sep 9, 2026 12 repo stars

File contents

OpenClaw Shield — Security Audit

Audit any OpenClaw config for security vulnerabilities, misconfigurations, and best-practice violations. Produces a structured JSON report with risk scores, findings, and remediation steps.

When to Use

User asks to check/audit/review their OpenClaw security
User wants to harden their config before deploying
User is setting up a new OpenClaw instance
User asks about secret leakage or API key exposure in their config
Before publishing or sharing any config file

Quick Audit (live config)

node scripts/shield-audit.sh

Or directly:

node SKILL_DIR/bin/shield.js audit ~/.openclaw/openclaw.json --summary

What It Checks (11 categories)

Gateway Auth — missing/weak auth, insecure UI settings
Network Exposure — bind address, Tailscale funnel, wildcard proxies
Channel Security — wildcard allowFrom, missing allowlists
DM Policy — open DM policy without pairing
Subagent Permissions — wildcard allowAgents, circular delegation chains, self-delegation
Tool Permissions — over-privileged agents with tools.profile: "full"
Secret Leakage — API keys, tokens, private keys in plaintext config
Sandbox/Execution — missing workspace isolation, no execution policies
Plugin Config — enabled plugins without channel config
Heartbeat Exposure — sensitive data in heartbeat prompts
Remote Config — unencrypted WebSocket, exposed remote URLs/tokens

Usage

Audit a config file

node SKILL_DIR/bin/shield.js audit <config.json>
node SKILL_DIR/bin/shield.js audit <config.json> --summary   # human-readable

Audit from stdin

cat config.json | node SKILL_DIR/bin/shield.js audit --stdin

Sanitize a config (strip secrets)

node SKILL_DIR/bin/shield.js sanitize <config.json>

Programmatic use

const { auditConfig } = require('SKILL_DIR/src/audit');
const config = require('./openclaw.json');
const report = auditConfig(config);
console.log(report.risk_level);      // "CRITICAL" | "HIGH" | "MEDIUM" | "LOW"
console.log(report.overall_score);   // 0-100
console.log(report.vulnerabilities); // detailed findings

Output

Returns JSON with: risk_level, overall_score (0-100), vulnerabilities[], vulnerability_count, best_practices_compliance, action_recommended, safe_to_deploy, audit_timestamp.

Workflow for Agent

Load the user's config: cat ~/.openclaw/openclaw.json
Run: node SKILL_DIR/bin/shield.js audit ~/.openclaw/openclaw.json --summary
Present findings to user with prioritized recommendations
Offer to sanitize before sharing: node SKILL_DIR/bin/shield.js sanitize <file>

---name: openclaw-shielddescription: Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.--- # OpenClaw Shield — Security Audit Audit any OpenClaw config for security vulnerabilities, misconfigurations, and best-practice violations. Produces a structured JSON report with risk scores, findings, and remediation steps. ## When to Use - User asks to check/audit/review their OpenClaw security - User wants to harden their config before deploying - User is setting up a new OpenClaw instance - User asks about secret leakage or API key exposure in their config - Before publishing or sharing any config file ## Quick Audit (live config) ```bash node scripts/shield-audit.sh ``` Or directly: ```bash node SKILL_DIR/bin/shield.js audit ~/.openclaw/openclaw.json --summary ``` ## What It Checks (11 categories) 1. **Gateway Auth** — missing/weak auth, insecure UI settings 2. **Network Exposure** — bind address, Tailscale funnel, wildcard proxies 3. **Channel Security** — wildcard allowFrom, missing allowlists 4. **DM Policy** — open DM policy without pairing 5. **Subagent Permissions** — wildcard allowAgents, circular delegation chains, self-delegation 6. **Tool Permissions** — over-privileged agents with tools.profile: "full" 7. **Secret Leakage** — API keys, tokens, private keys in plaintext config 8. **Sandbox/Execution** — missing workspace isolation, no execution policies 9. **Plugin Config** — enabled plugins without channel config 10. **Heartbeat Exposure** — sensitive data in heartbeat prompts 11. **Remote Config** — unencrypted WebSocket, exposed remote URLs/tokens ## Usage ### Audit a config file ```bash node SKILL_DIR/bin/shield.js audit <config.json> node SKILL_DIR/bin/shield.js audit <config.json> --summary # human-readable ``` ### Audit from stdin ```bash cat config.json | node SKILL_DIR/bin/shield.js audit --stdin ``` ### Sanitize a config (strip secrets) ```bash node SKILL_DIR/bin/shield.js sanitize <config.json> ``` ### Programmatic use ```javascript const { auditConfig } = require('SKILL_DIR/src/audit'); const config = require('./openclaw.json'); const report = auditConfig(config); console.log(report.risk_level); // "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" console.log(report.overall_score); // 0-100 console.log(report.vulnerabilities); // detailed findings ``` ## Output Returns JSON with: `risk_level`, `overall_score` (0-100), `vulnerabilities[]`, `vulnerability_count`, `best_practices_compliance`, `action_recommended`, `safe_to_deploy`, `audit_timestamp`. ## Workflow for Agent 1. Load the user's config: `cat ~/.openclaw/openclaw.json` 2. Run: `node SKILL_DIR/bin/shield.js audit ~/.openclaw/openclaw.json --summary` 3. Present findings to user with prioritized recommendations 4. Offer to sanitize before sharing: `node SKILL_DIR/bin/shield.js sanitize <file>`

Frequently asked questions