security-audit
A hostile-by-design, fail-closed audit workflow for codebases and OpenClaw/ClawHub skills.
It does not try to answer “does this skill work?”.
It tries to answer: “can this skill betray the system?”
What it checks (high level)
This skill’s scripts combine multiple layers:
- Secrets / credential leakage: trufflehog
- Static analysis: semgrep (auto rules)
- Hostile repo audit (custom): prompt-injection signals, persistence mechanisms, suspicious artifacts, dependency hygiene
If any layer fails, the overall audit is FAIL.
Run an audit (JSON)
From this skill folder (use bash so it works even if executable bits were not preserved by a zip download):
bash scripts/run_audit_json.sh <path>
Example:
bash scripts/run_audit_json.sh . > /tmp/audit.json
jq '.ok, .tools' /tmp/audit.json
Security levels (user configurable)
Set the strictness level (default: standard):
OPENCLAW_AUDIT_LEVEL=standard bash scripts/run_audit_json.sh <path>
OPENCLAW_AUDIT_LEVEL=strict bash scripts/run_audit_json.sh <path>
OPENCLAW_AUDIT_LEVEL=paranoid bash scripts/run_audit_json.sh <path>
standard: pragmatic strict defaults (lockfiles required; install hooks/persistence/prompt-injection signals fail)strict: more patterns become hard FAIL (e.g. minified/obfuscation artifacts)paranoid: no "best-effort" hashing failures; more fail-closed behavior
Manifest requirement (for zero-trust install workflows)
For strict/quarantine workflows, require a machine-readable intent/permissions manifest at repo root:
If a repo/skill does not provide this manifest, the hostile audit should treat it as FAIL.
See: docs/OPENCLAW_SKILL_MANIFEST_SCHEMA.md.
Optional: execution sandbox (Docker)
Docker is optional here. This skill can be used for static auditing without Docker.
If you want to execute any generated/untrusted code, run it in a separate sandbox workflow (recommended).
Files
scripts/run_audit_json.sh — main JSON audit runnerscripts/hostile_audit.py — prompt-injection/persistence/dependency hygiene scannerscripts/security_audit.sh — convenience wrapper (always returns JSON, never non-zero)openclaw-skill.json — machine-readable intent/permissions manifest
1---
2name: security-audit-2
3description: "Fail-closed security auditing for OpenClaw/ClawHub skills & repos: trufflehog secrets scanning, semgrep SAST, prompt-injection/persistence signals, and supply-chain hygiene checks before enabling or installing."
4metadata: {"openclaw":{"emoji":"🛡️","requires":{"bins":["jq","trufflehog","semgrep","python3"]},"install":[{"id":"apt-jq","kind":"apt","package":"jq","bins":["jq"],"label":"Install jq (apt)"},{"id":"apt-ghog","kind":"apt","package":"python3","bins":["python3"],"label":"Install Python 3 (apt)"},{"id":"apt-trufflehog","kind":"apt","package":"trufflehog","bins":["trufflehog"],"label":"Install trufflehog (apt)"},{"id":"pipx-semgrep","kind":"shell","label":"Install semgrep (pipx)","command":"python3 -m pip install --user pipx && python3 -m pipx ensurepath && pipx install semgrep"},{"id":"brew-jq","kind":"brew","formula":"jq","bins":["jq"],"label":"Install jq (brew)"},{"id":"brew-trufflehog","kind":"brew","formula":"trufflehog","bins":["trufflehog"],"label":"Install trufflehog (brew)"},{"id":"brew-semgrep","kind":"brew","formula":"semgrep","bins":["semgrep"],"label":"Install semgrep (brew)"}]}}
5---
6
7# security-audit
8
9A hostile-by-design, **fail-closed** audit workflow for codebases and OpenClaw/ClawHub skills.
10
11It does **not** try to answer “does this skill work?”.
12It tries to answer: **“can this skill betray the system?”**
13
14## What it checks (high level)
15
16This skill’s scripts combine multiple layers:
17
18- **Secrets / credential leakage:** trufflehog
19- **Static analysis:** semgrep (auto rules)
20- **Hostile repo audit (custom):** prompt-injection signals, persistence mechanisms, suspicious artifacts, dependency hygiene
21
22If any layer fails, the overall audit is **FAIL**.
23
24## Run an audit (JSON)
25
26From this skill folder (use `bash` so it works even if executable bits were not preserved by a zip download):
27
28```bash
29bash scripts/run_audit_json.sh <path>
30```
31
32Example:
33
34```bash
35bash scripts/run_audit_json.sh . > /tmp/audit.json
36jq '.ok, .tools' /tmp/audit.json
37```
38
39### Security levels (user configurable)
40
41Set the strictness level (default: `standard`):
42
43```bash
44OPENCLAW_AUDIT_LEVEL=standard bash scripts/run_audit_json.sh <path>
45OPENCLAW_AUDIT_LEVEL=strict bash scripts/run_audit_json.sh <path>
46OPENCLAW_AUDIT_LEVEL=paranoid bash scripts/run_audit_json.sh <path>
47```
48
49- `standard`: pragmatic strict defaults (lockfiles required; install hooks/persistence/prompt-injection signals fail)
50- `strict`: more patterns become hard FAIL (e.g. minified/obfuscation artifacts)
51- `paranoid`: no "best-effort" hashing failures; more fail-closed behavior
52
53## Manifest requirement (for zero-trust install workflows)
54
55For strict/quarantine workflows, require a machine-readable intent/permissions manifest at repo root:
56
57- `openclaw-skill.json`
58
59If a repo/skill does not provide this manifest, the hostile audit should treat it as **FAIL**.
60
61See: `docs/OPENCLAW_SKILL_MANIFEST_SCHEMA.md`.
62
63## Optional: execution sandbox (Docker)
64
65Docker is **optional** here. This skill can be used for static auditing without Docker.
66
67If you want to execute any generated/untrusted code, run it in a separate sandbox workflow (recommended).
68
69## Files
70
71- `scripts/run_audit_json.sh` — main JSON audit runner
72- `scripts/hostile_audit.py` — prompt-injection/persistence/dependency hygiene scanner
73- `scripts/security_audit.sh` — convenience wrapper (always returns JSON, never non-zero)
74- `openclaw-skill.json` — machine-readable intent/permissions manifest
sundial-org