OpenClaw Security Audit Skill
Run a comprehensive security audit on the current OpenClaw installation. Checks 6 security domains: gateway, credentials, channels, tools & sandbox, network, and system (macOS).
When to Use
- User asks to "check security", "audit security", "run security check", or "is my openclaw secure?"
- User mentions concerns about API key leaks, exposed ports, or privacy
- User wants to verify their OpenClaw configuration is safe
- After changing OpenClaw config (gateway, channels, tools, etc.)
When NOT to Use
- User is asking about general (non-OpenClaw) system security
- User wants to audit a different application
- User is just asking what OpenClaw is
How to Run
The audit tool is located at {baseDir}/../../. Run checks individually or all at once.
Quick Check (critical items only)
bash {baseDir}/../../checks/gateway.sh && bash {baseDir}/../../checks/credentials.sh
Full Audit (all 6 modules)
for check in gateway credentials channels tools network system; do
bash {baseDir}/../../checks/${check}.sh
done
Individual Checks
Run a specific module when the user asks about a particular area:
| User asks about |
Run |
| Gateway, ports, binding, auth |
bash {baseDir}/../../checks/gateway.sh |
| API keys, passwords, tokens, permissions |
bash {baseDir}/../../checks/credentials.sh |
| WhatsApp, Telegram, DM policy, channels |
bash {baseDir}/../../checks/channels.sh |
| Sandbox, tools, denyCommands |
bash {baseDir}/../../checks/tools.sh |
| IP leak, exposed ports, firewall |
bash {baseDir}/../../checks/network.sh |
| SIP, FileVault, TCC, iCloud |
bash {baseDir}/../../checks/system.sh |
Auto-Fix
When issues are found and the user wants to fix them:
bash {baseDir}/../../fixes/interactive-fix.sh
Or run specific fixes:
bash {baseDir}/../../fixes/gateway-fix.sh — bind to localhost, generate strong tokenbash {baseDir}/../../fixes/permission-fix.sh — fix file/directory permissionsbash {baseDir}/../../fixes/channel-fix.sh — fix DM policy, allowFrom, requireMention
Generate Report
bash {baseDir}/../../audit.sh
Then select option 5 for HTML/JSON report.
Output Format
Each check outputs lines in the format:
[PASS] — check passed, no action needed[WARN] — potential issue, review recommended[FAIL] — security issue found, fix recommended[SKIP] — check skipped (component not installed/found)
Important Notes
- This tool is read-only by default. Fix scripts require explicit user confirmation.
- The IP leak check (in network module) will ask before sending your IP to external services.
- All checks gracefully skip if OpenClaw is not installed.
1---2name: security-audit3description: Run OpenClaw security audit — check gateway, credentials, channels, tools, network, and system security4---56# OpenClaw Security Audit Skill78Run a comprehensive security audit on the current OpenClaw installation. Checks 6 security domains: gateway, credentials, channels, tools & sandbox, network, and system (macOS).910## When to Use1112- User asks to "check security", "audit security", "run security check", or "is my openclaw secure?"13- User mentions concerns about API key leaks, exposed ports, or privacy14- User wants to verify their OpenClaw configuration is safe15- After changing OpenClaw config (gateway, channels, tools, etc.)1617## When NOT to Use1819- User is asking about general (non-OpenClaw) system security20- User wants to audit a different application21- User is just asking what OpenClaw is2223## How to Run2425The audit tool is located at `{baseDir}/../../`. Run checks individually or all at once.2627### Quick Check (critical items only)2829```bash30bash {baseDir}/../../checks/gateway.sh && bash {baseDir}/../../checks/credentials.sh31```3233### Full Audit (all 6 modules)3435```bash36for check in gateway credentials channels tools network system; do37 bash {baseDir}/../../checks/${check}.sh38done39```4041### Individual Checks4243Run a specific module when the user asks about a particular area:4445| User asks about | Run |46|----------------|-----|47| Gateway, ports, binding, auth | `bash {baseDir}/../../checks/gateway.sh` |48| API keys, passwords, tokens, permissions | `bash {baseDir}/../../checks/credentials.sh` |49| WhatsApp, Telegram, DM policy, channels | `bash {baseDir}/../../checks/channels.sh` |50| Sandbox, tools, denyCommands | `bash {baseDir}/../../checks/tools.sh` |51| IP leak, exposed ports, firewall | `bash {baseDir}/../../checks/network.sh` |52| SIP, FileVault, TCC, iCloud | `bash {baseDir}/../../checks/system.sh` |5354### Auto-Fix5556When issues are found and the user wants to fix them:5758```bash59bash {baseDir}/../../fixes/interactive-fix.sh60```6162Or run specific fixes:63- `bash {baseDir}/../../fixes/gateway-fix.sh` — bind to localhost, generate strong token64- `bash {baseDir}/../../fixes/permission-fix.sh` — fix file/directory permissions65- `bash {baseDir}/../../fixes/channel-fix.sh` — fix DM policy, allowFrom, requireMention6667### Generate Report6869```bash70bash {baseDir}/../../audit.sh71```72Then select option 5 for HTML/JSON report.7374## Output Format7576Each check outputs lines in the format:77- `[PASS]` — check passed, no action needed78- `[WARN]` — potential issue, review recommended79- `[FAIL]` — security issue found, fix recommended80- `[SKIP]` — check skipped (component not installed/found)8182## Important Notes8384- This tool is **read-only by default**. Fix scripts require explicit user confirmation.85- The **IP leak check** (in network module) will ask before sending your IP to external services.86- All checks gracefully skip if OpenClaw is not installed.
sunt23310-ops