Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Latest update
What This Skill Does
Runs a structured 100-iteration security audit covering OWASP Top 10, authentication, secrets detection, infrastructure, and code quality. Each iteration performs one focused check with a pass/fail/warn result, confidence rating, and fix recommendation. Progress is saved to a report file every 10 iterations.
Combines reconnaissance, OWASP coverage, secret scanning, and infrastructure review in a single structured run rather than requiring separate tools for each concern.
When to use it
- Weekly security check before a production deployment
- Onboarding a new open-source project you're adopting
- Pre-release audit of an API with authentication endpoints
- Reviewing a containerized app for Docker and network misconfigurations
- Scanning a codebase for accidentally committed secrets or API keys
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Run a security audit on this project'
- 1Detects stack and infrastructure by reading package.json, Dockerfile, and CI config files
- 2Enumerates public endpoints, auth requirements, and environment variables in Phase 1
- 3Steps through OWASP Top 10 checks in Phase 2, reading actual code before marking any finding as FAIL
- 4Audits JWT usage, OAuth flows, secret detection, and rate limiting in Phase 3
- 5Checks container config, network exposure, TLS, SSH, and database permissions in Phases 4-5
- 6Generates a final scorecard and saves the full report to .ralph-report.md
A structured .ralph-report.md with per-finding severity, confidence level, and fix recommendations across all 100 checks