Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Latest update
What This Skill Does
A 1,000-iteration security audit that runs approximately 4-8 hours across 8 structured phases. Each iteration performs one targeted check with a CVSS score, confidence level, and specific remediation. Four expert personas rotate through phases covering OWASP Top 10, authentication, infrastructure, supply chain, and compliance.
Structures 1,000 individual checks into resumable phases with checkpoint saves every 50 iterations, so audits survive context limits without losing progress.
When to use it
- Pre-release security audit before shipping a major version
- Compliance audit preparation for GDPR or SOC 2 reviews
- Post-incident investigation of a compromised codebase
- Deep follow-up after a lighter audit flags suspicious patterns
- CI/CD pipeline and container security hardening review
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Run a full deep security audit before the v2.0 release
- 1Auto-detects stack, git state, Dockerfiles, and CI/CD config in iteration 1
- 2Runs 100 reconnaissance checks mapping endpoints, auth flows, exposed ports, and undeclared services
- 3Executes OWASP Top 10 deep dive across iterations 101-250 using a Code Auditor persona
- 4Audits secrets, JWT configuration, OAuth flows, and rate limiting in phase 3, then container and network security in phase 4
- 5Saves checkpoint to .ralph-report.md every 50 iterations and generates a scored final report at iteration 1000
.ralph-report.md with CVSS-scored findings organized by severity, proof-of-concept exploits where applicable, and specific file-level remediation steps