Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Added detailed security and privacy section outlining what leaves the machine and required permissions. - Listed used environment variables (`TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`) and binaries, including new requirement for `ufw`. - Documented all installed and distributed files, systemd units, and scripts. - Clarified the only external endpoint is Telegram API for user alerts; all scans remain local. - Provided clear installation instructions with `install.sh`. - Expanded transparency for user trust and self-audit of scripts.
What This Skill Does
LobsterGuard audits OpenClaw installations for security issues, running 68 checks across system security, network, OWASP Agentic AI Top 10, forensic detection, and skill ecosystem categories. It includes 11 auto-fixes that require explicit user confirmation before execution. A real-time gateway plugin intercepts prompt injection, path traversal, and command injection threats before they reach the agent.
Unlike generic Linux hardening tools, it targets AI agent-specific threats including OWASP Agentic AI Top 10, tool poisoning, and rogue skill detection.
When to use it
- Scanning an OpenClaw setup for firewall and kernel misconfigurations
- Auto-fixing UFW rules after a failed firewall check
- Detecting prompt injection attempts before they reach an AI agent
- Receiving Telegram alerts when suspicious skills are quarantined
- Auditing OpenClaw skill permissions for unauthorized access patterns
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Check my OpenClaw installation for security issues
- 1Runs check.py --compact to execute all 68 checks locally
- 2Displays the raw compact report showing only failed checks and overall score
- 3Identifies which failed checks have auto-fix support
- 4Presents a fix plan and asks for user confirmation before making any changes
- 5Executes fixes step-by-step, then runs verify to confirm each fix worked
Security score with list of failed checks, applied fixes, and verification results
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.