Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Audits codebases, infrastructure, and AI agent workspaces for security vulnerabilities. Covers dependency scanning, secret detection, OWASP web top 10 patterns, SSL/TLS verification, and file permissions. Also addresses agentic-specific risks including prompt injection, identity spoofing, memory poisoning, and multi-agent communication security based on OWASP Agentic Top 10 (2026).
Combines traditional code and infrastructure security checks with agentic AI-specific audits in one skill, covering attack surfaces that standard security tools miss entirely.
When to use it
- Scanning Node.js or Python dependencies for known CVEs before a release
- Detecting hardcoded API keys or credentials committed to a git repository
- Auditing an AI agent workspace for prompt injection vectors in agent-facing content
- Verifying SSL certificate validity and checking for disabled SSL verification in code
- Reviewing agent identity verification rules and access boundaries before exposing an agent to external interactions
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Run a full security audit on my project'
- 1Runs dependency vulnerability scan using npm audit, pip-audit, or govulncheck depending on project type
- 2Searches source files for hardcoded secrets, API keys, and credentials using grep patterns against git history and current files
- 3Checks for OWASP top 10 patterns including SQL injection, XSS, CORS misconfiguration, and disabled SSL verification
- 4Verifies SSL certificate validity and supported TLS versions on any configured endpoints
- 5If agent workspace files are present, runs agentic audit checking for prompt injection patterns, missing authorized-sender rules, and override instructions in memory files
Report listing critical issues and warnings by category with exit code 1 if critical issues are found