Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Runs a security audit against an OpenClaw gateway deployment. Executes a verified collection script, reads the output bundle, and evaluates a mandatory checklist covering network exposure, firewall status, filesystem hygiene, plugin supply chain, and config keys. Emits an OK/VULNERABLE report with severity levels, redacted evidence excerpts, and fix instructions.
Operates entirely from a strict verified allowlist, so it audits the host without executing untrusted remote content or modifying system state.
When to use it
- Checking whether an OpenClaw gateway is reachable from outside the local network
- Auditing third-party skills and plugins for supply chain risks before use
- Verifying firewall and port configuration on an OpenClaw host
- Reviewing filesystem permissions and symlinks on the gateway machine
- Producing a shareable security report before granting team access to an OpenClaw instance
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit my OpenClaw deployment and tell me if anything is vulnerable
- 1Run scripts/collect_verified.sh in the current working directory
- 2Read verified-bundle.json and extract host metadata (OS, OpenClaw version, config path, runtime context)
- 3Evaluate every check in references/required-checks.md against evidence from the bundle
- 4Build a threat model summary using references/threat-model.md aligned with findings
- 5Emit a findings table with severity, evidence excerpts (redacted), and per-finding fix instructions
Structured OK/VULNERABLE report listing each check, its severity, a cited evidence key with redacted excerpt, and remediation steps