Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Clawstrike audits an OpenClaw gateway deployment for misconfigurations and real-world attack paths. It runs a verified collection script, evaluates configuration, network exposure, filesystem hygiene, and installed skills/plugins, then produces an OK/VULNERABLE report with severity ratings, evidence excerpts, and fix instructions.
Produces a structured, evidence-backed report with automatic secret redaction instead of requiring manual ad-hoc checks across config files, network state, and plugin directories.
When to use it
- Checking whether a self-hosted OpenClaw gateway is reachable without authentication
- Auditing installed skills and plugins for supply chain risks before a team deployment
- Verifying firewall and port exposure on an OpenClaw host
- Reviewing filesystem permissions and SUID/SGID binaries on the gateway machine
- Generating a shareable security report before granting colleagues access to an OpenClaw instance
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: audit my OpenClaw deployment and tell me if anything is vulnerable
- 1Run scripts/collect_verified.sh in the current working directory to gather system evidence
- 2Read verified-bundle.json to obtain timestamp, OS, OpenClaw version, config path, and runtime context
- 3Evaluate every required check from references/required-checks.md against evidence in the bundle
- 4Build a concise threat model aligned with the findings using references/threat-model.md
- 5Emit a findings table with severity, evidence excerpts, and fix instructions for each issue
A structured OK/VULNERABLE report listing each check result, severity level, redacted evidence, and remediation steps