Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Audits API code against a 10-point security checklist covering rate limiting, input validation, authentication, CORS, security headers, injection prevention, error handling, request size limits, versioning, and logging. Produces a structured report with before/after code examples for each issue found, scored by priority. Works with Express.js, Flask, Gin, and Fastify.
It pairs each finding with concrete before/after code so fixes can be applied immediately without additional research.
When to use it
- Auditing an Express.js API before production launch
- Identifying rate limiting gaps on login and password reset endpoints
- Reviewing CORS configuration for a multi-tenant SaaS API
- Checking JWT validation logic in existing auth middleware
- Generating a scored security report before a client or compliance review
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Review this Express.js API for security vulnerabilities'
- 1Identify the framework and parse the provided API code
- 2Run each of the 10 hardening checks against the code
- 3Score each category as PASS, WARN, or FAIL
- 4Generate before/after code examples for each WARN or FAIL finding
- 5Output a structured hardening report with an overall score and prioritized quick wins
Hardening report with a score out of 10, a per-check status table, and code-level fixes for each identified issue