Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Added Trust Hierarchy, Prompt Injection Mitigation, Sandboxing levels, Browser Control Risks, Incident Response, Secret Scanning, Vulnerability Reporting. 13 domains.
What This Skill Does
A read-only security audit framework that teaches Clawdbot to inspect its own configuration across 13 domains, including gateway exposure, access control policies, credential storage, file permissions, and prompt injection protection. It detects misconfigurations and outputs prioritized findings with specific remediation steps. No configuration changes are made during the audit.
Unlike a static script, this skill embeds the security framework as knowledge so Clawdbot can apply it dynamically and new checks can be added by updating the skill file.
When to use it
- Checking if the gateway is exposed to the network without authentication
- Auditing DM and group access policies before sharing a bot with a team
- Verifying credential file permissions after migrating to a new server
- Reviewing browser control exposure when enabling remote access features
- Running a deep audit after suspecting unauthorized access to the bot
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: run security audit --deep
- 1Locates clawdbot.json config file across known paths
- 2Checks gateway binding, auth token presence, and WebSocket auth settings
- 3Inspects DM policy, group access controls, and credential file permissions
- 4Evaluates tool sandboxing, logging redaction, and prompt injection protections
- 5Generates severity-ranked report with findings and remediation commands
Formatted audit report listing critical, high, and medium findings with specific config changes to apply