Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
trentclaw 1.4.0 - Updated internal modules: SKILL.md, __init__.py, and trent_client.py updated for improved assessment workflow or maintenance. - Removed skill-card.md (legacy or redundant documentation). - No major changes to end-user instructions or usage flow. - Version bump from 1.3.0 to 1.4.0.
What This Skill Does
Runs a three-phase security audit on OpenClaw deployments. Phase 1 checks configuration for misconfigurations, Phase 2 scans and uploads skill source code (with automatic secret redaction), and Phase 3 performs deep per-skill analysis. Results are severity-rated findings with exact fixes, including chained attack paths where multiple weak settings compound.
Combines configuration-level and skill-level analysis in a single threaded session, so the advisor can spot cross-cutting attack paths that isolated checks would miss.
When to use it
- Auditing OpenClaw config after adding new MCP servers
- Checking whether installed skills introduce security risks
- Reviewing your setup before moving to production
- Identifying chained attack paths across configuration and skills
- Verifying secret redaction before sharing skill packages
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Is my OpenClaw setup secure?'
- 1Collect OpenClaw metadata and send to Trent API for configuration audit
- 2Present severity-grouped findings from Phase 1 and ask to proceed
- 3Scan workspace skills, show what will be uploaded with redaction details
- 4Upload confirmed skills to Trent for deep analysis
- 5Run per-skill analysis using the Phase 1 thread for full context and present combined results
Severity-rated findings across configuration and skills, with diff snippets for recommended fixes and highlighted chained attack paths
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.