Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
A security audit toolkit covering OWASP Top 10 detection, dependency vulnerability scanning, secret detection, SSL/TLS verification, and AI agent security checks. Produces a quantified 0-100 security score with categorized findings. Supports JavaScript, TypeScript, Python, Go, Java, Rust, PHP, Ruby, and Solidity.
Consolidates OWASP scanning, dependency analysis, secret detection, SSL verification, and AI-specific security checks into a single scored workflow rather than requiring separate tools for each concern.
When to use it
- Scanning a codebase for hardcoded API keys before a code review
- Running OWASP Top 10 compliance checks before a security audit
- Detecting floating-point precision issues in AI agent financial logic
- Checking npm, pip, or cargo dependencies for known CVEs
- Verifying SSL/TLS certificate validity and cipher suite support on a live domain
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Run a full security audit on my Node.js codebase
- 1Execute ./scripts/security-audit.sh --full to run all audit modules
- 2Scan source files for OWASP Top 10 patterns including injection, broken access control, and XSS
- 3Run npm audit to detect dependency vulnerabilities and flag high/critical findings
- 4Search for hardcoded secrets matching 70+ patterns including AWS keys, OpenAI tokens, and private keys
- 5Calculate a 0-100 security score weighted across OWASP compliance, dependencies, secrets, SSL, and AI agent risks
Security report with an overall score (e.g., 72/100 Medium Risk), findings grouped by severity with file paths and line numbers, and specific remediation steps for each issue