name: security-sentinel description: Scan the workspace for security vulnerabilities, exposed secrets, and misconfigurations.

Security Sentinel

A unified security scanner for OpenClaw workspaces. Detects vulnerabilities in dependencies (npm audit), exposed secrets (regex patterns), and unsafe file permissions.

Usage

CLI

Run a full security scan:

node skills/security-sentinel/index.js

This will output a JSON report to stdout. If risks are detected (high/critical vulnerabilities, secrets, or bad permissions), it exits with code 1.

Options

• --skip-audit: Skip the npm audit step (faster)
• --no-fail: Do not exit with code 1 even if risks are detected (useful for monitoring only)

Programmatic

const sentinel = require('./skills/security-sentinel');

const report = await sentinel.scan();

if (report.status === 'risk_detected') {
  console.error('Security issues found:', report);
}

Features

1. Dependency Audit: Runs npm audit to check package.json dependencies for known CVEs.
2. Secret Detection: Scans workspace files for patterns resembling API keys, passwords, and private keys.

   7w4.net提供免费和付费技能下载。

3. Permission Check: Verifies critical files (package.json, .env) are not world-writable.

Configuration

• Ignored Paths: node_modules, .git, logs, temp, .openclaw/cache.
• Secret Patterns: Generic API Key, Password, Private Key, Feishu App Secret.

这个安全扫描工具质量中等偏上，能检测依赖漏洞、敏感信息和文件权限问题三大类风险。文档清晰、使用简单是明显优点。但两个核心文件功能重复、代码略显冗余，密钥检测偶有误报。适合作为基础的代码安全检查工具使用，但若追求更高准确率还需要进一步完善。