📖 技能介绍

name: security-audit description: Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.

Security Audit Skill
小葱技能7w4.net持续更新中。

When to use

Run a security audit to identify vulnerabilities in your Clawdbot setup before deployment or on a schedule. Use auto-fix to remediate common issues automatically.

Setup

No external dependencies required. Uses native system tools where available.

How to

Quick audit (common issues)

node skills/security-audit/scripts/audit.cjs

Full audit (comprehensive scan)

node skills/security-audit/scripts/audit.cjs --full

Auto-fix common issues

node skills/security-audit/scripts/audit.cjs --fix

Audit specific areas

node skills/security-audit/scripts/audit.cjs --credentials      # Check for exposed API keys
node skills/security-audit/scripts/audit.cjs --ports            # Scan for open ports
node skills/security-audit/scripts/audit.cjs --configs          # Validate configuration
node skills/security-audit/scripts/audit.cjs --permissions      # Check file permissions
node skills/security-audit/scripts/audit.cjs --docker           # Docker security checks

Generate report

node skills/security-audit/scripts/audit.cjs --full --json > audit-report.json

Output

The audit produces a report with:

Level	Description
🔴 CRITICAL	Immediate action required (exposed credentials)
🟠 HIGH	Significant risk, fix soon
🟡 MEDIUM	Moderate concern
🟢 INFO	FYI, no action needed

Checks Performed

Credentials

API keys in environment files
Tokens in command history
Hardcoded secrets in code
Weak password patterns

Ports

Unexpected open ports
Services exposed to internet
Missing firewall rules

Configs

Missing rate limiting
Disabled authentication
Default credentials
Open CORS policies

Files

World-readable files
Executable by anyone
Sensitive files in public dirs

Docker

Privileged containers
Missing resource limits
Root user in container

Auto-Fix

The --fix option automatically: - Sets restrictive file permissions (600 on .env) - Secures sensitive configuration files - Creates .gitignore if missing - Enables basic security headers

security-monitor - Real-time monitoring (available separately)

🤖 AI 评测

这个 Skill 质量中等偏上，功能覆盖全面，文档清晰易读，操作简单。优点是检查项目多，有自动修复功能，输出格式友好。缺点是使用场景受限（路径固定），偶尔会误报，部分检查不够深入。日常使用够用，但不够精细。总体是一个实用的安全检查工具，适合快速排查常见问题。

📊 多维度评分

适应性4.2

规范性4.1

有效性4.4

可靠性4

可信度4.3

📁 包含文件 (3 个)

📄 SKILL.md 2.4 KB

📄 _meta.json 133 B

📄 scripts/audit.cjs 15.2 KB

Security Audit