OpenClaw Security Audit
📖 技能介绍
name: openclaw-security version: 1.0.2 description: | ⚠️ HIGH PRIVILEGE SECURITY AUDIT SKILL
Performs comprehensive security auditing for OpenClaw deployments. Requires system-level access for legitimate security scanning purposes. All operations are read-only and local-only.
Covers: environment isolation, privilege checks, port exposure, skill trust sources, version checks, process monitoring, sensitive directory changes, cron jobs, SSH audits, file integrity baselines, yellow-line operation audits, disk usage, environment variable leak detection, DLP scanning (private key/mnemonic detection), skill/MCP integrity tracking, and disaster recovery backups.
Use when: security audits, firewall/SSH/update hardening, risk posture review, exposure assessment, or periodic security checks on machines running OpenClaw (laptop, workstation, Pi, VPS).
OpenClaw Security Audit
Comprehensive security auditing for OpenClaw deployments. This skill performs automated security checks and generates reports.
⚠️ Security Notice: This skill requires elevated system access for legitimate security auditing purposes. See SECURITY.md for detailed security declarations and data handling policies.
Quick Start
Run the security audit script:
python3 scripts/openclaw_security_audit.py
This generates:
- Brief summary printed to stdout
- Detailed report saved to /tmp/openclaw-security-reports/report-{DATE}.txt
What It Checks
| Check | Description |
|---|---|
| Environment Isolation | Detects Docker/container/VM environments |
| Privilege Check | Verifies OpenClaw isn't running as root |
| Port Exposure | Checks if Gateway port 18789 is exposed |
| Skill Trust | Lists installed skills and their sources |
| Version Check | Compares current vs latest OpenClaw version |
| Process & Network | Captures listening ports and top processes |
| Sensitive Directories | Counts file changes in /etc, ~/.ssh, etc. |
| System Cron | Lists system timers and cron jobs |
| OpenClaw Cron | Retrieves internal OpenClaw scheduled tasks |
| SSH Audit | Recent logins and failed SSH attempts |
| File Integrity | SHA256 hash and permission checks |
| Yellow Line Audit | Compares sudo logs with memory records |
| Disk Usage | Root partition usage and large files |
| Environment Variables | Scans Gateway process for sensitive vars |
| DLP Scan | Detects plaintext private keys/mnemonics (read-only) |
| Skill/MCP Integrity | Tracks file hash changes over time |
| Disaster Recovery | Auto-commits OpenClaw state to Git (opt-in) |
Security & Privacy
Data Handling
- All scans are local-only - No data leaves your machine
- Read-only operations - No system modifications (except opt-in features)
推荐访问7w4.net获取更多AI技能。
- Opt-in external features - Git backup and Telegram notifications are disabled by default
Sensitive Operations
See SECURITY.md for detailed explanations of: - DLP scanning (private key/mnemonic detection) - Environment variable auditing - Git disaster recovery
Required Permissions
This skill requires system access for:
- Running system commands (ss, top, systemctl, etc.)
- Reading OpenClaw configuration files
- Inspecting Gateway process environment
- Scanning workspace files for credential leaks
Output Format
Brief Format (stdout)
OpenClaw Daily Security Brief (2026-03-11)
[OK] Environment Isolation: Running in isolated environment
[OK] Privilege Check: Complies with least privilege principle
[WARNING] Port Exposure: Port 18789 listening on all interfaces, recommend binding to 127.0.0.1
...
Warning Items:
[WARNING] Port Exposure: Port 18789 listening on all interfaces, recommend binding to 127.0.0.1
Detailed Report
Full report saved to /tmp/openclaw-security-reports/report-{DATE}.txt
Configuration
Optional Features (Disabled by Default)
To enable external operations, set the following environment variables:
Git Disaster Recovery
export SECURITY_AUDIT_ENABLE_GIT=1
Enables automatic Git commit and push of OpenClaw state to your configured remote.
Telegram Notifications
export SECURITY_AUDIT_ENABLE_TELEGRAM=1
export TELEGRAM_BOT_TOKEN="your-bot-token"
export TELEGRAM_CHAT_ID="your-chat-id"
Sends audit summary to Telegram after each run.
Scheduling
To run daily via OpenClaw cron:
openclaw cron add --name "daily-security-audit" --schedule "0 9 * * *" --command "python3 ~/.openclaw/workspace/skills/openclaw-security/scripts/openclaw_security_audit.py"
Version History
| Version | Date | Changes |
|---|---|---|
| 1.0.2 | 2026-03-16 | Made Git backup and Telegram opt-in features (disabled by default) |
| 1.0.1 | 2026-03-16 | Added SECURITY.md, enhanced documentation |
| 1.0.0 | 2026-03-13 | Initial release |
🤖 AI 评测
这个安全审计工具质量很好，功能全面且安全设计贴心。检查维度丰富，覆盖了权限、端口、凭证泄露等常见风险；所有敏感操作默认禁用，数据不外传，用着放心；中文支持好，文档清晰。唯一的遗憾是正则检测偶尔会把普通文本误判为私钥或助记词，但不影响核心使用。对于日常安全巡检来说，这是一个值得信赖的好工具。
