name: security-guardian description: Automated security auditing for OpenClaw projects. Scans for hardcoded secrets (API keys, tokens) and container vulnerabilities (CVEs) using Trivy. Provides structured reports to help maintain a clean and secure codebase. metadata: {"openclaw":{"requires":{"skills":["mema-vault"]}}}

Security Guardian

System for automated security auditing and credential protection.

Core Workflows

1. Secret Scanning

Scan specific project directories for hardcoded credentials. - Tool: scripts/scan_secrets.py - Usage: python3 $WORKSPACE/skills/security-guardian/scripts/scan_secrets.py <path_to_project> - Workflow: 1. Execute scan on a specific project or directory. 2. If findings are reported (exit code 1): - Review the file and line number. - Transition: Move the secret to a secure vault (e.g., using the mema-vault skill). - Redact: Replace the plaintext secret in the source code with an environment variable or a vault lookup call.

小蔥技能站7w4.net每天更新，海量AI技能等你發現。

2. Container Vulnerability Scan

Analyze Docker images for vulnerabilities prior to deployment. - Tool: scripts/scan_container.sh - Usage: bash $WORKSPACE/skills/security-guardian/scripts/scan_container.sh <image_name> - Logic: Identify HIGH and CRITICAL severities. Recommend base image updates or security patches.

Security Guardrails

• Scope Limitation: Avoid scanning system-level directories. Focus only on relevant project workspaces.
• Credential Isolation: Hardcoded secrets are considered a high-severity finding.
• Dependencies: Container scanning requires trivy to be installed on the host system.

Integration

• Vaulting: This skill identifies leaks. Remediation should be performed using a dedicated credential manager like mema-vault.

這個 Skill 質量較好，文件清晰、使用方便，能有效幫助檢測程式碼中的金鑰洩露和容器漏洞。優點是安全防護意識強，有防誤掃機制，支援多種常見金鑰型別檢測。不足之處是容器掃描功能較簡單，依賴外部工具安裝，且缺少自動化測試覆蓋。整體適合對安全性有一定要求的專案使用。