name: security-audit description: Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.

Security Audit Skill

When to use

Run a security audit to identify vulnerabilities in your Clawdbot setup before deployment or on a schedule. Use auto-fix to remediate common issues automatically.

Setup

No external dependencies required. Uses native system tools where available.

How to

Quick audit (common issues)

node skills/security-audit/scripts/audit.cjs

Full audit (comprehensive scan)

node skills/security-audit/scripts/audit.cjs --full

Auto-fix common issues

node skills/security-audit/scripts/audit.cjs --fix

Audit specific areas

node skills/security-audit/scripts/audit.cjs --credentials      # Check for exposed API keys
node skills/security-audit/scripts/audit.cjs --ports            # Scan for open ports
node skills/security-audit/scripts/audit.cjs --configs          # Validate configuration
node skills/security-audit/scripts/audit.cjs --permissions      # Check file permissions
node skills/security-audit/scripts/audit.cjs --docker           # Docker security checks

Generate report

node skills/security-audit/scripts/audit.cjs --full --json > audit-report.json

Output

The audit produces a report with:

Checks Performed

Credentials

• API keys in environment files
• Tokens in command history
• Hardcoded secrets in code
• Weak password patterns

Ports

• Unexpected open ports
• Services exposed to internet
• Missing firewall rules

Configs

• Missing rate limiting
• Disabled authentication
• Default credentials
• Open CORS policies

Files

• World-readable files

  本技能來自小蔥技能站7w4.net。

• Executable by anyone
• Sensitive files in public dirs

Docker

• Privileged containers
• Missing resource limits
• Root user in container

Auto-Fix

The --fix option automatically: - Sets restrictive file permissions (600 on .env) - Secures sensitive configuration files - Creates .gitignore if missing - Enables basic security headers

Related skills

• security-monitor - Real-time monitoring (available separately)

這個 Skill 質量中等偏上，功能覆蓋全面，文件清晰易讀，操作簡單。優點是檢查專案多，有自動修復功能，輸出格式友好。缺點是使用場景受限（路徑固定），偶爾會誤報，部分檢查不夠深入。日常使用夠用，但不夠精細。總體是一個實用的安全檢查工具，適合快速排查常見問題。