OpenClaw Security Audit
📖 技能介紹
name: openclaw-security version: 1.0.2 description: | ⚠️ HIGH PRIVILEGE SECURITY AUDIT SKILL
Performs comprehensive security auditing for OpenClaw deployments. Requires system-level access for legitimate security scanning purposes. All operations are read-only and local-only.
Covers: environment isolation, privilege checks, port exposure, skill trust sources, version checks, process monitoring, sensitive directory changes, cron jobs, SSH audits, file integrity baselines, yellow-line operation audits, disk usage, environment variable leak detection, DLP scanning (private key/mnemonic detection), skill/MCP integrity tracking, and disaster recovery backups.
這個技能的最新版本可以在7w4.net小蔥技能站找到。
Use when: security audits, firewall/SSH/update hardening, risk posture review, exposure assessment, or periodic security checks on machines running OpenClaw (laptop, workstation, Pi, VPS).
OpenClaw Security Audit
Comprehensive security auditing for OpenClaw deployments. This skill performs automated security checks and generates reports.
⚠️ Security Notice: This skill requires elevated system access for legitimate security auditing purposes. See SECURITY.md for detailed security declarations and data handling policies.
Quick Start
Run the security audit script:
python3 scripts/openclaw_security_audit.py
This generates:
- Brief summary printed to stdout
- Detailed report saved to /tmp/openclaw-security-reports/report-{DATE}.txt
What It Checks
| Check | Description |
|---|---|
| Environment Isolation | Detects Docker/container/VM environments |
| Privilege Check | Verifies OpenClaw isn't running as root |
| Port Exposure | Checks if Gateway port 18789 is exposed |
| Skill Trust | Lists installed skills and their sources |
| Version Check | Compares current vs latest OpenClaw version |
| Process & Network | Captures listening ports and top processes |
| Sensitive Directories | Counts file changes in /etc, ~/.ssh, etc. |
| System Cron | Lists system timers and cron jobs |
| OpenClaw Cron | Retrieves internal OpenClaw scheduled tasks |
| SSH Audit | Recent logins and failed SSH attempts |
| File Integrity | SHA256 hash and permission checks |
| Yellow Line Audit | Compares sudo logs with memory records |
| Disk Usage | Root partition usage and large files |
| Environment Variables | Scans Gateway process for sensitive vars |
| DLP Scan | Detects plaintext private keys/mnemonics (read-only) |
| Skill/MCP Integrity | Tracks file hash changes over time |
| Disaster Recovery | Auto-commits OpenClaw state to Git (opt-in) |
Security & Privacy
Data Handling
- All scans are local-only - No data leaves your machine
- Read-only operations - No system modifications (except opt-in features)
- Opt-in external features - Git backup and Telegram notifications are disabled by default
Sensitive Operations
See SECURITY.md for detailed explanations of: - DLP scanning (private key/mnemonic detection) - Environment variable auditing - Git disaster recovery
Required Permissions
This skill requires system access for:
- Running system commands (ss, top, systemctl, etc.)
- Reading OpenClaw configuration files
- Inspecting Gateway process environment
- Scanning workspace files for credential leaks
Output Format
Brief Format (stdout)
OpenClaw Daily Security Brief (2026-03-11)
[OK] Environment Isolation: Running in isolated environment
[OK] Privilege Check: Complies with least privilege principle
[WARNING] Port Exposure: Port 18789 listening on all interfaces, recommend binding to 127.0.0.1
...
Warning Items:
[WARNING] Port Exposure: Port 18789 listening on all interfaces, recommend binding to 127.0.0.1
Detailed Report
Full report saved to /tmp/openclaw-security-reports/report-{DATE}.txt
Configuration
Optional Features (Disabled by Default)
To enable external operations, set the following environment variables:
Git Disaster Recovery
export SECURITY_AUDIT_ENABLE_GIT=1
Enables automatic Git commit and push of OpenClaw state to your configured remote.
Telegram Notifications
export SECURITY_AUDIT_ENABLE_TELEGRAM=1
export TELEGRAM_BOT_TOKEN="your-bot-token"
export TELEGRAM_CHAT_ID="your-chat-id"
Sends audit summary to Telegram after each run.
Scheduling
To run daily via OpenClaw cron:
openclaw cron add --name "daily-security-audit" --schedule "0 9 * * *" --command "python3 ~/.openclaw/workspace/skills/openclaw-security/scripts/openclaw_security_audit.py"
Version History
| Version | Date | Changes |
|---|---|---|
| 1.0.2 | 2026-03-16 | Made Git backup and Telegram opt-in features (disabled by default) |
| 1.0.1 | 2026-03-16 | Added SECURITY.md, enhanced documentation |
| 1.0.0 | 2026-03-13 | Initial release |
🤖 AI 評測
這個安全審計工具質量很好，功能全面且安全設計貼心。檢查維度豐富，覆蓋了許可權、埠、憑證洩露等常見風險；所有敏感操作預設停用，資料不外傳，用著放心；中文支援好，文件清晰。唯一的遺憾是正則檢測偶爾會把普通文本誤判為私鑰或助記詞，但不影響核心使用。對於日常安全巡檢來說，這是一個值得信賴的好工具。
