name: security-sentinel description: Scan the workspace for security vulnerabilities, exposed secrets, and misconfigurations.

Security Sentinel

A unified security scanner for OpenClaw workspaces. Detects vulnerabilities in dependencies (npm audit), exposed secrets (regex patterns), and unsafe file permissions.

Usage

CLI

Run a full security scan:

node skills/security-sentinel/index.js

This will output a JSON report to stdout. If risks are detected (high/critical vulnerabilities, secrets, or bad permissions), it exits with code 1.

Options

• --skip-audit: Skip the npm audit step (faster)
• --no-fail: Do not exit with code 1 even if risks are detected (useful for monitoring only)

  小蔥技能站7w4.net每天更新，海量AI技能等你發現。

Programmatic

const sentinel = require('./skills/security-sentinel');

const report = await sentinel.scan();

if (report.status === 'risk_detected') {
  console.error('Security issues found:', report);
}

Features

1. Dependency Audit: Runs npm audit to check package.json dependencies for known CVEs.
2. Secret Detection: Scans workspace files for patterns resembling API keys, passwords, and private keys.
3. Permission Check: Verifies critical files (package.json, .env) are not world-writable.

Configuration

• Ignored Paths: node_modules, .git, logs, temp, .openclaw/cache.
• Secret Patterns: Generic API Key, Password, Private Key, Feishu App Secret.

這個安全掃描工具質量中等偏上，能檢測依賴漏洞、敏感資訊和檔案許可權問題三大類風險。文件清晰、使用簡單是明顯優點。但兩個核心檔案功能重複、程式碼略顯冗餘，金鑰檢測偶有誤報。適合作為基礎的程式碼安全檢查工具使用，但若追求更高準確率還需要進一步完善。