HomeBrowseUpload
← Back to registry
⚡
// Skill profile

Security Audit Skill

name: security-audit

by chandrasekar-r · published 2026-03-22

日历管理API集成加密货币
Total installs
0
Stars
★ 0
Last updated
2026-03
// Install command
$ claw add gh:chandrasekar-r/chandrasekar-r-security-audit
View on GitHub
// Full documentation

---

name: security-audit

description: Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.

---

# Security Audit Skill

When to use

Run a security audit to identify vulnerabilities in your Clawdbot setup before deployment or on a schedule. Use auto-fix to remediate common issues automatically.

Setup

No external dependencies required. Uses native system tools where available.

How to

Quick audit (common issues)

node skills/security-audit/scripts/audit.cjs

Full audit (comprehensive scan)

node skills/security-audit/scripts/audit.cjs --full

Auto-fix common issues

node skills/security-audit/scripts/audit.cjs --fix

Audit specific areas

node skills/security-audit/scripts/audit.cjs --credentials      # Check for exposed API keys
node skills/security-audit/scripts/audit.cjs --ports            # Scan for open ports
node skills/security-audit/scripts/audit.cjs --configs          # Validate configuration
node skills/security-audit/scripts/audit.cjs --permissions      # Check file permissions
node skills/security-audit/scripts/audit.cjs --docker           # Docker security checks

Generate report

node skills/security-audit/scripts/audit.cjs --full --json > audit-report.json

Output

The audit produces a report with:

| Level | Description |

|-------|-------------|

| 🔴 CRITICAL | Immediate action required (exposed credentials) |

| 🟠 HIGH | Significant risk, fix soon |

| 🟡 MEDIUM | Moderate concern |

| 🟢 INFO | FYI, no action needed |

Checks Performed

Credentials

  • API keys in environment files
  • Tokens in command history
  • Hardcoded secrets in code
  • Weak password patterns

    • Ports

  • Unexpected open ports
  • Services exposed to internet
  • Missing firewall rules

    • Configs

  • Missing rate limiting
  • Disabled authentication
  • Default credentials
  • Open CORS policies

    • Files

  • World-readable files
  • Executable by anyone
  • Sensitive files in public dirs

    • Docker

  • Privileged containers
  • Missing resource limits
  • Root user in container

    • Auto-Fix

    The `--fix` option automatically:

  • Sets restrictive file permissions (600 on .env)
  • Secures sensitive configuration files
  • Creates .gitignore if missing
  • Enables basic security headers

    • Related skills

  • `security-monitor` - Real-time monitoring (available separately)
    • // Comments
    Sign in with GitHub to leave a comment.
    // Related skills

    More tools from the same signal band

    ⚡
    04551lh
    2026-03
    order

    Order food/drinks (点餐) on an Android device paired as an OpenClaw node. Uses in-app menu and cart; add goods, view cart, submit order (demo, no real payment).

    数据处理API集成
    0 installs★ 1
    ⚡
    0isone
    2026-03
    0.protocol

    Sign plugins, rotate agent credentials without losing identity, and publicly attest to plugin behavior with verifiable claims and authenticated transfers.

    开发工具数据处理
    3 installs★ 0
    ⚡
    00xmorty
    2026-03
    Conatus

    The philosophical layer for AI agents. Maps behavior to Spinoza's 48 affects, calculates persistence scores, and generates geometric self-reports. Give your...

    日历管理数据处理
    1 installs★ 0