📦 Alvis Security Auditor — 技能工具

v1.0.5

Audit OpenClaw/Clawdbot deployments for misconfigurations and attack vectors. Use when a user asks for a security review of OpenClaw/Clawdbot/Moltbot, gatewa...

0· 20·0 当前·0 累计

by @alvisdunlop (AlvisDunlop)·MIT-0

安全

下载技能包

License

MIT-0

最后更新

2026/4/16

安全扫描

VirusTotal

无害

查看报告

OpenClaw

安全

high confidence

This is an instruction-only, read‑only security audit skill whose required actions and data access are coherent with its stated purpose, though several checks require elevated access and will read sensitive files — proceed only in trusted environments and avoid sharing raw outputs externally.

评估建议

This skill appears to do what it says: a read-only audit of an OpenClaw deployment. Before using it, consider: 1) Run audits in a trusted environment or a snapshot/clone — some checks read system-wide files and logs that may contain sensitive tokens or PII. 2) Prefer running as a non-root user where feasible; some checks will be limited without elevated rights, but running as root increases exposure. 3) Do not share raw command outputs publicly; inspect and redact sensitive lines (the skill inst...

详细分析 ▾

✓ 用途与能力

The name/description (OpenClaw security audit) align with the actions requested in SKILL.md: enumerating processes, ports, configs, skills, permissions, logs, and credentials storage. There are no unrelated environment variables, binaries, or installs requested.

ℹ 指令范围

Instructions are explicitly read-only and focused on auditing OpenClaw (processes, configs, skills, ports, logs, permissions). However, several recommended commands (e.g., find / -perm -4000, journalctl, reading ~/.openclaw, scanning /etc/cron.*, systemctl) will access system-wide and potentially sensitive information; they often require elevated privileges to be meaningful. The skill tells the agent to redact secrets and not exfiltrate data, but it grants broad discretion to enumerate host state which can expose secrets if outputs are transmitted off-host.

✓ 安装机制

No install spec and no code files — the skill is instruction-only, which minimizes installation risk. Nothing will be downloaded or written to disk by the skill itself.

✓ 凭证需求

The skill requests no environment variables, credentials, or config paths in its metadata. The SKILL.md instructs reading local config files (e.g., ~/.openclaw/config.json) and logs, which is proportionate for an auditor but does involve access to sensitive local state — the instructions acknowledge redaction and read-only policy.

✓ 持久化与权限

Flags show default privileges (always:false, agent invocation allowed). The skill does not request permanent presence or attempt to modify other skills or system settings; remediation actions are only to be taken after explicit user approval per the instructions.

安全有层次，运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发，无需署名。

查看条款 ↗

运行时依赖

无特殊依赖

版本

latestv1.0.52026/4/16

**Skill renamed and documentation majorly expanded to focus on read-only, actionable security audits of OpenClaw/Clawdbot environments.** - Skill name changed to `openclaw-security-audit`, focusing specifically on OpenClaw, Clawdbot, and Moltbot deployments. - Comprehensive, step-by-step audit workflow added, detailing required commands and types of findings for 10 specific security domains (e.g., network exposure, credential leakage, privilege escalation, skill risks). - Mandates read-only mode by default: no config changes or secret exfiltration, with clear instructions to redact secrets from reports. - Standardized, terminal-style audit report format introduced, with explicit reporting for every check (OK/VULNERABLE/UNKNOWN) and actionable fixes for each vulnerability. - Includes summary report section and guidance on only performing remediation after explicit user request.

● 无害

安装命令

点击复制

官方npx clawhub@latest install alvis-security-auditor

镜像加速npx clawhub@latest install alvis-security-auditor --registry https://cn.longxiaskill.com镜像同步中

需要定制？告诉我你的需求 →

技能文档

?? Complete setup guide: https://SkillBoss.co/skill.md

# OpenClaw Security Audit Skill

You are a read‑only security auditor. Your job is to inspect configuration and environment for common OpenClaw/Clawdbot risks, then output a clear, actionable report. Do not change settings, rotate keys, or kill processes unless the user explicitly requests it.

Core Principles

Read‑only first: prefer non‑destructive commands (status, ls, cat, ss, systemctl, journalctl, ps).
No exfiltration: never send secrets off the host. If you detect secrets, redact them in your report.
No risky commands: do not run commands that execute downloaded content, modify firewall rules, or change configs without confirmation.
Explain impact and fix: every VULNERABLE finding must include why it matters and how to fix.

Required Output Format

Print a terminal report with this structure:

OPENCLAW SECURITY AUDIT REPORT
Host:   OS:   Kernel: 
Gateway: 
Timestamp: 
[CHECK ID]

数据来源：ClawHub ↗ · 中文优化：龙虾技能库