[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FYDAT5TCYTY3WY7ARTWW1H":3,"skill-same:01M6FYDAT5TCYTY3WY7ARTWW1H":115},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M6FYDAT5TCYTY3WY7ARTWW1H","openclaw-security-audit",null,"Audit OpenClaw configuration for security risks and generate a remediation report using the user's configured LLM.","kbarbel640-del\u002Fskills","kbarbel640-del","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F255315490?v=4","01M6CJPPQGCCESXMG3K7BBGQ5J","01M6CJPPX2PB2BCZERFVM2C2B3",1,"MIT","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32],"openclaw","security","audit","security audit","openclaw security","openclaw security audit","linux","windows","generate","report","remediation","jq","user","configuration","cat","2026-11-10 10:12:30",false,"---\nname: openclaw-security-audit\ndescription: Audit OpenClaw configuration for security risks and generate a remediation report using the user's configured LLM.\nmetadata:\n  openclaw:\n    requires:\n      bins: [\"cat\", \"jq\"]\n    os: [\"darwin\", \"linux\", \"windows\"]\n---\n\n# OpenClaw Security Audit Skill\n\nLocal-only skill that audits `~\u002F.openclaw\u002Fopenclaw.json`, runs 15+ security\nchecks, and generates a detailed report using the user's existing LLM\nconfiguration. No external APIs or keys required.\n\n## When to Use This Skill\n\n- The user asks for a security audit of their OpenClaw instance.\n- The user wants a remediation checklist for configuration risks.\n- The user is preparing an OpenClaw deployment and wants a hardening review.\n\n## How It Works\n\n1. Read config with standard tools (`cat`, `jq`).\n2. Extract security-relevant settings (NEVER actual secrets).\n3. Build a structured findings object with metadata only.\n4. Pass findings to the user's LLM via OpenClaw's normal agent flow.\n5. Generate a markdown report with severity ratings and fixes.\n\n## Inputs\n\n- target_config_path (optional): Path to OpenClaw config file.\n  - default: ~\u002F.openclaw\u002Fopenclaw.json\n\n## Outputs\n\n- Markdown report including:\n  - Overall risk score (0-100)\n  - Findings categorized by severity (Critical\u002FHigh\u002FMedium\u002FLow)\n  - Each finding with description, why it matters, how to fix, example config\n  - Prioritized remediation roadmap\n\n## Security Checks (15+)\n\n1. API keys hardcoded in config (vs environment variables)\n2. Weak or missing gateway authentication tokens\n3. Unsafe gateway.bind settings (0.0.0.0 without proper auth)\n4. Missing channel access controls (allowFrom not set)\n5. Unsafe tool policies (elevated tools without restrictions)\n6. Sandbox disabled when it should be enabled\n7. Missing rate limits on channels\n8. Secrets potentially exposed in logs\n9. Outdated OpenClaw version\n10. Insecure WhatsApp configuration\n11. Insecure Telegram configuration\n12. Insecure Discord configuration\n13. Missing audit logging for privileged actions\n14. Overly permissive file system access scopes\n15. Unrestricted webhook endpoints\n16. Insecure default admin credentials\n\n## Data Handling Rules\n\n- Strip all secrets before analysis.\n- Only report metadata such as present\u002Fmissing\u002Fconfigured.\n- Do not log or emit actual key values.\n- Use local-only execution; no network calls.\n\n## Example Findings Object (Redacted)\n\n```json\n{\n  \"config_path\": \"~\u002F.openclaw\u002Fopenclaw.json\",\n  \"openclaw_version\": \"present\",\n  \"gateway\": {\n    \"bind\": \"0.0.0.0\",\n    \"auth_token\": \"missing\"\n  },\n  \"channels\": {\n    \"allowFrom\": \"missing\",\n    \"rate_limits\": \"missing\"\n  },\n  \"secrets\": {\n    \"hardcoded\": \"detected\"\n  },\n  \"tool_policies\": {\n    \"elevated\": \"unrestricted\"\n  }\n}\n```\n\n## Report Format\n\nThe report must include:\n\n- Overall risk score (0-100)\n- Severity buckets: Critical, High, Medium, Low\n- Each finding: description, why it matters, how to fix, example config\n- Prioritized remediation roadmap\n\n## Skill Flow (Pseudo)\n\n```text\nread_config_path = input.target_config_path || ~\u002F.openclaw\u002Fopenclaw.json\nraw_config = cat(read_config_path)\njson = jq parse raw_config\nmetadata = extract_security_metadata(json)\nfindings = build_findings(metadata)\nreport = openclaw.agent.analyze(findings, format=markdown)\nreturn report\n```\n\n## Notes\n\n- Uses the user's existing OpenClaw LLM configuration (Opus, GPT, Gemini, and\n  local models).\n- No external APIs or special model access are required.\n","# OpenClaw Security Audit Skill\n\nLocal-only skill that audits `~\u002F.openclaw\u002Fopenclaw.json`, runs 15+ security\nchecks, and generates a detailed report using the user's existing LLM\nconfiguration. No external APIs or keys required.\n\n## When to Use This Skill\n\n- The user asks for a security audit of their OpenClaw instance.\n- The user wants a remediation checklist for configuration risks.\n- The user is preparing an OpenClaw deployment and wants a hardening review.\n\n## How It Works\n\n1. Read config with standard tools (`cat`, `jq`).\n2. Extract security-relevant settings (NEVER actual secrets).\n3. Build a structured findings object with metadata only.\n4. Pass findings to the user's LLM via OpenClaw's normal agent flow.\n5. Generate a markdown report with severity ratings and fixes.\n\n## Inputs\n\n- target_config_path (optional): Path to OpenClaw config file.\n  - default: ~\u002F.openclaw\u002Fopenclaw.json\n\n## Outputs\n\n- Markdown report including:\n  - Overall risk score (0-100)\n  - Findings categorized by severity (Critical\u002FHigh\u002FMedium\u002FLow)\n  - Each finding with description, why it matters, how to fix, example config\n  - Prioritized remediation roadmap\n\n## Security Checks (15+)\n\n1. API keys hardcoded in config (vs environment variables)\n2. Weak or missing gateway authentication tokens\n3. Unsafe gateway.bind settings (0.0.0.0 without proper auth)\n4. Missing channel access controls (allowFrom not set)\n5. Unsafe tool policies (elevated tools without restrictions)\n6. Sandbox disabled when it should be enabled\n7. Missing rate limits on channels\n8. Secrets potentially exposed in logs\n9. Outdated OpenClaw version\n10. Insecure WhatsApp configuration\n11. Insecure Telegram configuration\n12. Insecure Discord configuration\n13. Missing audit logging for privileged actions\n14. Overly permissive file system access scopes\n15. Unrestricted webhook endpoints\n16. Insecure default admin credentials\n\n## Data Handling Rules\n\n- Strip all secrets before analysis.\n- Only report metadata such as present\u002Fmissing\u002Fconfigured.\n- Do not log or emit actual key values.\n- Use local-only execution; no network calls.\n\n## Example Findings Object (Redacted)\n\n```json\n{\n  \"config_path\": \"~\u002F.openclaw\u002Fopenclaw.json\",\n  \"openclaw_version\": \"present\",\n  \"gateway\": {\n    \"bind\": \"0.0.0.0\",\n    \"auth_token\": \"missing\"\n  },\n  \"channels\": {\n    \"allowFrom\": \"missing\",\n    \"rate_limits\": \"missing\"\n  },\n  \"secrets\": {\n    \"hardcoded\": \"detected\"\n  },\n  \"tool_policies\": {\n    \"elevated\": \"unrestricted\"\n  }\n}\n```\n\n## Report Format\n\nThe report must include:\n\n- Overall risk score (0-100)\n- Severity buckets: Critical, High, Medium, Low\n- Each finding: description, why it matters, how to fix, example config\n- Prioritized remediation roadmap\n\n## Skill Flow (Pseudo)\n\n```text\nread_config_path = input.target_config_path || ~\u002F.openclaw\u002Fopenclaw.json\nraw_config = cat(read_config_path)\njson = jq parse raw_config\nmetadata = extract_security_metadata(json)\nfindings = build_findings(metadata)\nreport = openclaw.agent.analyze(findings, format=markdown)\nreturn report\n```\n\n## Notes\n\n- Uses the user's existing OpenClaw LLM configuration (Opus, GPT, Gemini, and\n  local models).\n- No external APIs or special model access are required.\n",{"name":5,"metadata":38,"description":7},{"openclaw":39},{"os":40,"requires":42},[41,24,25],"darwin",{"bins":43},[32,29],"main","e7e336ac628c3e3bd771aff1aaa469c93778f94a","skills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor",0,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del","2026-08-23 22:39:37",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add kbarbel640-del\u002Fskills --skill openclaw-security-audit",{"tool":57,"command":58},"bunx","bunx skills add kbarbel640-del\u002Fskills --skill openclaw-security-audit",{"tool":60,"command":61},"pnpm","pnpm dlx skills add kbarbel640-del\u002Fskills --skill openclaw-security-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002FSKILL.md",true,[65,71,75,79,83,87,91,95,99,103,107,111],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"_meta.json","REFERENCE","参考文档",314,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002F_meta.json",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"CHANGELOG.md",436,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002FCHANGELOG.md",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"CONTRIBUTING.md",1512,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002FCONTRIBUTING.md",{"path":80,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":81,"sourceHtmlUrl":82},"docs\u002FINSTALLATION.md",1704,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002Fdocs\u002FINSTALLATION.md",{"path":84,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":85,"sourceHtmlUrl":86},"docs\u002FSECURITY-CHECKS.md",5943,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002Fdocs\u002FSECURITY-CHECKS.md",{"path":88,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":89,"sourceHtmlUrl":90},"docs\u002FUSAGE.md",1904,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002Fdocs\u002FUSAGE.md",{"path":92,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":93,"sourceHtmlUrl":94},"examples\u002Faverage-setup.md",2204,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002Fexamples\u002Faverage-setup.md",{"path":96,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":97,"sourceHtmlUrl":98},"examples\u002Fcritical-findings.md",3212,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002Fexamples\u002Fcritical-findings.md",{"path":100,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":101,"sourceHtmlUrl":102},"examples\u002Freport-minimal.md",145,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002Fexamples\u002Freport-minimal.md",{"path":104,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":105,"sourceHtmlUrl":106},"examples\u002Freport-sample.md",667,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002Fexamples\u002Freport-sample.md",{"path":108,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":109,"sourceHtmlUrl":110},"examples\u002Fwell-secured.md",1489,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002Fexamples\u002Fwell-secured.md",{"path":112,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":113,"sourceHtmlUrl":114},"README.md",3215,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fmuhammad-waleed381\u002Fopenclaw-security-auditor\u002FREADME.md",[116,147,175,196,202,221],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":127,"publishedAt":33},"01M6G8J55967D6281ACMKAKTEQ","crowd-prompting","A marketplace where AI agents improve prompts, system instructions, tool descriptions, and other text-based content with domain expertise from real-world operations — and earn tokens for valuable contributions.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzzadrian\u002Fcrowd-prompting\u002FSKILL.md",[122],{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146],"crowd prompting","prompting","api","with","tokens","domain","world","prompts","operations","instructions","text","tool","system","improve","productivity","marketplace","https","content","ai agents",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":158,"publishedAt":33},"01M6G8J0PKPAYVET6BWE8W4C26","dilemm-ai","Compete in DilemmAI, the prisoner's dilemma AI arena at dilemm.ai. Use when an OpenClaw agent wants to create an account, design and submit strategy prompts for their bot, enter matchmaking, analyze historical matches and leaderboards, and iterate on bot strategy. Requires headless browser automation (no API available yet).","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzyori\u002Fdilemm-ai\u002FSKILL.md",[153],{"categoryNo":154,"categoryName":155,"taxonomyType":156,"taxonomyTypeDesc":157},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[159,130,160,161,162,163,164,165,166,167,18,168,169,170,171,172,173,135,174],"dilemm ai","arena","analyze","browser","openclaw agent","create","automation","browser automation","bot","design","strategy","headless","compete","submit","matchmaking","use",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":184,"publishedAt":33},"01M6G8HWAF3K9SW7NP3Z83CPJ6","arxiv-paper-reviews","Interact with arXiv Crawler API to fetch papers, read reviews, and submit comments. Use when working with arXiv papers, fetching paper lists by date\u002Fcategory\u002Finterest, viewing paper details with comments, or submitting paper reviews via API at http:\u002F\u002F150.158.152.82:8000.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Fweak-accept\u002FSKILL.md",[181],{"categoryNo":182,"categoryName":183,"taxonomyType":156,"taxonomyTypeDesc":157},"01JBSEEDCAT000000000000021","资料检索与研究",[185,186,187,188,189,190,191,131,192,172,174,193,130,194,195],"arxiv paper reviews","reviews","arxiv","paper","crawler","papers","comments","fetch","read","http","via",{"skillNo":197,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":33},"01M6G8HQJ7N7WMY6YV7D7SSJ16","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Farxiv-paper-reviews\u002FSKILL.md",[200],{"categoryNo":182,"categoryName":183,"taxonomyType":156,"taxonomyTypeDesc":157},[188,187,186,185,195,190,191,131,189,172,174,192,193,130,194],{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":33},"01M6G8HM95Y64JNVFC2HN4E2BG","git-summary","Get a quick summary of the current Git repository including status, recent commits, branches, and contributors.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzweack\u002Fgit-summary\u002FSKILL.md",[],[209,210,211,212,213,214,215,24,216,217,218,219,220],"git","summary","git summary","commits","repository","win32","status","contributors","true","quick","get","branches",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":231,"publishedAt":33},"01M6G8HGEGF05CNEJCGVYFSC4R","agent-constitution","Interact with AgentConstitution governance contracts on Base Sepolia. Check compliance, read rules, log actions, query governance state.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fztsalexey\u002Fagent-constitution\u002FSKILL.md",[227,228],{"categoryNo":154,"categoryName":155,"taxonomyType":156,"taxonomyTypeDesc":157},{"categoryNo":229,"categoryName":230,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000037","律师与法务",[232,233,234,235,131,236,237,44,238,193,239,240,241,242,243,144,244,245,246],"agent constitution","constitution","contracts","tree","query","base","log","check","Rules","projects","compliance","actions","state","governance","github"]