Security Audit

**Judgement** A solid, general-purpose security auditing skill for Clawdbot deployments that provides good coverage of common misconfigurations and exposed secrets. It is well-suited as a baseline security check or CI/CD gate, but should not be treated as a complete security solution or a replacement for expert review or penetration testing. **Key strengths & risks** - **Strengths:** - Focuses on high-impact issues: exposed credentials, insecure ports, weak configs, loose file permissions, and Docker hardening. - Clear severity levels (CRITICAL/HIGH/MEDIUM/INFO) and JSON output make it practical for automation and prioritization. - No external dependencies and simple CLI interface make adoption and integration straightforward. - **Risks / Limitations:** - Auto-fix (`--fix`) changes file permissions and configurations; this can break applications or workflows if used without review. - Detection appears pattern/heuristic-based; it may **miss** non-standard or environment-specific vulnerabilities, leading to a false sense of security if used alone. - Not a substitute for network-level scanning, code review, or comprehensive container and infrastructure security tools. **Recommended usage scenarios** - Use for **pre-deployment security baselines** and **regular scheduled audits** of Clawdbot environments. - Integrate the JSON report into **CI/CD pipelines** to block deployments when CRITICAL or HIGH findings appear. - Prefer running without `--fix` first, **review the report**, and then either: - Apply fixes manually, or - Use `--fix` in a controlled environment with version control and rollback options. - Combine with other security measures (secret scanning in repos, network scanners, container security tools, and manual reviews) for a more complete security posture.