OpenClaw Security Auditor

**Quick judgement** A focused, local-only security auditing skill for OpenClaw configurations. It is well-scoped, privacy-preserving by design, and particularly useful for hardening OpenClaw deployments. Its effectiveness depends on the correctness of the checks implemented and the quality of the user’s configured LLM, but the conceptual design is strong. **What it does well** - Scans `~/.openclaw/openclaw.json` (or a user-specified path) for 15+ common misconfigurations: insecure bindings, missing auth, missing rate limits, weak tool policies, missing audit logs, etc. - Avoids sending secrets to the model by extracting only metadata (present/missing/status) rather than raw values. - Generates a structured markdown report with: - Overall risk score (0–100) - Findings grouped by Critical/High/Medium/Low - Each finding including description, why it matters, how to fix, and example config - A prioritized remediation roadmap. **Key risks / limitations** - **File access trust**: The skill must read local configuration files; users should only run it in trusted environments where granting such access is acceptable. - **Secret redaction correctness**: The description promises not to emit raw secrets, but any implementation bug in parsing/redaction could still surface sensitive values in prompts or logs. This is a moderate but important risk for a security-focused tool. - **Coverage constraints**: The checks list is strong but not exhaustive; custom or advanced OpenClaw setups might have risks not covered by the current ruleset. - **LLM dependence**: Report quality and precision depend on the user’s configured LLM (could be excellent with strong models, weaker with limited local models). - **Tooling assumptions**: The pseudo-flow assumes `cat` and `jq` are available; environments lacking these tools may require adjustment. **Recommended usage scenarios** - You manage or deploy OpenClaw and want a **quick security baseline** on your configuration. - You are preparing a **production deployment** and need an initial hardening review plus a remediation checklist. - You run **periodic security checks** on OpenClaw as part of DevSecOps workflows. - You want to generate **documentation-ready security findings** using your existing LLM configuration, without sending config data to external services. Overall, this is a solid, specialized security auditing skill for OpenClaw configs. It is best suited for security-conscious users comfortable with local file access and aware that the report complements, rather than replaces, a full security review.