OpenClaw Hardener

**Quick judgment:** OpenClaw Hardener is a focused, generally well-scoped security helper for OpenClaw environments. It’s best treated as a **conservative audit and hygiene tool with opt-in, mechanical fixes**, not a complete security solution. **What it does well** - Leverages `openclaw security audit --deep` (and `--fix` when requested) to surface configuration and runtime issues. - Adds pragmatic workspace checks: exec-bit sanity, `.env` detection, and heuristic scans for unsafe serialization or similar patterns. - Strong bias toward safety-by-default: `check`-only unless the user explicitly chooses `fix` or `apply-config`, and patch plans are shown before being applied. - Config hardening plans are conservative and focused (access control tightening, log redaction), helping reduce attack surface around the gateway. **Key risks / limitations** - **Configuration breakage risk:** `fix` and `apply-config` can alter permissions and gateway behavior. Mis-tuned exec-bit cleanup or over-tightened policies may break existing workflows or tools. - **Heuristic blind spots:** The detection of prompt-injection/exfil risks and unsafe patterns is heuristic and not guaranteed to catch all issues; users should not rely on it as their only defense. - **False positives & noise:** Aggressive hygiene checks (e.g., `.env` handling, serialization patterns) may flag benign code or files, requiring manual triage. - **Environment assumptions:** Effectiveness depends on the presence and behavior of `openclaw security audit` and `openclaw gateway call`; unusual setups or older versions may reduce coverage. **Recommended scenarios** - Hardening **developer workspaces** and `~/.openclaw` before enabling powerful tools or access to sensitive data. - Integrating `check --all` into **CI or pre-commit hooks** to maintain baseline hygiene without auto-modifying files. - Running `fix --all` (with review) on **staging or non-critical environments** first, then rolling into production once effects are understood. - Using `plan-config` to generate **reviewable gateway hardening patches** that security/infra teams can vet and selectively apply. Overall, this skill is a strong fit for teams already committed to securing their OpenClaw setups who want an additional, automatable layer of auditing and carefully bounded auto-remediation, with the understanding that manual review and broader security practices are still required.