Security Audit for OpenClaw

Logs risky OpenClaw agent actions, conducts activity audits, and reviews OpenClaw configs for security risks without blocking operations.

This skill is plausibly the audit tool it claims to be, but review and clarify a few things before installing or enabling it: - Confirm blocking semantics: SKILL.md says 'does not block' but the audit guide describes a 'blocked_soft' behavior — decide which behavior you want and ensure the agent follows only that. Unexpected blocking or prompting can break workflows. - Verify log/config paths: docs use both `logs/` and `memory/` paths; the scripts write to workspace/logs/security-audit.log. Make sure this path is acceptable and that the relative path resolution (SCRIPT_DIR/../../..) will not cause writes outside your intended workspace in your deployment layout. - Treat --deep and --fix carefully: `--deep` may perform live probes of your gateway (network activity). `--fix` will attempt to change permissions/config — run only in an environment where automated changes are safe and after code review. - Notifications: the scripts do not themselves send messages; SKILL.md expects the agent to call the platform `message` tool based on config. Confirm the OpenClaw config tokens/credentials used for messaging are stored and accessed securely. - Test in a sandbox first: run the scripts manually in a controlled environment to confirm where logs are created and what `openclaw security audit` does in your setup. If these inconsistencies are fixed (unify the docs and scripts, remove contradictory blocking guidance, and clearly document where logs live and when the skill modifies config), the skill looks coherent and appropriate for its stated purpose.

Type: OpenClaw Skill Name: n0nu-security-audit Version: 1.0.0 The security-audit skill bundle is a legitimate administrative tool designed to provide logging and configuration review for OpenClaw agents. It includes scripts for recording security events (log_event.sh), generating Markdown audit reports (run_audit.sh), and delegating configuration checks to the native OpenClaw CLI (audit_config.sh). The provided reference documentation (dangerous-patterns.md, config-risks.md) contains accurate security guidance, and the skill lacks any indicators of data exfiltration, unauthorized persistence, or malicious prompt injection.