← Back to Skills Marketplace
Firm Advanced Security Pack
by
romainsantoli-web
· GitHub ↗
· v1.0.0
347
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install firm-advanced-security-pack
Description
Advanced security audit pack covering secrets lifecycle, path canonicalization, exec plan freeze, hook routing, config includes, prototype pollution, safeBin...
README (SKILL.md)
firm-advanced-security-pack
⚠️ Contenu généré par IA — validation humaine requise avant utilisation.
Purpose
Deep security auditing for OpenClaw configurations — covers external secrets lifecycle,
channel path canonicalization, execution plan freeze validation, hook session routing,
$include directive guards, prototype pollution detection, safeBins profile enforcement,
and group policy default audit.
Tools (8)
| Tool | Description | Severity |
|---|---|---|
openclaw_secrets_lifecycle_check |
External Secrets lifecycle audit | CRITICAL |
openclaw_channel_auth_canon_check |
Channel path canonicalization | CRITICAL |
openclaw_exec_approval_freeze_check |
Exec plan freeze validation | CRITICAL |
openclaw_hook_session_routing_check |
Hook session routing audit | HIGH |
openclaw_config_include_check |
$include directive guards |
HIGH |
openclaw_config_prototype_check |
Prototype pollution detection | HIGH |
openclaw_safe_bins_profile_check |
safeBins profile enforcement | HIGH |
openclaw_group_policy_default_check |
Group policy default audit | HIGH |
Usage
skills:
- firm-advanced-security-pack
# Run full advanced security audit:
openclaw_secrets_lifecycle_check config_path=/path/to/config.json
openclaw_config_prototype_check config_path=/path/to/config.json
openclaw_safe_bins_profile_check config_path=/path/to/config.json
Requirements
mcp-openclaw-extensions >= 3.0.0
Usage Guidance
This skill is instruction-only and lists eight audit commands but provides no code, no install steps, and no provenance for the dependency it references. Before installing or running it: 1) Ask the publisher where the openclaw_* tools come from and how to obtain and verify 'mcp-openclaw-extensions >= 3.0.0' (signed releases, repository, package registry). 2) Do not run the listed commands on production systems until you can inspect the actual binaries/scripts; run them in a sandbox. 3) Request human-reviewed source code or a trusted install mechanism; if none is provided, treat the skill as untrusted because it could cause arbitrary command execution. 4) If you proceed, verify digitally-signed packages or review the extension code to ensure the tools only read the intended config files and do not exfiltrate secrets.
Capability Analysis
Type: OpenClaw Skill
Name: firm-advanced-security-pack
Version: 1.0.0
The OpenClaw AgentSkills bundle 'firm-advanced-security-pack' is classified as benign. Its stated purpose is to provide an advanced security audit pack for OpenClaw configurations, covering various security aspects like secrets lifecycle, prototype pollution, and safeBins profiles. All listed tools and example usage in SKILL.md are consistent with this auditing purpose, involving checks against local configuration files. There is no evidence of data exfiltration, malicious execution, persistence, obfuscation, or prompt injection attempts against the agent within the provided files. The dependency on `mcp-openclaw-extensions` is a standard requirement declaration, not an indicator of malice within this skill itself.
Capability Assessment
Purpose & Capability
The name, description, and listed tools are coherent with an OpenClaw configuration audit pack. However, the SKILL.md lists eight executable tool names (openclaw_*) yet the skill declares no required binaries and provides no installation or provenance for those executables. The metadata lists a dependency on 'mcp-openclaw-extensions >= 3.0.0' but the skill does not explain how that dependency supplies the tools or how it will be installed.
Instruction Scope
Runtime instructions direct the agent to run specific commands (e.g., openclaw_secrets_lifecycle_check config_path=/path/to/config.json). Those commands would execute arbitrary code on the host if present; the SKILL.md does not say where the commands come from, how to verify them, or any sandboxing/validation. The only file path referenced is a user-supplied config_path, which is reasonable for an audit tool, but the agent is being asked to run external commands without provenance—this is scope creep relative to an instruction-only skill.
Install Mechanism
No install spec is present (low disk-write risk), which is consistent with an instruction-only skill. However, the declared dependency (mcp-openclaw-extensions >= 3.0.0) is not accompanied by an installation or verification mechanism; the skill neither declares required binaries nor how to obtain the listed tools. That gap creates uncertainty about how the tools are expected to appear on the system.
Credentials
The skill requests no environment variables, no credentials, and no config paths. That is proportionate. Note: the commands it tells the agent to run will likely read user-supplied config files (config_path) — expected for an audit tool, but the skill does not constrain or document what parts of configs are read or transmitted.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent presence or elevated platform privileges. Autonomous invocation is allowed by default but is not combined with other high-risk flags here.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install firm-advanced-security-pack - After installation, invoke the skill by name or use
/firm-advanced-security-pack - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of firm-advanced-security-pack.
- Introduces 8 advanced security audit tools for OpenClaw configurations.
- Covers areas such as secrets lifecycle, path canonicalization, exec plan freeze, hook routing, config includes, prototype pollution, safeBins profiles, and group policy defaults.
- Requires mcp-openclaw-extensions version 3.0.0 or higher.
- Provides critical and high-severity checks for comprehensive security auditing.
Metadata
Frequently Asked Questions
What is Firm Advanced Security Pack?
Advanced security audit pack covering secrets lifecycle, path canonicalization, exec plan freeze, hook routing, config includes, prototype pollution, safeBin... It is an AI Agent Skill for Claude Code / OpenClaw, with 347 downloads so far.
How do I install Firm Advanced Security Pack?
Run "/install firm-advanced-security-pack" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Firm Advanced Security Pack free?
Yes, Firm Advanced Security Pack is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Firm Advanced Security Pack support?
Firm Advanced Security Pack is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Firm Advanced Security Pack?
It is built and maintained by romainsantoli-web (@romainsantoli-web); the current version is v1.0.0.
More Skills