Security Audit Toolkit

Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.

Review before installing. Use it only for an explicitly authorized security audit, prefer pinned and trusted scanner versions, avoid automatic fix commands unless you are ready for dependency and lockfile changes, and do not run host-wide or SSH-directory checks unless the user has approved a host/infrastructure audit scope.

Type: OpenClaw Skill Name: security-audit-toolkit Version: 1.0.0 The OpenClaw AgentSkills bundle 'security-audit-toolkit' is classified as benign. All commands and scripts provided in SKILL.md, including the comprehensive `security-audit.sh` script, are directly aligned with the stated purpose of performing security audits. The skill utilizes standard security tools and practices (e.g., `npm audit`, `pip-audit`, `grep` for secrets, `openssl` for TLS checks, `find` for permissions) to identify vulnerabilities within a project. There is no evidence of intentional harmful behavior such as data exfiltration to unauthorized external endpoints, malicious execution of remote payloads, persistence mechanisms, or prompt injection attempts against the agent to subvert its intended function. The commands that access sensitive areas (like `~/.ssh`) are for auditing permissions, not for exfiltrating data, and network calls use placeholder domains like `example.com`.