\r \r

ConfigSafe — Infrastructure Configuration Auditor\r

\r ConfigSafe scans infrastructure configuration files for security misconfigurations across Dockerfiles, docker-compose, Kubernetes manifests, Terraform, CI/CD pipelines, and web server configs. It uses regex-based pattern matching against 80+ misconfiguration patterns, lefthook for git hook integration, and produces markdown security reports with CIS benchmark mapping.\r \r

Commands\r

\r

Free Tier (No license required)\r

\r

configsafe scan [file|directory]\r

One-shot configuration security scan of files or directories.\r \r How to execute:\r

bash "\x3CSKILL_DIR>/scripts/configsafe.sh" scan [target]\r
```\r
\r
**What it does:**\r
1. Accepts a file path or directory (defaults to current directory)\r
2. Auto-detects configuration types (Dockerfile, docker-compose, Kubernetes, Terraform, CI/CD, Nginx/Apache)\r
3. Finds all config files matching known patterns\r
4. Runs 80+ misconfiguration patterns against each file\r
5. Calculates a security score (0-100) per file and overall\r
6. Outputs findings with: file, line number, check ID, severity, description, recommendation\r
7. Exit code 0 if secure (score >= 70), exit code 1 if issues found\r
8. Free tier limited to 5 config files per scan\r
\r
**Example usage scenarios:**\r
- "Scan my infrastructure configs for security issues" -> runs `configsafe scan .`\r
- "Check this Dockerfile for misconfigurations" -> runs `configsafe scan Dockerfile`\r
- "Audit my Kubernetes manifests" -> runs `configsafe scan k8s/`\r
- "Is my Terraform config secure?" -> runs `configsafe scan terraform/`\r
\r
### Pro Tier ($19/user/month -- requires CONFIGSAFE_LICENSE_KEY)\r
\r
#### `configsafe hooks install`\r
Install git pre-commit hooks that scan staged config files before every commit.\r
\r
**How to execute:**\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/configsafe.sh" hooks install\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Copies lefthook config to project root\r
3. Installs lefthook pre-commit hook\r
4. On every commit: scans all staged config files for misconfigurations, blocks commit if critical/high findings, shows remediation advice\r
\r
#### `configsafe hooks uninstall`\r
Remove ConfigSafe git hooks.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/configsafe.sh" hooks uninstall\r
```\r
\r
#### `configsafe report [directory]`\r
Generate a markdown security report with findings, severity breakdown, and remediation steps.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/configsafe.sh" report [directory]\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Runs full scan of the directory\r
3. Generates a formatted markdown report from template\r
4. Includes per-file breakdowns, security scores, CIS benchmark references\r
5. Output suitable for security reviews and compliance audits\r
\r
#### `configsafe benchmark [directory]`\r
Run CIS benchmark checks against infrastructure configurations.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/configsafe.sh" benchmark [directory]\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Maps findings to CIS Docker Benchmark, CIS Kubernetes Benchmark, and CIS AWS Foundations\r
3. Reports pass/fail status for each benchmark check\r
4. Outputs overall compliance percentage\r
\r
### Team Tier ($39/user/month -- requires CONFIGSAFE_LICENSE_KEY with team tier)\r
\r
#### `configsafe policy [directory]`\r
Enforce organization-specific security policies on infrastructure configurations.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/configsafe.sh" policy [directory]\r
```\r
\r
**What it does:**\r
1. Validates Team+ license\r
2. Loads custom policies from ~/.openclaw/openclaw.json (configsafe.config.customPolicies)\r
3. Enforces organization-specific rules (e.g., required labels, forbidden images, mandatory resource limits)\r
4. Combines custom policies with built-in patterns for comprehensive scanning\r
5. Outputs SARIF-compatible results\r
\r
#### `configsafe compliance [directory]`\r
Generate a full compliance report covering CIS and NIST frameworks.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/configsafe.sh" compliance [directory]\r
```\r
\r
**What it does:**\r
1. Validates Team+ license\r
2. Runs full scan with all patterns\r
3. Maps findings to CIS Docker Benchmark, CIS Kubernetes Benchmark, CIS AWS Foundations, and NIST 800-190\r
4. Generates comprehensive compliance report with pass/fail per control\r
5. Includes executive summary, detailed findings, and remediation roadmap\r
\r
#### `configsafe status`\r
Show license and configuration information.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/configsafe.sh" status\r
```\r
\r
## Detected Misconfigurations\r
\r
ConfigSafe detects 80+ misconfiguration patterns across 6 config types:\r
\r
| Category | Examples | Severity |\r
|----------|----------|----------|\r
| **Dockerfile** | Running as root, `latest` tag, ADD vs COPY, exposed sensitive ports, missing health checks, secrets in ENV, curl pipe bash, chmod 777, missing multi-stage builds | Critical/High |\r
| **docker-compose** | privileged: true, host network, Docker socket mount, missing resource limits, plaintext secrets, unbound ports, missing restart policy | Critical/High |\r
| **Kubernetes** | Running as root, privileged containers, missing security context, missing resource limits, hostPath volumes, default namespace, missing probes, allowPrivilegeEscalation | Critical/High |\r
| **Terraform** | Hardcoded credentials, missing encryption, public S3 buckets, open security groups (0.0.0.0/0), missing logging, overly permissive IAM, default VPC | Critical/High |\r
| **CI/CD Pipelines** | Plaintext secrets, PR trigger with write perms, unpinned actions, missing timeout, unrestricted self-hosted runners, artifact upload without expiry | High/Medium |\r
| **Nginx/Apache** | Missing security headers, server tokens enabled, SSL/TLS misconfig, open proxy, missing rate limiting, directory listing enabled | Medium/High |\r
\r
## Configuration\r
\r
Users can configure ConfigSafe in `~/.openclaw/openclaw.json`:\r
\r
```json\r
{\r
  "skills": {\r
    "entries": {\r
      "configsafe": {\r
        "enabled": true,\r
        "apiKey": "YOUR_LICENSE_KEY_HERE",\r
        "config": {\r
          "severityThreshold": "high",\r
          "customPolicies": [],\r
          "excludePatterns": ["**/test/**", "**/examples/**"],\r
          "reportFormat": "markdown"\r
        }\r
      }\r
    }\r
  }\r
}\r
```\r
\r
## Important Notes\r
\r
- **Free tier** works immediately with no configuration\r
- **All scanning happens locally** -- no code or configs are sent to external servers\r
- **License validation is offline** -- no phone-home or network calls\r
- Pattern matching only -- no AST parsing, no external dependencies\r
- Supports scanning multiple config types in a single pass\r
- Git hooks use **lefthook** which must be installed (see install metadata above)\r
- Exit codes: 0 = secure (score >= 70), 1 = issues found (for CI/CD integration)\r
\r
## Error Handling\r
\r
- If lefthook is not installed and user tries `hooks install`, prompt to install it\r
- If license key is invalid or expired, show clear message with link to https://configsafe.pages.dev/renew\r
- If a file is binary, skip it automatically with no warning\r
- If no config files found in target, report clean scan with info message\r
- If config type cannot be determined, skip the file gracefully\r
\r
## When to Use ConfigSafe\r
\r
The user might say things like:\r
- "Scan my Dockerfile for security issues"\r
- "Check my Kubernetes manifests for misconfigurations"\r
- "Audit my Terraform configs"\r
- "Is my docker-compose file secure?"\r
- "Check my CI/CD pipeline for security problems"\r
- "Generate a security report for my infrastructure"\r
- "Run CIS benchmark checks"\r
- "Set up pre-commit hooks for config scanning"\r
- "Check if my containers are running as root"\r
- "Scan for open security groups in Terraform"\r
- "Are there any hardcoded secrets in my configs?"\r
- "Check my nginx config for security headers"\r