Openclaw Security

Unified security suite for agent workspaces. Installs, configures, and orchestrates all 11 OpenClaw security tools in one command — integrity, secrets, permissions, network, audit trail, signing, supply chain, credentials, injection defense, compliance, and incident response.

This skill is an orchestrator that will run many other skill scripts inside whatever workspace you point it at. Before installing or running it: 1) Verify the source and repository — this package has no homepage and an unknown origin. 2) Expect it to call the ClawHub CLI or git/npm to fetch other tools; only allow that if you trust those package sources. 3) Inspect the code of the orchestrator and the individual security skill packages (scripts under workspace/*) before running setup/update/protect — they will be executed and can read/modify your files. 4) Run initial tests in an isolated or disposable workspace (or VM/container) and back up important data. 5) Ask the maintainer to clarify the README contradiction about 'no external dependencies' and to provide a verifiable homepage or repository before trusting it in a production environment.

Type: OpenClaw Skill Name: openclaw-security Version: 1.0.1 The OpenClaw Security Suite skill bundle is an orchestrator designed to install, configure, and manage other OpenClaw security tools. The `SKILL.md` and `README.md` files clearly describe its purpose and commands, with no evidence of prompt injection or hidden instructions. The `scripts/security.py` script uses `subprocess.run` to execute the `clawhub` CLI for installing/updating other skills and to run local Python scripts for the 11 security tools it manages. All commands passed to `subprocess.run` are hardcoded lists of strings, preventing shell injection from within this script. There is no evidence of data exfiltration, persistence mechanisms, or other malicious intent within this skill bundle's code or documentation. The inherent reliance on `clawhub` and other external skills introduces a supply chain risk, but this specific skill bundle itself does not exhibit malicious behavior.