← Back to Skills Marketplace
213
Downloads
1
Stars
0
Active Installs
11
Versions
Install in OpenClaw
/install securityvitals
Description
Security vitals checker for OpenClaw. Scans your installation, scores your setup, and shows you exactly what to fix. First scan in seconds.
Usage Guidance
This skill appears to do exactly what it says: run a local OpenClaw audit/health/version check and report a constrained set of fields. Before installing or running it: (1) ensure you trust the installed openclaw CLI because `openclaw update status` may contact OpenClaw's update registry; (2) run scans as a user with least privilege — some health probe error strings could include diagnostic data, so avoid running in an environment where that output would expose secrets; and (3) note that the clawvitals.io dashboard and plugin are separate — this skill is stateless and does not send scan data to that dashboard by itself. If you need extra assurance, inspect the OpenClaw audit/health outputs locally to confirm nothing sensitive would be exposed by the limited fields the skill extracts.
Capability Analysis
Type: OpenClaw Skill
Name: securityvitals
Version: 1.4.8
The securityvitals (ClawVitals) skill is a security auditing tool designed to scan OpenClaw installations. It operates by executing a specific set of local CLI commands (`openclaw security audit`, `openclaw health`, `openclaw update status`, etc.) and parsing their JSON output to generate a security score and remediation report. The skill instructions in `SKILL.md` explicitly forbid the storage or display of sensitive credentials and secrets. It requests no network permissions, although it notes that the `openclaw update status` command may trigger the CLI's native update check. The code and instructions are transparent, aligned with the stated purpose, and contain no indicators of malicious intent or data exfiltration.
Capability Tags
Capability Assessment
Purpose & Capability
Name/description (security vitals for OpenClaw) match the actual behavior: the skill runs OpenClaw and node CLI commands to collect audit, health, version, and update-status information. The two required binaries (openclaw, node) are appropriate and proportional to the stated purpose.
Instruction Scope
SKILL.md tightly limits which commands to run and exactly which fields to extract, and it instructs not to show raw output or secrets. Two caveats: (1) `openclaw update status --json` may cause the OpenClaw CLI itself to contact its update registry (this is documented), and (2) the skill extracts `probe.error` from channel health output which could, in some unusual failure modes, contain diagnostic strings with sensitive info. The instructions constrain reporting, but operators should be aware of those two disclosure surfaces.
Install Mechanism
No install spec and no code files — the skill is instruction-only. Nothing is downloaded or written to disk by the skill itself, minimizing install-time risk.
Credentials
The skill requests no environment variables, no credentials, and no config paths. The lack of secrets or unrelated env vars is proportionate to a diagnostics-only tool.
Persistence & Privilege
always is false (no forced global inclusion) and the skill is stateless per its documentation. It does not modify other skills or system-wide settings and does not request persistent presence.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install securityvitals - After installation, invoke the skill by name or use
/securityvitals - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.4.8
Fix SKILL.md contradictions flagged by security review: clarify network access claim, clarify detail field display rule
v1.4.7
Rollback: restore original skill description and tags (v1.4.6 incorrectly included plugin capabilities in description)
v1.4.6
Resilience improvements: NC-OLLAMA-001 discovers port from OLLAMA_HOST env var, NC-NET-001 expands to 10 default ports with user-configurable extra_ports, NC-TUNNEL-001 checks multiple config paths and detects non-Cloudflare tunnels. New clawvitals help command. Pre-publish security review fixes.
v1.4.5
Fix listing title via --name flag.
v1.4.4
Fix ClawHub listing title — SecurityVitals now has its own frontmatter with correct displayName: SecurityVitals.
v1.4.3
Fix ClawHub listing title — add displayName to SKILL.md frontmatter.
v1.4.2
Sync with ClawVitals v1.4.2: 3 new stable controls (NC-OC-012 Critical, NC-OC-013 Critical, NC-OC-014 High), skill version header in output, tightened data extraction scope.
v1.3.2
v1.3.2: Same SECURITY.md fix as ClawVitals.
v1.3.1
v1.3.1: Same fixes as ClawVitals — correct requires.bins, clarified network posture.
v1.3.0
v1.3.0: Shorter description (removed 'for OpenClaw'), declared required binaries in metadata.
v1.2.9
v1.2.9: Initial SecurityVitals publish — same content as ClawVitals, alternate slug for search discoverability.
Metadata
Frequently Asked Questions
What is SecurityVitals?
Security vitals checker for OpenClaw. Scans your installation, scores your setup, and shows you exactly what to fix. First scan in seconds. It is an AI Agent Skill for Claude Code / OpenClaw, with 213 downloads so far.
How do I install SecurityVitals?
Run "/install securityvitals" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is SecurityVitals free?
Yes, SecurityVitals is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does SecurityVitals support?
SecurityVitals is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created SecurityVitals?
It is built and maintained by BK-CM (@bk-cm); the current version is v1.4.8.
More Skills