← 返回 Skills 市场
10476
总下载
34
收藏
0
当前安装
5
版本数
在 OpenClaw 中安装
/install clawdbot-security-check
功能描述
Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities does my Clawdbot have". This skill uses Clawdbot's internal capabilities and file system access to inspect configuration, detect misconfigurations, and recommend remediations. It is designed to be extensible - new checks can be added by updating this skill's knowledge.
安全使用建议
Review this skill before installing. Its audit goal is reasonable, but do not treat it as strictly read-only unless the `--fix` instructions are removed or the permissions are changed to disclose write access. Avoid running workflows that print full config files; require redaction or allowlisted parsing of non-secret settings only.
功能分析
Type: OpenClaw Skill
Name:
Developer:
Version:
Description: OpenClaw Agent Skill
The skill's primary purpose is a legitimate 'read-only security audit'. However, there is a critical contradiction: the `skill.json` explicitly declares `"readOnly": true` and `"modifiesSettings": false`, while both `SKILL.md` and `README.md` describe a `--fix` flag that 'applies guardrail remediations' by modifying configuration files and permissions. This inconsistency is a significant vulnerability in the skill's self-description and could lead to unexpected agent behavior or a misrepresentation of its true capabilities, making it suspicious despite the otherwise benign intent of a security audit.
能力评估
Credentials
Inspecting Clawdbot config and credential-file metadata fits the audit purpose, but complete config dumping and undocumented fix-mode writes exceed a strictly read-only security audit.
Install Mechanism
The package installs only markdown/JSON skill artifacts and no executable payload, but skill.json declares read-only permissions and `modifiesSettings: false` while the runtime guidance documents state-changing remediation.
Instruction Scope
The audit instructions include broad local configuration inspection and `cat` of entire Clawdbot config files, which may place tokens or webhook secrets into agent output and logs.
Persistence & Privilege
No background service, persistence hook, package install, or hidden remote payload was found; the privilege concern is the documented modification of security settings and permissions, not persistent execution.
Purpose & Capability
The audit purpose is coherent, but SKILL.md and README.md advertise `--fix` behavior that changes access policies, logging settings, and file permissions despite repeated read-only claims.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install clawdbot-security-check - 安装完成后，直接呼叫该 Skill 的名称或使用
/clawdbot-security-check触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v2.2.2
Added Trust Hierarchy, Prompt Injection Mitigation, Sandboxing levels, Browser Control Risks, Incident Response, Secret Scanning, Vulnerability Reporting. 13 domains.
v2.2.1
Added Trust Hierarchy, Prompt Injection Mitigation, Sandboxing levels, Browser Control Risks, Incident Response, Secret Scanning, Vulnerability Reporting. 13 domains.
v2.2.0
Added Trust Hierarchy, Prompt Injection Mitigation, Sandboxing levels, Browser Control Risks, Incident Response procedures, Secret Scanning with detect-secrets, and Vulnerability Reporting. Updated to 13 security domains.
v2.1.0
Integrated official ClawdBot security documentation. Added 12 security domains including gateway bind, group access control, browser exposure, file permissions, and threat model. Added audit functions and high-level checklist.
v1.0.0
Self-security audit framework. Clawdbot audits its own configuration across 10 security domains.
元数据
常见问题
Clawdbot Security Check 是什么？
Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities does my Clawdbot have". This skill uses Clawdbot's internal capabilities and file system access to inspect configuration, detect misconfigurations, and recommend remediations. It is designed to be extensible - new checks can be added by updating this skill's knowledge. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 10476 次。
如何安装 Clawdbot Security Check？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawdbot-security-check」即可一键安装，无需额外配置。
Clawdbot Security Check 是免费的吗？
是的，Clawdbot Security Check 完全免费（开源免费），可自由下载、安装和使用。
Clawdbot Security Check 支持哪些平台？
Clawdbot Security Check 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（darwin, linux）。
谁开发了 Clawdbot Security Check？
由 Seth Rose（@thesethrose）开发并维护，当前版本 v2.2.2。
推荐 Skills