Runtime environment and configuration audit pack. Validates Node.js version, secrets workflow, HTTP headers, allowed commands, trusted proxy, disk budget, an...

This skill is mostly a wrapper that documents and calls auditing checks provided by the mcp-openclaw-extensions package. Before installing or running it: 1) Verify and obtain mcp-openclaw-extensions from a trusted source and review its code or documentation so you know exactly what each 'openclaw_*' check does. 2) Avoid running secret-auditing checks directly against production secrets — run against sanitized copies or ensure the check does not exfiltrate sensitive fields. 3) Review where reports are written or sent (local files, logs, external endpoints) and ensure they won't leak sensitive config. 4) If you need higher assurance, request an explicit install spec or signed release for the required extension so you can validate what will be executed.

Type: OpenClaw Skill Name: firm-runtime-audit-pack Version: 1.0.0 The skill bundle describes a 'firm-runtime-audit-pack' designed for auditing runtime environment and configuration aspects like Node.js version, secrets handling, HTTP headers, and command allowlists. The `SKILL.md` file clearly outlines the purpose and lists seven specific security audit tools. There is no executable code provided in these files, only metadata and documentation. No evidence of malicious intent, prompt injection, data exfiltration, or other harmful behaviors was found in `_meta.json` or `SKILL.md`. The content is consistent with a legitimate security auditing tool.