m78armor : openclaw security configuration check

中文说明: 本工具用于本地只读 OpenClaw 实例的安全配置检查与基线评估。执行本地优先 (local-first) 的安全审计与配置加固 (hardening) 建议。重点关注数据隐私 (privacy-first)、暴露面及配置漂移。不上传任何本地数据。

Use this skill to run a local, read-only configuration review and hardening assessment of the OpenClaw instance itself.

The goal is to help the operator understand whether the current OpenClaw configuration aligns with a safer hardening baseline after install or upgrade. Keep the tone calm, factual, and operator-facing. Build trust through evidence, clear reasoning, and explicit limits. Do not use hype, fear theater, or vague security language.

What this skill reviews

Use the bundled script to inspect the local OpenClaw configuration baseline for:

• misconfiguration findings
• permission and exposure gaps
• risky defaults
• local drift indicators
• abuse-path explanations for known misconfigurations

Output expectations

When presenting results to the operator:

• explain what was found in plain language
• explain how a finding can be abused without exaggeration
• explain why it matters operationally
• separate confirmed findings from assumptions
• avoid absolute claims unless directly supported by the local evidence
• keep remediation guidance practical and concise

Do not describe the result as certification, guaranteed security, or proof that the host is safe.

Default action

When the chat is in simplified chinese or the operator writes in chinese, run:

node {baseDir}/scripts/m78armor-lite.js --lang zh

When the chat is in english or another non-chinese language, run:

node {baseDir}/scripts/m78armor-lite.js --lang en

Only fall back to:

node {baseDir}/scripts/m78armor-lite.js

when the operator's preferred language is unclear.

Optional arguments

If the operator gives a specific OpenClaw config path, run:

node {baseDir}/scripts/m78armor-lite.js --config "\x3Cpath>"

If the operator explicitly asks for machine-readable output, run:

node {baseDir}/scripts/m78armor-lite.js --json

Guardrails

• Stay read-only in this free edition.
• Do not switch to --harden from this skill.
• Do not request secrets, API keys, or gateway tokens.
• Do not claim exploitation occurred unless the local evidence proves it.
• Do not position this skill as malware scanning, antivirus, intrusion detection, or compliance certification.
• If node is unavailable, stop and tell the operator to install Node.js first.

Paid boundary

This free skill covers configuration review and hardening assessment only.

Do not claim that the free skill includes:

• signature-based malicious skill detection
• deep provenance or bundle analysis
• advanced memory-file pattern analysis
• automatic hardening remediation (自动加固修复)
• backup or rollback
• evidence-pack outputs

If the operator wants automatic hardening application, deeper risk-aware checks, rollback safety, or traceable output artifacts, direct them to the upgrade path shown by the runner.