Security Team

Automates daily security, platform, and memory audits of your OpenClaw environment, alerting only on critical risks requiring immediate action.

Summary & next steps before installing/running: - Expect writes: despite README claims of "read-only by design," the setup steps create security-team/state.json, an audit-history dir, and copy the skill's scripts/config into your workspace. If you prefer no persistent footprint, do not run the setup; instead run the scripts from the skill directory manually. - Inspect and test scripts locally first: open scripts/security-scan.sh and scripts/platform-health.sh and search for the 'find_skill_root' function and other top-of-file logic. In the provided files there are garbled lines in the skill-root detection (malformed quoting); fix or validate these before executing. Run scripts in a safe environment (non-production VM or container) first. - Validate network behavior: the scripts will make outbound requests to whatever domains you add to config/domains and will call npm (which may contact registries) and openssl/curl. Ensure you only configure intended endpoints. The skill does not declare any telemetry endpoints, but you should monitor outbound connections during a first run. - Review permissions and state files: the setup changes file permissions and creates a state directory with audit history. If you are comfortable with that persistence, proceed; otherwise run scans ad-hoc and avoid running the setup copy steps. - Check large-repo and git-history impact: git history scanning and npm audits can be expensive on large repos. Limit scan_directories in config/security-config.json to avoid unintended heavy scans. - If you want stronger assurance, run the scripts through static linters (shellcheck) and execute them step-by-step with 'set -x' in an isolated environment to see what they do before letting an agent run them autonomously. If you want, I can point out the exact lines with malformed quoting in the scripts and suggest a corrected snippet to safely detect the skill root.

Type: OpenClaw Skill Name: normieclaw-security-team Version: 1.0.3 The 'Security Team' skill bundle is a comprehensive security and health monitoring tool designed for the OpenClaw environment. It includes well-structured Bash scripts (security-scan.sh and platform-health.sh) that perform legitimate auditing tasks such as secret detection, npm vulnerability checks, and service uptime monitoring. The skill demonstrates high security awareness by including explicit prompt-injection defenses in SKILL.md, enforcing strict file permissions (chmod 600/700) for its data directory, and implementing mandatory redaction of discovered secrets to prevent accidental exposure in chat logs.