Openclaw Security Guard

Security audit CLI + live dashboard for OpenClaw. Scans for secrets, config issues, prompt injections, vulnerable dependencies, and unverified MCP servers. Zero telemetry.

This package appears coherent for a local OpenClaw security scanner, but take these precautionary steps before installing or running with --auto: - Verify the npm package and repository: confirm the package on npm matches the GitHub repo referenced in SKILL.md and check the package author/publisher identity. - Grep the source for outbound network calls (http, https, ws, fetch, axios, net.connect) to confirm 'zero telemetry' — focus on dashboard/server.js, monitors/*, and helpers for any external endpoints or hosts. - Review code paths that modify configuration (auto-hardener, fix command) and test fix --dry-run first; ensure backups are created in a location you control. - Inspect where dashboard credentials are stored (~/.openclaw-security-guard/auth.json is mentioned) and secure or delete that file as needed. - Prefer running via npx or in an isolated/sandbox environment initially rather than global install. If you want, I can (1) point to specific files to grep for outbound connections or secrets exfiltration patterns, or (2) run a quick static checklist of the top files (dashboard/server.js, monitors/*, auto-hardener.js) and list lines that look like external network usage. Confidence is medium because the package includes full source (which helps) but registry/source metadata had a small mismatch and claims like 'zero telemetry' should be verified by code inspection.

Type: OpenClaw Skill Name: openclaw-security-guard Version: 1.0.0 The OpenClaw Security Guard skill bundle is a security tool designed to audit, monitor, and harden OpenClaw installations. The code and documentation consistently emphasize privacy, local operation, and the absence of telemetry. Key security features include robust input validation using Zod, path sanitization to prevent traversal attacks, strong password hashing (PBKDF2, SHA-512) for the local dashboard, and explicit binding of the dashboard to localhost (127.0.0.1) to prevent external access. The tool performs local file system operations (reading/writing OpenClaw configuration, creating git pre-commit hooks) as part of its stated purpose, with safeguards like backups and direct programmatic file/permission modifications (e.g., `fs.chmod`) instead of shell execution. There is no evidence of data exfiltration, malicious execution, persistence mechanisms beyond intended git hooks, or prompt injection attempts against the AI agent itself. The skill is a legitimate security utility.