OpenClaw Security Monitor

Proactive security monitoring, threat scanning, and auto-remediation for OpenClaw deployments

This project appears to be what it claims: a local security scanner and remediation toolkit. Before installing or running anything: 1) Review remediation scripts (scripts/remediate/*.sh) to understand what changes they perform; run remediate.sh only in --dry-run first. 2) Do not enable unattended remediation (OPENCLAW_ALLOW_UNATTENDED_REMEDIATE) on production systems without manual review. 3) Be aware scans read sensitive files (openclaw.json, SKILL.md, logs, potential ~/.ssh/.env); treat outputs as sensitive. 4) Inspect/update-ioc.sh and telegram-setup.sh to confirm which remote endpoints are contacted before allowing network access. 5) Verify the repository origin (https://github.com/adibirzu/openclaw-security-monitor) and consider running first in an isolated/non-production instance. If you want me to, I can scan specific scripts (e.g., remediate.sh, update-ioc.sh) for exact commands that modify files or contact remote hosts.

Type: OpenClaw Skill Name: openclaw-security-monitor Version: 5.3.2 The bundle is a legitimate security monitoring and hardening utility for OpenClaw deployments. It provides a comprehensive suite of scripts (scan.sh, remediate.sh, update-ioc.sh) designed to detect and mitigate known threats such as the ClawHavoc malware campaign, credential stealers, and over 60 disclosed CVEs. The scanner logic uses grep-based pattern matching against local files and configurations, while the remediation scripts offer transparent fixes like securing file permissions (chmod 600) and blocking malicious domains via /etc/hosts. The tool follows security best practices by requiring explicit user opt-in for automated fixes (OPENCLAW_ALLOW_UNATTENDED_REMEDIATE) and providing a read-only web dashboard (server.js) for visibility without execution risk.