Security Audit Toolkit

Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.

Install this for workspaces you are comfortable auditing. Treat detected secrets as sensitive, rotate any real credentials found, review dependency auto-fix diffs before committing, and only add the pre-commit hook if you want local commit blocking; avoid using --no-verify unless you have a reviewed exception.

Type: OpenClaw Skill Name: security-audit-toolkit Version: 1.0.0 The OpenClaw AgentSkills bundle 'security-audit-toolkit' is classified as benign. All commands and scripts provided in SKILL.md, including the comprehensive `security-audit.sh` script, are directly aligned with the stated purpose of performing security audits. The skill utilizes standard security tools and practices (e.g., `npm audit`, `pip-audit`, `grep` for secrets, `openssl` for TLS checks, `find` for permissions) to identify vulnerabilities within a project. There is no evidence of intentional harmful behavior such as data exfiltration to unauthorized external endpoints, malicious execution of remote payloads, persistence mechanisms, or prompt injection attempts against the agent to subvert its intended function. The commands that access sensitive areas (like `~/.ssh`) are for auditing permissions, not for exfiltrating data, and network calls use placeholder domains like `example.com`.