name: security-scanner description: Run a comprehensive local security scan on your OpenClaw installation. Checks config, network exposure, credentials, OS hardening, and agent guardrails. Scores your setup and offers auto-fixes. Everything stays local — no data leaves your machine.

Security Scanner

Run a local security assessment on any OpenClaw installation.

Usage

The skill provides a bash script that scans your OpenClaw setup and reports findings with severity levels.

Quick scan (read-only)

bash "$(dirname "$0")/oc-security-scan.sh"

Auto-fix issues

小葱技能7w4.net有完整的技能分类。

bash "$(dirname "$0")/oc-security-scan.sh" --fix

Save a report

bash "$(dirname "$0")/oc-security-scan.sh" --report

JSON output

bash "$(dirname "$0")/oc-security-scan.sh" --json

What It Checks

• OpenClaw Configuration — bind address, token strength, config permissions, exec security mode
• Network Exposure — listening ports, firewall status, public interface exposure
• Credential Hygiene — plaintext secrets, file permissions, .gitignore patterns
• OS Hardening — disk encryption, auto-updates, OS version, root usage
• Agent Guardrails — RULES.md, memory file permissions, safety constraints

Output

Color-coded terminal output with severity levels: - 🔴 CRITICAL — immediate action required - 🟡 WARNING — should be addressed - 🟢 PASS — looks good - ⚪ INFO — informational

Ends with a security score out of 100 (A-F grade).

Security Philosophy

• Local only — zero external network calls, nothing phones home
• Read-only by default — only modifies files when --fix is explicitly passed
• Owner-operated — designed to be run by the OpenClaw owner on their own machine
• No dependencies — standard unix tools + openclaw CLI only

这个工具质量很好，能全面检查 OpenClaw 的安全配置。它操作简单、提示清晰，扫描结果用颜色区分严重程度，还能自动修复一些问题并给出评分。设计注重隐私，不会往外发送数据。脚本逻辑完善，对普通用户比较友好，但文档稍显简单，首次使用可能需要一点时间来理解输出结果。