Oc Security Hardener OpenClaw Plugin & Skill | ClawHub
Looking to integrate Oc Security Hardener into your AI workflows? This free OpenClaw plugin from ClawHub helps you automate coding agents & ides tasks instantly, without having to write custom tools from scratch.
What this skill does
Audit and harden OpenClaw configuration for security. Scans openclaw.json for vulnerabilities, exposed credentials, insecure gateway settings, overly permissive exec rules, and missing security best practices. Use when asked to audit security, harden configuration, check for vulnerabilities, or secure an OpenClaw deployment.
Install
ClawHub CLI
openclaw skills install @mariusfit/oc-security-hardenerNode.js (npx)
npx clawhub@latest install oc-security-hardenerFull SKILL.md
Open originalMetadata table.
| name | description |
|---|---|
| security-hardener | Audit and harden OpenClaw configuration for security. Scans openclaw.json for vulnerabilities, exposed credentials, insecure gateway settings, overly permissive exec rules, and missing security best practices. Use when asked to audit security, harden configuration, check for vulnerabilities, or secure an OpenClaw deployment. |
SKILL.md content below is scrollable.
Security Hardener
Audit your OpenClaw configuration and apply security best practices automatically.
Quick Start
# Full security audit (read-only, no changes)
python scripts/hardener.py audit
# Audit a specific config file
python scripts/hardener.py audit --config /path/to/openclaw.json
# Audit with JSON output
python scripts/hardener.py audit -f json
# Auto-fix issues (creates backup first)
python scripts/hardener.py fix
# Fix specific issues only
python scripts/hardener.py fix --only gateway,permissions
# Scan for exposed credentials in config
python scripts/hardener.py scan-secrets
# Generate a security report
python scripts/hardener.py report -o security-report.md
# Check file permissions
python scripts/hardener.py check-perms
Commands
| Command | Args | Description |
|---|---|---|
audit |
[--config PATH] [-f FORMAT] |
Full security audit (read-only) |
fix |
[--config PATH] [--only CHECKS] |
Auto-fix issues (with backup) |
scan-secrets |
[--config PATH] |
Scan for exposed API keys/tokens |
report |
[-o FILE] |
Generate detailed security report |
check-perms |
[--config-dir PATH] |
Check file permissions |
Security Checks
| Check | Severity | Description |
|---|---|---|
gateway-bind |
CRITICAL | Gateway not bound to loopback |
exposed-keys |
CRITICAL | API keys in config instead of .env |
insecure-auth |
HIGH | allowInsecureAuth or dangerouslyDisableDeviceAuth enabled |
exec-sandbox |
HIGH | exec sandbox mode not set to restricted |
file-perms |
HIGH | Config files readable by others (not 600) |
agent-allow-all |
MEDIUM | agentToAgent.allow: ["*"] is overly permissive |
no-heartbeat |
MEDIUM | No heartbeat configured (can't detect outages) |
no-session-reset |
MEDIUM | No session reset policy (memory leak risk) |
no-pruning |
LOW | No context pruning (cost and performance impact) |
no-memory-flush |
LOW | Memory flush disabled (context loss on pruning) |
Scoring
The audit produces a security score from 0-100:
- 90-100: Excellent — production-ready
- 70-89: Good — minor improvements recommended
- 50-69: Fair — several issues to address
- 0-49: Poor — critical issues require immediate attention
Example Output
╔══════════════════════════════════════════════════╗
║ OPENCLAW SECURITY AUDIT ║
╠══════════════════════════════════════════════════╣
║ Score: 75/100 (Good) ║
║ ║
║ ✅ Gateway bound to loopback ║
║ ✅ No exposed API keys in config ║
║ ⚠️ exec sandbox mode: unrestricted ║
║ ⚠️ agentToAgent allow: * (too permissive) ║
║ ❌ File permissions too open (644 → should be 600) ║
║ ✅ Heartbeat configured ║
║ ✅ Session reset policy active ║
║ ⚠️ No context pruning configured ║
╚══════════════════════════════════════════════════╝
ClawHub Registry URL: https://clawhub.ai/mariusfit/skills/oc-security-hardener