OpenClaw Hardener

This skill provides a user-choice hardening tool that can:

• - Run OpenClaw’s built-in security audit (openclaw security audit --deep / --fix).
• Run workspace hygiene checks (exec bits, stray .env, unsafe serialization patterns, etc.).
• Apply safe mechanical fixes only when explicitly requested.
• Generate (and optionally apply) a Gateway config.patch plan to tighten runtime policy.

Run the tool

Script:

• - INLINECODE4

Examples:

CODEBLOCK0

Design rules (do not violate)

• - Default = check-only. No file/config changes unless user runs fix or apply-config.
• No secrets in output. If a check reads sensitive paths, it must redact likely tokens.
• Patch plans must be explicit. Always show the patch before applying.

What it checks / fixes

OpenClaw built-in security audit

• - Runs openclaw security audit --deep (and --fix in fix mode).

Workspace hygiene (scope: workspace + ~/.openclaw)

• - Permissions sanity under ~/.openclaw (basic checks).
• Unexpected executable bits in non-executable filetypes.
• Stray .env files (warn) and tracked .env (fail).
• Risky deserialization / unsafe patterns in our scripts (heuristics).

Config hardening (optional plan)

• - Tightening inbound access defaults (pairing/allowlist, mention gating) only if you opt-in.
• Ensuring sensitive log redaction is enabled.

(Exact keys depend on your config; the plan is best-effort and should be reviewed.)