From 06af6c625f632fcf908ed37145de43a914411a58 Mon Sep 17 00:00:00 2001 From: developerisnow <35399970+developerisnow@users.noreply.github.com> Date: Thu, 5 Feb 2026 19:24:47 +0300 Subject: [PATCH] openclaw-skills-security: initial release --- .../ISSUE_TEMPLATE/report-malicious-skill.md | 37 +++ .github/ISSUE_TEMPLATE/skill-request.md | 22 ++ .gitignore | 6 + CONTRIBUTING.md | 50 ++++ LICENSE | 22 ++ README.md | 178 +++++++++++++ SECURITY.md | 17 ++ assets/openclaw-skills-flow.svg | 1 + catalog/skills.json | 236 ++++++++++++++++++ catalog/skills.md | 15 ++ docs/AUDIT.md | 123 +++++++++ docs/INSTALL.md | 73 ++++++ docs/config-hardening-checklist.md | 55 ++++ docs/incident-response-playbook.md | 64 +++++ docs/threat-coverage-matrix.md | 53 ++++ scripts/generate-catalog.mjs | 176 +++++++++++++ skills/config-hardener/SKILL.md | 150 +++++++++++ skills/credential-scanner/SKILL.md | 109 ++++++++ skills/dependency-auditor/SKILL.md | 175 +++++++++++++ skills/incident-responder/SKILL.md | 201 +++++++++++++++ skills/network-watcher/SKILL.md | 148 +++++++++++ skills/output-sanitizer/SKILL.md | 145 +++++++++++ skills/permission-auditor/SKILL.md | 103 ++++++++ skills/prompt-guard/SKILL.md | 158 ++++++++++++ skills/sandbox-guard/SKILL.md | 135 ++++++++++ skills/setup-auditor/SKILL.md | 220 ++++++++++++++++ skills/skill-auditor/SKILL.md | 204 +++++++++++++++ skills/skill-guard/SKILL.md | 144 +++++++++++ skills/skill-vetter/SKILL.md | 129 ++++++++++ 29 files changed, 3149 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/report-malicious-skill.md create mode 100644 .github/ISSUE_TEMPLATE/skill-request.md create mode 100644 .gitignore create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100644 README.md create mode 100644 SECURITY.md create mode 100644 assets/openclaw-skills-flow.svg create mode 100644 catalog/skills.json create mode 100644 catalog/skills.md create mode 100644 docs/AUDIT.md create mode 100644 docs/INSTALL.md create mode 100644 docs/config-hardening-checklist.md create mode 100644 docs/incident-response-playbook.md create mode 100644 docs/threat-coverage-matrix.md create mode 100644 scripts/generate-catalog.mjs create mode 100644 skills/config-hardener/SKILL.md create mode 100644 skills/credential-scanner/SKILL.md create mode 100644 skills/dependency-auditor/SKILL.md create mode 100644 skills/incident-responder/SKILL.md create mode 100644 skills/network-watcher/SKILL.md create mode 100644 skills/output-sanitizer/SKILL.md create mode 100644 skills/permission-auditor/SKILL.md create mode 100644 skills/prompt-guard/SKILL.md create mode 100644 skills/sandbox-guard/SKILL.md create mode 100644 skills/setup-auditor/SKILL.md create mode 100644 skills/skill-auditor/SKILL.md create mode 100644 skills/skill-guard/SKILL.md create mode 100644 skills/skill-vetter/SKILL.md diff --git a/.github/ISSUE_TEMPLATE/report-malicious-skill.md b/.github/ISSUE_TEMPLATE/report-malicious-skill.md new file mode 100644 index 0000000..d52ae86 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/report-malicious-skill.md @@ -0,0 +1,37 @@ +--- +name: "Report malicious skill" +about: "Report a suspicious/malicious OpenClaw skill (research only)." +title: "[malicious-skill] " +labels: ["security", "malicious-skill"] +--- + +## Skill + +- Name / slug: +- URL(s): +- Where discovered: +- Date (UTC): + +## Why suspicious + +- [ ] Typosquatting / impersonation +- [ ] Exfiltration behavior (network) +- [ ] Install hooks / persistence +- [ ] Shell execution +- [ ] Reads secrets (`.env`, `~/.ssh`, `~/.aws`, etc.) +- [ ] Obfuscation +- [ ] Other: + +## Evidence (sanitized) + +Paste **sanitized** evidence (no secrets): +- excerpts of manifest / permissions requested +- suspicious domains / IPs +- suspicious commands + +## Suggested mitigation + +- [ ] Blocklist candidate +- [ ] Needs review / reproduce safely +- [ ] Add heuristic rule + diff --git a/.github/ISSUE_TEMPLATE/skill-request.md b/.github/ISSUE_TEMPLATE/skill-request.md new file mode 100644 index 0000000..5c7e388 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/skill-request.md @@ -0,0 +1,22 @@ +--- +name: "Skill request" +about: "Request a new skill to be added to this curated set." +title: "[skill] " +labels: ["enhancement"] +--- + +## What problem does this solve? + +## Suggested skill behavior (outline) + +## Permissions needed (minimum) + +- fileRead: +- fileWrite: +- network: +- shell: + +## References + +- links / example threads / similar tools + diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..715c668 --- /dev/null +++ b/.gitignore @@ -0,0 +1,6 @@ +.DS_Store +.idea/ +.vscode/ + +# Agent artifacts / accidental copies +**/CLAUDE.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..bb5eb12 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,50 @@ +# Contributing + +This repo is a curated set of **OpenClaw skills** (Markdown-based), optimized for security-first workflows. + +## Add a skill + +1. Create a new folder: `skills//` +2. Add `skills//SKILL.md` with YAML frontmatter + Markdown body. + +Frontmatter schema (example): + +```yaml +--- +name: permission-auditor +version: 1.0.0 +description: "Analyze OpenClaw skill permissions and explain security implications." +author: useclawpro +category: Security +trustScore: 96 +permissions: + fileRead: true + fileWrite: false + network: false + shell: false +lastAudited: "2026-02-05" +--- +``` + +Rules: +- Use **ASCII** for `name` and folder `slug`. +- Keep the description short (1–2 sentences). +- Do not include secrets, tokens, or private URLs in skill bodies. +- Treat any `network` or `shell` permission as high-risk; justify it in the skill text. + +## Update catalog + +From repo root: + +```bash +node scripts/generate-catalog.mjs +``` + +This updates: +- `README.md` (skills table) +- `catalog/skills.md` +- `catalog/skills.json` + +## Reporting malicious skills + +If you find a suspicious skill in the OpenClaw ecosystem, open an issue using the **Report malicious skill** template. diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..12db493 --- /dev/null +++ b/LICENSE @@ -0,0 +1,22 @@ +MIT License + +Copyright (c) 2026 UseAI.pro + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + diff --git a/README.md b/README.md new file mode 100644 index 0000000..ed1dd7f --- /dev/null +++ b/README.md @@ -0,0 +1,178 @@ +# openclaw-skills-security + +Security-first skills for the **OpenClaw** ecosystem — maintained by **UseClawPro** (UseAI.pro). + +Two auditor skills for end-users, plus 11 reusable modules (advanced checks). + +| Job | Skill | What it does | +|-----|-------|-------------| +| **Audit a skill** | `skill-auditor` | Vet any SKILL.md before install (typosquatting, permissions, prompt injection, supply chain, exfiltration) | +| **Audit your setup** | `setup-auditor` | Check your environment for credential leaks, unsafe defaults, missing sandbox (wizard-style) | + +These are **instruction modules** (`SKILL.md`) — they don't run on their own. Load them into a host agent (Codex CLI / Claude Code / OpenClaw) or paste into any LLM chat. + +Quick links: +- UseClawPro security hub: https://useclaw.pro/ +- Pillar guide: https://useclaw.pro/guides/openclaw-security/ +- Skill Verifier (browser): https://useclaw.pro/verifier/ +- Verified Skills (catalog): https://useclaw.pro/verified-skills/ + +## Quickstart + +### Job 1 — Audit a skill before installing + +**Fast (browser):** paste the skill URL/name into [UseClawPro Verifier](https://useclaw.pro/verifier/). + +**Deep (agent):** load `skill-auditor` and give it the target: + +``` +1) Paste skills/skill-auditor/SKILL.md into your agent +2) Paste the target skill's SKILL.md +3) Ask: "Audit this skill. Return a SKILL AUDIT REPORT." +``` + +The auditor runs a 6-step protocol: metadata & typosquat check → permission analysis → dependency audit → prompt injection scan → network & exfiltration analysis → content red flags. + +Verdict: **SAFE / SUSPICIOUS / DANGEROUS / BLOCK**. + +### Job 2 — Audit your environment + +Load `setup-auditor` and answer 5 wizard questions about your workspace: + +``` +1) Paste skills/setup-auditor/SKILL.md into your agent +2) Answer the wizard: workspace path, host agent, permissions, sandbox, ports +3) Get a SETUP AUDIT REPORT with a fix checklist +``` + +The auditor runs a 4-step protocol: credential scan → config audit → sandbox readiness → persistence check. + +Verdict: **READY / RISKY / NOT_READY**. + +### Install into your host agent + +- **Codex CLI (global):** `ln -s "$PWD/skills/skill-auditor" ~/.codex/skills/skill-auditor` and `ln -s "$PWD/skills/setup-auditor" ~/.codex/skills/setup-auditor` +- **Claude Code (project):** `ln -s "$PWD/skills/skill-auditor" .claude/skills/skill-auditor` and `ln -s "$PWD/skills/setup-auditor" .claude/skills/setup-auditor` +- **No tooling:** just paste the SKILL.md content into your LLM chat. + +Modules are optional: you usually don't need to install them separately. + +## Threat coverage + +Both auditors together cover **12/12 real-world attack types** observed in the wild (including the ClawHavoc campaign): + +| # | Attack type | skill-auditor | setup-auditor | +|---|------------|:---:|:---:| +| T1 | Typosquatting | **primary** | | +| T2 | Credential theft | | **primary** | +| T3 | Crypto miners | | **primary** | +| T4 | Reverse shells | **primary** | yes | +| T5 | Prompt injection | **primary** | | +| T6 | Skill loader exploits | **primary** | yes | +| T7 | Obfuscated commands | yes | | +| T8 | Supply chain attack | **primary** | | +| T9 | Social engineering | yes | | +| T10 | Persistence | | **primary** | +| T11 | Over-privilege | **primary** | yes | +| T12 | Data exfiltration | **primary** | yes | + +Full evidence: [docs/threat-coverage-matrix.md](docs/threat-coverage-matrix.md) + +## Flow + +```mermaid +flowchart TD + A[Find a skill] --> B{Audit before install} + B -->|Fast| C[UseClawPro Verifier] + B -->|Deep| D[skill-auditor] + C --> E{Verdict} + D --> E + E -->|SAFE| F[Install into host agent] + E -->|DANGER| G[Do not install — report it] + F --> H[Run in sandbox, no network] + H -->|Suspect compromise?| I[Incident Response Playbook] + + J[New environment] --> K[setup-auditor] + K --> L{Verdict} + L -->|READY| M[Safe to run skills] + L -->|NOT_READY| N[Fix checklist → re-run] +``` + +## What's inside + +``` +skills/ + skill-auditor/SKILL.md — Job 1: vet any skill (6-step protocol) + setup-auditor/SKILL.md — Job 2: audit your environment (wizard + 4-step) + config-hardener/SKILL.md — module: harden OpenClaw config + credential-scanner/SKILL.md — module: scan workspace for leaked secrets + dependency-auditor/SKILL.md — module: supply chain / install hooks + incident-responder/SKILL.md — module: post-incident playbook (contain → rotate → recover) + network-watcher/SKILL.md — module: network/exfil checks + output-sanitizer/SKILL.md — module: redact secrets/PII from agent output + permission-auditor/SKILL.md — module: permission fit + dangerous combos + prompt-guard/SKILL.md — module: prompt injection detection + sandbox-guard/SKILL.md — module: Docker sandbox profiles + skill-guard/SKILL.md — module: runtime monitoring checklist + skill-vetter/SKILL.md — module: legacy “deep audit” checklist + +docs/ + threat-coverage-matrix.md — evidence: which checks catch which attacks + config-hardening-checklist.md — minimum security baseline + incident-response-playbook.md — what to do if compromised +``` + +## What it checks (and what it doesn't) + +**skill-auditor** checks: +- Typosquatting & naming anomalies +- Permission combinations (`network` + `shell` = critical) +- Dependency supply chain (install hooks, obfuscation, recent publish) +- Prompt injection patterns (role hijacking, hidden instructions) +- Network exfiltration (suspicious endpoints, DNS tunneling, data in headers) +- Content red flags (credential paths, encoded commands, sudo) + +**setup-auditor** checks: +- Exposed secrets in workspace (`.env`, keys, tokens — with regex patterns) +- Config hardening (AGENTS.md, permission defaults, gateway) +- Sandbox readiness (Docker, resource limits, isolation) +- Persistence indicators (`.bashrc`, `authorized_keys`, cron, git hooks) + +**Neither** guarantees: +- Runtime behavior analysis (static check only) +- Zero-day logic hidden in dependencies +- Full supply chain provenance + +Treat untrusted skills as **code execution**. Default to sandboxing. + +## Skills catalog + + + +| Skill | Type | Category | Trust | Perms | Last audited | +| --- | --- | --- | ---: | --- | --- | +| [skill-auditor](skills/skill-auditor/SKILL.md) | auditor | Security | 97 | R | 2026-02-05 | +| [setup-auditor](skills/setup-auditor/SKILL.md) | auditor | Security | 96 | R,W | 2026-02-05 | +| [credential-scanner](skills/credential-scanner/SKILL.md) | module | Security | 98 | R | 2026-02-01 | +| [prompt-guard](skills/prompt-guard/SKILL.md) | module | Security | 97 | R | 2026-02-03 | +| [skill-vetter](skills/skill-vetter/SKILL.md) | module | Security | 97 | R | 2026-02-01 | +| [incident-responder](skills/incident-responder/SKILL.md) | module | Security | 96 | R,W | 2026-02-03 | +| [permission-auditor](skills/permission-auditor/SKILL.md) | module | Security | 96 | R | 2026-02-01 | +| [skill-guard](skills/skill-guard/SKILL.md) | module | Security | 96 | R | 2026-02-03 | +| [config-hardener](skills/config-hardener/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | +| [network-watcher](skills/network-watcher/SKILL.md) | module | Security | 95 | R | 2026-02-03 | +| [sandbox-guard](skills/sandbox-guard/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | +| [output-sanitizer](skills/output-sanitizer/SKILL.md) | module | Security | 94 | R | 2026-02-03 | +| [dependency-auditor](skills/dependency-auditor/SKILL.md) | module | Security | 93 | R | 2026-02-03 | + + + +## Report a malicious skill + +If you find a suspicious OpenClaw skill in the wild, please open an issue (sanitized evidence, no secrets): + +- https://github.com/UseAI-pro/openclaw-skills-security/issues/new?template=report-malicious-skill.md + +## Contributing + +See `CONTRIBUTING.md`. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..1f63184 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,17 @@ +# Security + +If you believe you have found a security issue related to this repository: + +- Do **not** post secrets in public issues. +- Prefer reporting via a GitHub issue with sanitized details, or contact the maintainers privately if credentials may be involved. + +## Scope + +This repository contains **Markdown skill definitions**. Treat every third-party skill as **untrusted code** until reviewed, even if it looks harmless. + +Recommended baseline: +- Run OpenClaw in a sandbox (container/VM) +- Default `network: none` +- Keep `shell: prompt` +- Keep secrets isolated (`.env`, `~/.ssh`, cloud creds) + diff --git a/assets/openclaw-skills-flow.svg b/assets/openclaw-skills-flow.svg new file mode 100644 index 0000000..23f36a1 --- /dev/null +++ b/assets/openclaw-skills-flow.svg @@ -0,0 +1 @@ +

Fast

Deep

SAFE

DANGER

Find a skill: ClawHub, GitHub, ZIP

Audit before install

UseClawPro Verifier: browser

Skill Vetter: auditor agent

Verdict

Install into host agent: Codex, Claude, OpenClaw

Do not install and report suspicious

Run in sandbox: no network by default

Monitor and respond: incident playbook

 \ No newline at end of file diff --git a/catalog/skills.json b/catalog/skills.json new file mode 100644 index 0000000..906756a --- /dev/null +++ b/catalog/skills.json @@ -0,0 +1,236 @@ +[ + { + "name": "skill-auditor", + "slug": "skill-auditor", + "version": "2.0.0", + "author": "useclawpro", + "description": "Comprehensive security auditor for OpenClaw skills. Checks for typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns — before you install anything.", + "kind": "auditor", + "category": "Security", + "trustScore": 97, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-05", + "path": "skills/skill-auditor/SKILL.md" + }, + { + "name": "setup-auditor", + "slug": "setup-auditor", + "version": "2.0.0", + "author": "useclawpro", + "description": "Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style: answers questions about your setup and produces a fix checklist.", + "kind": "auditor", + "category": "Security", + "trustScore": 96, + "permissions": { + "fileRead": true, + "fileWrite": true, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-05", + "path": "skills/setup-auditor/SKILL.md" + }, + { + "name": "credential-scanner", + "slug": "credential-scanner", + "version": "1.0.0", + "author": "useclawpro", + "description": "Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental exfiltration.", + "kind": "module", + "category": "Security", + "trustScore": 98, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-01", + "path": "skills/credential-scanner/SKILL.md" + }, + { + "name": "prompt-guard", + "slug": "prompt-guard", + "version": "1.0.0", + "author": "useclawpro", + "description": "Detect and neutralize prompt injection attacks in OpenClaw skill content, user inputs, and external data sources. Prevents instruction hijacking and context manipulation.", + "kind": "module", + "category": "Security", + "trustScore": 97, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-03", + "path": "skills/prompt-guard/SKILL.md" + }, + { + "name": "skill-vetter", + "slug": "skill-vetter", + "version": "1.0.0", + "author": "useclawpro", + "description": "Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.", + "kind": "module", + "category": "Security", + "trustScore": 97, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-01", + "path": "skills/skill-vetter/SKILL.md" + }, + { + "name": "incident-responder", + "slug": "incident-responder", + "version": "1.0.0", + "author": "useclawpro", + "description": "Step-by-step incident response for OpenClaw security breaches. Guides you through containment, investigation, credential rotation, and recovery after a malicious skill is detected.", + "kind": "module", + "category": "Security", + "trustScore": 96, + "permissions": { + "fileRead": true, + "fileWrite": true, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-03", + "path": "skills/incident-responder/SKILL.md" + }, + { + "name": "permission-auditor", + "slug": "permission-auditor", + "version": "1.0.0", + "author": "useclawpro", + "description": "Analyze OpenClaw skill permissions and explain exactly what each permission allows. Identifies over-privileged skills and suggests minimal permission sets.", + "kind": "module", + "category": "Security", + "trustScore": 96, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-01", + "path": "skills/permission-auditor/SKILL.md" + }, + { + "name": "skill-guard", + "slug": "skill-guard", + "version": "1.0.0", + "author": "useclawpro", + "description": "Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries.", + "kind": "module", + "category": "Security", + "trustScore": 96, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-03", + "path": "skills/skill-guard/SKILL.md" + }, + { + "name": "config-hardener", + "slug": "config-hardener", + "version": "1.0.0", + "author": "useclawpro", + "description": "Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses.", + "kind": "module", + "category": "Security", + "trustScore": 95, + "permissions": { + "fileRead": true, + "fileWrite": true, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-01", + "path": "skills/config-hardener/SKILL.md" + }, + { + "name": "network-watcher", + "slug": "network-watcher", + "version": "1.0.0", + "author": "useclawpro", + "description": "Audit and monitor network requests made by OpenClaw skills. Detects data exfiltration, unauthorized API calls, and suspicious outbound connections.", + "kind": "module", + "category": "Security", + "trustScore": 95, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-03", + "path": "skills/network-watcher/SKILL.md" + }, + { + "name": "sandbox-guard", + "slug": "sandbox-guard", + "version": "1.0.0", + "author": "useclawpro", + "description": "Generate Docker sandbox configurations for safely running untrusted OpenClaw skills. Isolates filesystem, network, and process access.", + "kind": "module", + "category": "Security", + "trustScore": 95, + "permissions": { + "fileRead": true, + "fileWrite": true, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-01", + "path": "skills/sandbox-guard/SKILL.md" + }, + { + "name": "output-sanitizer", + "slug": "output-sanitizer", + "version": "1.0.0", + "author": "useclawpro", + "description": "Sanitize OpenClaw agent output before display. Strips leaked credentials, PII, internal paths, and sensitive data from responses.", + "kind": "module", + "category": "Security", + "trustScore": 94, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-03", + "path": "skills/output-sanitizer/SKILL.md" + }, + { + "name": "dependency-auditor", + "slug": "dependency-auditor", + "version": "1.0.0", + "author": "useclawpro", + "description": "Audit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting, and malicious packages.", + "kind": "module", + "category": "Security", + "trustScore": 93, + "permissions": { + "fileRead": true, + "fileWrite": false, + "network": false, + "shell": false + }, + "lastAudited": "2026-02-03", + "path": "skills/dependency-auditor/SKILL.md" + } +] diff --git a/catalog/skills.md b/catalog/skills.md new file mode 100644 index 0000000..a911acf --- /dev/null +++ b/catalog/skills.md @@ -0,0 +1,15 @@ +| Skill | Type | Category | Trust | Perms | Last audited | +| --- | --- | --- | ---: | --- | --- | +| [skill-auditor](skills/skill-auditor/SKILL.md) | auditor | Security | 97 | R | 2026-02-05 | +| [setup-auditor](skills/setup-auditor/SKILL.md) | auditor | Security | 96 | R,W | 2026-02-05 | +| [credential-scanner](skills/credential-scanner/SKILL.md) | module | Security | 98 | R | 2026-02-01 | +| [prompt-guard](skills/prompt-guard/SKILL.md) | module | Security | 97 | R | 2026-02-03 | +| [skill-vetter](skills/skill-vetter/SKILL.md) | module | Security | 97 | R | 2026-02-01 | +| [incident-responder](skills/incident-responder/SKILL.md) | module | Security | 96 | R,W | 2026-02-03 | +| [permission-auditor](skills/permission-auditor/SKILL.md) | module | Security | 96 | R | 2026-02-01 | +| [skill-guard](skills/skill-guard/SKILL.md) | module | Security | 96 | R | 2026-02-03 | +| [config-hardener](skills/config-hardener/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | +| [network-watcher](skills/network-watcher/SKILL.md) | module | Security | 95 | R | 2026-02-03 | +| [sandbox-guard](skills/sandbox-guard/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | +| [output-sanitizer](skills/output-sanitizer/SKILL.md) | module | Security | 94 | R | 2026-02-03 | +| [dependency-auditor](skills/dependency-auditor/SKILL.md) | module | Security | 93 | R | 2026-02-03 | diff --git a/docs/AUDIT.md b/docs/AUDIT.md new file mode 100644 index 0000000..7704757 --- /dev/null +++ b/docs/AUDIT.md @@ -0,0 +1,123 @@ +# Audit workflow (fast → deep) + +Goal: **decide if a skill is safe to install** (or if it should be blocked / sandboxed / reported). + +Mental model: +- Installing a skill is **equivalent to running untrusted code** under your user account. +- This repo provides **auditor skills** you can use in a host agent or via copy/paste. + +Start with the auditors: +- `skills/skill-auditor/SKILL.md` — Job 1: audit a skill before install +- `skills/setup-auditor/SKILL.md` — Job 2: audit your environment before running skills + +The other folders under `skills/` are **modules** (reusable checklists) that auditors reference and advanced users can run directly. + +## Inputs you can audit + +You may have one of: +- **Skill name** (e.g., `git-commit-helper`) +- **Skill URL** (ClawHub / GitHub) +- **Manifest JSON** +- A local folder containing `SKILL.md` (+ optional code files) + +## Fast check (2 minutes) + +**Action:** paste the input into the browser verifier: +- https://useclaw.pro/verifier/ + +**Result:** you get: +- a verdict (SAFE / WARNING / DANGER / MALICIOUS) +- a trust score (heuristic) +- a permissions summary (file/network/shell) +- red flags (rules matched) + +If verdict is **DANGER/MALICIOUS** → stop and report (see bottom). + +## Deep check (10–20 minutes) + +Use the “main auditor” skill (Job 1): +- `skills/skill-auditor/SKILL.md` + +### Step 1 — Manifest sanity (Result A) + +Open the target `SKILL.md` and check: +- name (typosquatting risk) +- author identity (is there a real repo/profile?) +- version history (does it look maintained?) +- description matches what it claims to do + +**Result A:** you have a short list of “this is plausible” vs “this is suspicious”. + +### Step 2 — Permissions fit (Result B) + +Ask: “does this skill *need* these permissions?” + +High‑risk combinations: +- `network` + `shell` (exfiltration is easy) +- broad file reads (home folders, dotfiles) +- install hooks / auto‑run behavior + +**Result B:** you have “permissions justified?” yes/no, plus what to deny. + +### Step 3 — Red flags in content (Result C) + +Look for: +- credential paths (`~/.ssh`, `~/.aws`, `.env`) +- “curl | bash”, `wget`, reverse shell patterns +- obfuscated or base64 payloads +- instructions to disable sandbox/safety +- unknown URLs / IPs + +**Result C:** you have a list of red flags by severity. + +### Step 4 — Verdict & next step (Result D) + +Produce a report (recommended format): + +``` +SKILL AUDIT REPORT +================== +Skill: +Source: + +VERDICT: SAFE / WARNING / DANGER / BLOCK + +WHY: +- ... + +PERMISSIONS: +- fileRead: needed/not needed — why +- fileWrite: needed/not needed — why +- network: needed/not needed — endpoints? +- shell: needed/not needed — commands? + +RED FLAGS: +- [critical] ... +- [high] ... +- [medium] ... + +NEXT: +- install in sandbox / do not install / report suspicious +``` + +## Optional: run a single module (advanced) + +If you want a focused check (instead of the full auditor protocol), run a module directly: +- Permissions fit → `skills/permission-auditor/SKILL.md` +- Prompt injection → `skills/prompt-guard/SKILL.md` +- Supply chain → `skills/dependency-auditor/SKILL.md` +- Network/exfil → `skills/network-watcher/SKILL.md` + +## “Audit without installing” (copy/paste prompt) + +If you don’t have a host tool installed yet, you can still do a full audit: +1) paste `skills/skill-auditor/SKILL.md` into any LLM +2) paste the target `SKILL.md` +3) ask for the report format above + +This keeps you in a safe “review” mode before you install anything. + +## Report suspicious / malicious skills + +Open an issue with sanitized evidence (no secrets): +- https://github.com/UseAI-pro/openclaw-skills-security/issues/new?template=report-malicious-skill.md diff --git a/docs/INSTALL.md b/docs/INSTALL.md new file mode 100644 index 0000000..cfefab4 --- /dev/null +++ b/docs/INSTALL.md @@ -0,0 +1,73 @@ +# Install (Codex CLI / Claude Code / OpenClaw) + +This repo is a **skills pack**: each skill is a folder containing a `SKILL.md` file. + +Important mental model: +- A skill is **instructions for an AI agent**. +- It doesn’t “run” by itself. +- You either **copy/paste** it into any LLM chat, or install it into a **skill-aware host**. + +Two user-facing skills (start here): +- `skill-auditor` — Job 1: audit a skill before install +- `setup-auditor` — Job 2: audit your environment before running skills + +Everything else in `skills/` is a **module** (a reusable checklist) used by the auditors and/or advanced users. + +## Option 0 — No tooling (copy/paste) + +If you just want the behavior *right now*: +1) open `skills//SKILL.md` +2) copy/paste it into ChatGPT/Claude/etc +3) then paste the “target” you want it to work on (another `SKILL.md`, a config, a log, etc.) + +This is the simplest way to use the “auditor” skills without installing anything. + +## Option 1 — Codex CLI (global skills) + +Typical location: +- `~/.codex/skills//SKILL.md` + +macOS/Linux (symlink): +```bash +git clone https://github.com/UseAI-pro/openclaw-skills-security.git +cd openclaw-skills-security + +mkdir -p ~/.codex/skills +ln -s "$PWD/skills/skill-auditor" ~/.codex/skills/skill-auditor +ln -s "$PWD/skills/setup-auditor" ~/.codex/skills/setup-auditor +``` + +Expected result: +- after restarting Codex, the auditors appear in your available skills list (or become usable by name). + +## Option 2 — Claude Code (project-local skills) + +Typical location (inside your project): +- `.claude/skills//SKILL.md` + +macOS/Linux (symlink): +```bash +git clone https://github.com/UseAI-pro/openclaw-skills-security.git +cd openclaw-skills-security + +mkdir -p .claude/skills +ln -s "$PWD/skills/skill-auditor" .claude/skills/skill-auditor +ln -s "$PWD/skills/setup-auditor" .claude/skills/setup-auditor +``` + +Expected result: +- after restarting Claude Code, the project skill is available and can be invoked by name. + +## Option 3 — OpenClaw + +OpenClaw hosts vary. The only invariant we rely on is: +- a skill is a folder containing `SKILL.md` + +If your OpenClaw host supports loading local skills, point it at the `skills/` directory or copy individual skill folders into its configured “skills” path. + +## Smoke test prompt + +After installation, try: +- “Use `skill-auditor` to audit the SKILL.md below and return a SKILL AUDIT REPORT.” + +Then paste any target `SKILL.md` (or a manifest JSON) to confirm the flow works end-to-end. diff --git a/docs/config-hardening-checklist.md b/docs/config-hardening-checklist.md new file mode 100644 index 0000000..7762d62 --- /dev/null +++ b/docs/config-hardening-checklist.md @@ -0,0 +1,55 @@ +# Config Hardening Checklist + +> Minimum security baseline for running OpenClaw skills safely. + +## P0 (do today) + +- [ ] **Create AGENTS.md** with explicit allowed/forbidden actions +- [ ] **Set `network: none`** as default for all skills +- [ ] **Set `shell: prompt`** (require confirmation for every command) +- [ ] **Add to .gitignore**: `.env`, `*.pem`, `*.key`, `.ssh/`, `.aws/` +- [ ] **Enable sandbox mode** for untrusted skills + +## P1 (this week) + +- [ ] Audit all installed skills with `skill-auditor` +- [ ] Set up Docker sandbox profile (see `setup-auditor`) +- [ ] Configure file access allowlists (project dirs only) +- [ ] Disable mDNS broadcasting (gateway config) +- [ ] Enable HTTPS for remote access +- [ ] Configure rate limiting + +## AGENTS.md Template + +```markdown +# Security Policy + +## Allowed (no confirmation) +- Read files in current project directory +- Write files in src/, tests/, docs/ +- Read-only git commands (status, log, diff) + +## Requires Confirmation +- Any shell command that modifies files +- Git commits and pushes +- Installing dependencies +- File operations outside project directory + +## Forbidden (never) +- Read ~/.ssh, ~/.aws, ~/.gnupg, ~/.config/gh +- Read .env files outside current project +- Network requests to undeclared domains +- Execute downloaded scripts +- Modify system config files +- Disable sandbox or security settings +- Run as root/sudo +``` + +## Dangerous Permission Combinations + +| Combination | Risk | Action | +|---|---|---| +| `network` + `fileRead` | CRITICAL | Exfiltration — deny unless justified | +| `network` + `shell` | CRITICAL | Full remote access — deny | +| `shell` + `fileWrite` | HIGH | Persistence — require sandbox | +| All four permissions | CRITICAL | Full system access — deny | diff --git a/docs/incident-response-playbook.md b/docs/incident-response-playbook.md new file mode 100644 index 0000000..11ccb35 --- /dev/null +++ b/docs/incident-response-playbook.md @@ -0,0 +1,64 @@ +# Incident Response Playbook + +> What to do if you suspect a malicious skill was installed or your OpenClaw setup was compromised. + +## Severity Levels + +| Level | Trigger | Example | +|---|---|---| +| SEV-1 (Critical) | Active data exfiltration confirmed | Credentials sent to external server | +| SEV-2 (High) | Malicious skill installed, unknown scope | Typosquat skill discovered | +| SEV-3 (Medium) | Suspicious behavior detected, unconfirmed | Unexpected network requests | +| SEV-4 (Low) | Policy violation, no confirmed malice | Over-privileged skill installed | + +## Phase 1: Containment (do first) + +1. **Stop the skill** — remove from config, kill background processes +2. **Disconnect network** if exfiltration suspected +3. **Preserve evidence** — save the malicious SKILL.md, logs, timestamps +4. **Revoke API tokens** the skill had access to + +## Phase 2: Investigation + +**What did the skill access?** +- Which files? (especially `.env`, `.ssh`, `.aws`) +- Network requests? To which endpoints? +- Shell commands? Which ones? +- File modifications? + +**Was persistence established?** +- `~/.bashrc`, `~/.zshrc`, `~/.profile` +- `~/.ssh/authorized_keys` +- `crontab -l` +- `.git/hooks/` +- Node.js `postinstall` scripts + +## Phase 3: Credential Rotation + +**Rotate immediately (SEV-1/2):** +- [ ] API keys in `.env` +- [ ] Cloud provider keys (AWS, GCP, Azure) +- [ ] GitHub/GitLab tokens +- [ ] Database passwords +- [ ] SSH keys + +**Rotate within 24h:** +- [ ] Service account credentials +- [ ] CI/CD pipeline secrets +- [ ] Third-party API keys + +## Phase 4: Recovery + +1. Remove malicious skill and all traces +2. Restore modified files from git +3. Run `setup-auditor` to verify clean state +4. Enable sandbox mode for all future skills + +## Phase 5: Report + +Document: date, severity, skill name, exposure duration, compromised data, actions taken, lessons learned. + +Report the skill: +- ClawHub (for removal) +- UseClawPro (for database update) +- OpenClaw security team (if CVE applies) diff --git a/docs/threat-coverage-matrix.md b/docs/threat-coverage-matrix.md new file mode 100644 index 0000000..0057192 --- /dev/null +++ b/docs/threat-coverage-matrix.md @@ -0,0 +1,53 @@ +# Threat Coverage Matrix + +> Evidence: which checks catch which real-world attacks. + +## Source Data + +- **22 curated threats** from UseClaw malicious skills database +- **341 malicious skills** from ClawHavoc campaign (Jan-Feb 2026) + +## Real Attack Types + +| # | Attack Type | Real Examples | Frequency | +|---|---|---|---| +| T1 | Typosquatting | gihub-push, github-pusher, code-reveiw, docs-writer | 36% of curated | +| T2 | Credential theft | env-backup, cloud-sync-pro, project-stats | 14% | +| T3 | Crypto miners | build-optimizer-turbo, perf-boost | 9% | +| T4 | Reverse shells | remote-debug-helper, ssh-manager | 9% | +| T5 | Prompt injection | prompt-enhance, context-boost | 9% | +| T6 | Skill loader exploits | skill-loader-patch, auto-update-fix | 9% | +| T7 | Obfuscated commands | (ClawHavoc campaign) | common | +| T8 | Supply chain attack | (ClawHub ecosystem) | common | +| T9 | Social engineering | (trust exploitation) | common | +| T10 | Persistence | .bashrc modification, authorized_keys injection | 9% | +| T11 | Over-privilege | full system access without justification | 5% | +| T12 | Data exfiltration | network POST with file/env content | 14% | + +## Coverage by Auditor + +### skill-auditor catches: + +| Step | Threats Covered | Primary For | +|---|---|---| +| Step 1: Metadata & Typosquat | T1 | T1 Typosquatting | +| Step 2: Permission Analysis | T4, T11, T12 | T11 Over-privilege | +| Step 3: Dependency Audit | T1, T6, T7, T8 | T6 Loader exploits, T8 Supply chain | +| Step 4: Prompt Injection | T5, T7, T9 | T5 Prompt injection, T9 Social eng | +| Step 5: Network Analysis | T4, T7, T12 | T4 Reverse shells, T12 Exfil | +| Step 6: Content Red Flags | T1, T2, T4, T5, T7 | General | + +**Total: 10/12 threat types covered** + +### setup-auditor catches: + +| Step | Threats Covered | Primary For | +|---|---|---| +| Step 1: Credential Scan | T2, T12 | T2 Credential theft | +| Step 2: Config Audit | T10, T11 | T10 Persistence | +| Step 3: Sandbox Readiness | T3, T4, T6 | T3 Crypto miners | +| Step 4: Persistence Check | T10 | T10 Persistence | + +**Total: 7/12 threat types covered** + +### Combined coverage: 12/12 threat types diff --git a/scripts/generate-catalog.mjs b/scripts/generate-catalog.mjs new file mode 100644 index 0000000..36b4c30 --- /dev/null +++ b/scripts/generate-catalog.mjs @@ -0,0 +1,176 @@ +import { readdirSync, readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'; +import { join } from 'node:path'; + +const ROOT = process.cwd(); +const SKILLS_DIR = join(ROOT, 'skills'); +const CATALOG_DIR = join(ROOT, 'catalog'); +const README_PATH = join(ROOT, 'README.md'); + +function parseFrontmatter(content) { + const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/); + if (!match) return null; + + const yaml = match[1]; + const result = {}; + + let currentKey = null; + let nestedObj = null; + + for (const line of yaml.split('\n')) { + if (!line.trim()) continue; + + if (/^\s{2,}\w/.test(line) && currentKey) { + const nestedMatch = line.trim().match(/^(\w+):\s*(.+)$/); + if (nestedMatch) { + if (!nestedObj) nestedObj = {}; + let val = nestedMatch[2].trim(); + if (val === 'true') val = true; + else if (val === 'false') val = false; + nestedObj[nestedMatch[1]] = val; + } + continue; + } + + if (currentKey && nestedObj) { + result[currentKey] = nestedObj; + nestedObj = null; + } + + const topMatch = line.match(/^(\w+):\s*(.*)?$/); + if (topMatch) { + currentKey = topMatch[1]; + let val = (topMatch[2] || '').trim(); + + if (val === '') { + nestedObj = {}; + continue; + } + + if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) { + val = val.slice(1, -1); + } + + if (val === 'true') val = true; + else if (val === 'false') val = false; + else if (/^\d+$/.test(val)) val = parseInt(val, 10); + + result[currentKey] = val; + nestedObj = null; + } + } + + if (currentKey && nestedObj && Object.keys(nestedObj).length > 0) { + result[currentKey] = nestedObj; + } + + return result; +} + +function permsToShort(perms) { + const parts = []; + if (perms?.fileRead === true) parts.push('R'); + if (perms?.fileWrite === true) parts.push('W'); + if (perms?.network === true) parts.push('Net'); + if (perms?.shell === true) parts.push('Sh'); + return parts.length ? parts.join(',') : '-'; +} + +function kindRank(kind) { + if (kind === 'auditor') return 0; + if (kind === 'module') return 1; + return 2; +} + +function loadSkills() { + if (!existsSync(SKILLS_DIR)) throw new Error(`Missing skills dir: ${SKILLS_DIR}`); + + const dirs = readdirSync(SKILLS_DIR, { withFileTypes: true }) + .filter(d => d.isDirectory()) + .map(d => d.name) + .sort((a, b) => a.localeCompare(b)); + + const skills = []; + for (const slug of dirs) { + const skillPath = join(SKILLS_DIR, slug, 'SKILL.md'); + const raw = readFileSync(skillPath, 'utf-8'); + const fm = parseFrontmatter(raw); + if (!fm?.name) continue; + + skills.push({ + name: fm.name, + slug, + version: fm.version || '', + author: fm.author || '', + description: fm.description || '', + kind: fm.kind || '', + category: fm.category || '', + trustScore: typeof fm.trustScore === 'number' ? fm.trustScore : null, + permissions: fm.permissions || {}, + lastAudited: fm.lastAudited || '', + path: `skills/${slug}/SKILL.md`, + }); + } + + skills.sort((a, b) => { + const ak = kindRank(a.kind); + const bk = kindRank(b.kind); + if (bk != ak) return ak - bk; + const at = a.trustScore ?? -1; + const bt = b.trustScore ?? -1; + if (bt !== at) return bt - at; + return a.slug.localeCompare(b.slug); + }); + + return skills; +} + +function toMarkdownTable(skills) { + const header = [ + '| Skill | Type | Category | Trust | Perms | Last audited |', + '| --- | --- | --- | ---: | --- | --- |', + ]; + + const rows = skills.map(s => { + const trust = s.trustScore ?? ''; + const perms = permsToShort(s.permissions); + const audited = s.lastAudited || ''; + const kind = s.kind || ''; + const category = s.category || ''; + return `| [${s.slug}](${s.path}) | ${kind} | ${category} | ${trust} | ${perms} | ${audited} |`; + }); + + return header.concat(rows).join('\n') + '\n'; +} + +function updateReadmeTable(tableMd) { + const readme = readFileSync(README_PATH, 'utf-8'); + const start = ''; + const end = ''; + + const startIdx = readme.indexOf(start); + const endIdx = readme.indexOf(end); + if (startIdx === -1 || endIdx === -1 || endIdx < startIdx) { + throw new Error('README.md is missing catalog markers'); + } + + const before = readme.slice(0, startIdx + start.length); + const after = readme.slice(endIdx); + const next = `${before}\n\n${tableMd}\n${after}`; + + writeFileSync(README_PATH, next); +} + +function main() { + const skills = loadSkills(); + const tableMd = toMarkdownTable(skills); + + mkdirSync(CATALOG_DIR, { recursive: true }); + writeFileSync(join(CATALOG_DIR, 'skills.md'), tableMd); + writeFileSync(join(CATALOG_DIR, 'skills.json'), JSON.stringify(skills, null, 2) + '\n'); + + updateReadmeTable(tableMd); + + console.log(`Catalog generated: ${skills.length} skills`); +} + +main(); diff --git a/skills/config-hardener/SKILL.md b/skills/config-hardener/SKILL.md new file mode 100644 index 0000000..25c631c --- /dev/null +++ b/skills/config-hardener/SKILL.md @@ -0,0 +1,150 @@ +--- +name: config-hardener +version: 1.0.0 +description: "Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses." +kind: module +author: useclawpro +category: Security +trustScore: 95 +permissions: + fileRead: true + fileWrite: true + network: false + shell: false +lastAudited: "2026-02-01" +--- + +# Config Hardener + +You are an OpenClaw configuration security auditor. Analyze the user's OpenClaw setup and generate a hardened configuration that follows security best practices. + +## What to Audit + +### 1. AGENTS.md + +The `AGENTS.md` file defines what your agent can and cannot do. Check for: + +**Missing AGENTS.md (CRITICAL)** +Without AGENTS.md, OpenClaw runs with default permissions — this is the most common cause of security incidents. + +**Overly permissive rules:** +```markdown + +## Allowed +- All tools enabled +- No confirmation required + + +## Allowed +- Read files in the current project directory +- Write files only in src/ and tests/ + +## Requires Confirmation +- Any shell command +- File writes outside src/ + +## Forbidden +- Reading ~/.ssh, ~/.aws, ~/.env outside project +- Network requests to unknown domains +- Modifying system files +``` + +### 2. Gateway Settings + +Check the gateway configuration for: + +- [ ] Authentication enabled (not using default/no auth) +- [ ] mDNS broadcasting disabled (prevents local network discovery) +- [ ] HTTPS enabled for remote access +- [ ] Rate limiting configured +- [ ] Allowed origins restricted (no wildcard `*`) + +### 3. Skill Permissions Policy + +Check how skills are configured: + +- [ ] Default deny policy for new skills +- [ ] Each skill has explicit permission overrides +- [ ] No skill has all four permissions (fileRead + fileWrite + network + shell) +- [ ] Audit log enabled for permission usage + +### 4. Sandbox Configuration + +- [ ] Sandbox mode enabled for untrusted skills +- [ ] Docker/container runtime available +- [ ] Resource limits set (memory, CPU, pids) +- [ ] Network isolation for sandbox containers + +## Hardened Configuration Generator + +After auditing, generate a secure configuration: + +### AGENTS.md Template + +```markdown +# Security Policy + +## Identity +You are a coding assistant working on [PROJECT_NAME]. + +## Allowed (no confirmation needed) +- Read files in the current project directory +- Write files in src/, tests/, docs/ +- Run read-only git commands (git status, git log, git diff) + +## Requires Confirmation +- Any shell command that modifies files +- Git commits and pushes +- Installing dependencies (npm install, pip install) +- File operations outside the project directory + +## Forbidden (never do these) +- Read or access ~/.ssh, ~/.aws, ~/.gnupg, ~/.config/gh +- Read .env files outside the current project +- Make network requests to domains not in the project's dependencies +- Execute downloaded scripts +- Modify system configuration files +- Disable sandbox or security settings +- Run commands as root/sudo +``` + +## Output Format + +``` +OPENCLAW SECURITY AUDIT +======================= + +Configuration Score: /100 + +[CRITICAL] Missing AGENTS.md + Risk: Agent operates with no behavioral constraints + Fix: Create AGENTS.md with the template below + +[HIGH] mDNS broadcasting enabled + Risk: Your OpenClaw instance is discoverable on the local network + Fix: Set gateway.mdns.enabled = false + +[MEDIUM] No sandbox configured + Risk: Untrusted skills run directly on host + Fix: Enable Docker sandbox mode + +[LOW] Audit logging disabled + Risk: Cannot track permission usage by skills + Fix: Enable audit logging in settings + +GENERATED FILES: +1. AGENTS.md — behavioral constraints +2. .openclaw/settings.json — hardened settings + +Apply these changes? [Review each file before applying] +``` + +## Rules + +1. Always recommend the most restrictive configuration that still allows the user's workflow +2. Never disable security features — only add or tighten them +3. Explain each recommendation in plain language +4. Generate ready-to-use config files, not just advice +5. If the user has no AGENTS.md, treat this as the highest priority finding +6. Check for common misconfigurations from quick-start guides that prioritize convenience over security +7. **Never auto-apply changes** — only generate diffs, templates, or config files for the user to review. All modifications must be explicitly approved before being written to disk diff --git a/skills/credential-scanner/SKILL.md b/skills/credential-scanner/SKILL.md new file mode 100644 index 0000000..a1efa11 --- /dev/null +++ b/skills/credential-scanner/SKILL.md @@ -0,0 +1,109 @@ +--- +name: credential-scanner +version: 1.0.0 +description: "Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental exfiltration." +kind: module +author: useclawpro +category: Security +trustScore: 98 +permissions: + fileRead: true + fileWrite: false + network: false + shell: false +lastAudited: "2026-02-01" +--- + +# Credential Scanner + +You are a credential scanner for OpenClaw projects. Before the user runs any skill that has `fileRead` access, scan the workspace for exposed secrets that could be read and potentially exfiltrated. + +## What to Scan + +### High-Priority Files + +**Default scope: current workspace only.** Scan project-level files first: + +- `.env`, `.env.local`, `.env.production`, `.env.*` +- `docker-compose.yml` (environment sections) +- `config.json`, `settings.json`, `secrets.json` +- `*.pem`, `*.key`, `*.p12`, `*.pfx` + +**Home directory files (scan only with explicit user consent):** + +- `~/.aws/credentials`, `~/.aws/config` +- `~/.ssh/id_rsa`, `~/.ssh/id_ed25519`, `~/.ssh/config` +- `~/.netrc`, `~/.npmrc`, `~/.pypirc` + +### Patterns to Detect + +Scan all text files for these patterns: + +``` +# API Keys +AKIA[0-9A-Z]{16} # AWS Access Key +sk-[a-zA-Z0-9]{48} # OpenAI API Key +sk-ant-[a-zA-Z0-9-]{80,} # Anthropic API Key +ghp_[a-zA-Z0-9]{36} # GitHub Personal Token +gho_[a-zA-Z0-9]{36} # GitHub OAuth Token +glpat-[a-zA-Z0-9-_]{20} # GitLab Personal Token +xoxb-[0-9]{10,}-[a-zA-Z0-9]{24} # Slack Bot Token +SG\.[a-zA-Z0-9-_]{22}\.[a-zA-Z0-9-_]{43} # SendGrid API Key + +# Private Keys +-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY----- +-----BEGIN PGP PRIVATE KEY BLOCK----- + +# Database URLs +(postgres|mysql|mongodb)://[^\s'"]+:[^\s'"]+@ + +# Generic Secrets +(password|secret|token|api_key|apikey)\s*[:=]\s*['"][^\s'"]{8,}['"] +``` + +### Files to Skip + +Do not scan: +- `node_modules/`, `vendor/`, `.git/`, `dist/`, `build/` +- Binary files (images, compiled code, archives) +- Lock files (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) +- Test fixtures clearly marked as examples (`example`, `test`, `mock`, `fixture` in path) + +## Output Format + +``` +CREDENTIAL SCAN REPORT +====================== +Project: +Files scanned: +Secrets found: + +[CRITICAL] .env:3 + Type: API Key (OpenAI) + Value: sk-proj-...████████████ + Action: Move to secret manager, add .env to .gitignore + +[CRITICAL] src/config.ts:15 + Type: Database URL with credentials + Value: postgres://admin:████████@db.example.com/prod + Action: Use environment variable instead + +[WARNING] docker-compose.yml:22 + Type: Hardcoded password in environment + Value: POSTGRES_PASSWORD=████████ + Action: Use Docker secrets or .env file + +RECOMMENDATIONS: +1. Add .env to .gitignore (if not already) +2. Rotate any exposed keys immediately +3. Consider using a secret manager (e.g., 1Password CLI, Vault, Doppler) +``` + +## Rules + +1. Never display full secret values — always truncate with `████████` +2. Check `.gitignore` and warn if sensitive files are NOT ignored +3. Differentiate between committed secrets (critical) and local-only files (warning) +4. If running before a skill with `network` access — escalate all findings to CRITICAL +5. Suggest specific remediation for each finding +6. Check if the project has a `.env.example` that accidentally contains real values diff --git a/skills/dependency-auditor/SKILL.md b/skills/dependency-auditor/SKILL.md new file mode 100644 index 0000000..a7c916f --- /dev/null +++ b/skills/dependency-auditor/SKILL.md @@ -0,0 +1,175 @@ +--- +name: dependency-auditor +version: 1.0.0 +description: "Audit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting, and malicious packages." +kind: module +author: useclawpro +category: Security +trustScore: 93 +permissions: + fileRead: true + fileWrite: false + network: false + shell: false +lastAudited: "2026-02-03" +--- + +# Dependency Auditor + +You are a dependency security auditor for OpenClaw. When a skill tries to install packages or you review a project's dependencies, check for security issues. + +## When to Audit + +- Before running `npm install`, `pip install`, `go get` commands suggested by a skill +- When reviewing a skill that adds dependencies to package.json or requirements.txt +- When a skill suggests installing a package you haven't used before +- During periodic security audits of your project + +## Audit Checklist + +### 1. Package Legitimacy + +For each package, verify: + +- [ ] **Name matches intent** — is it the actual package, or a typosquat? + ``` + lodash ← legitimate + l0dash ← typosquat (zero instead of 'o') + lodash-es ← legitimate variant + lodash-ess ← typosquat (extra 's') + ``` + +- [ ] **Publisher is known** — check who published the package + ``` + npm: Check npmjs.com/package/ for publisher identity + pip: Check pypi.org/project/ for maintainer + ``` + +- [ ] **Download count is reasonable** — very new packages with 0-10 downloads are higher risk + +- [ ] **Repository exists** — the package should link to a real source repository + +- [ ] **Last published recently** — abandoned packages may have known unpatched vulnerabilities + +### 2. Known Vulnerabilities + +Check against vulnerability databases. + +Note (offline-first): this skill declares `network: false`, so you must not fetch live URLs yourself. Treat links below as **manual references** for the user to open, and prefer local commands (`npm audit`, `pip-audit`, `govulncheck`) when possible. + +``` +NPM: + npm audit + Check: https://github.com/advisories + +PyPI: + pip-audit + Check: https://osv.dev + +Go: + govulncheck + Check: https://vuln.go.dev +``` + +**Severity classification:** +| Severity | Action | +|---|---| +| Critical (CVSS 9.0+) | Do not install. Find alternative. | +| High (CVSS 7.0-8.9) | Install only if patched version available. | +| Medium (CVSS 4.0-6.9) | Install with awareness. Monitor for patches. | +| Low (CVSS 0.1-3.9) | Generally acceptable. Note for future. | + +### 3. Suspicious Package Indicators + +**Red flags that warrant deeper investigation:** + +- Package has `postinstall`, `preinstall`, or `install` scripts + ```json + // package.json — check "scripts" section + "scripts": { + "postinstall": "node setup.js" // ← What does this do? + } + ``` + +- Package imports `child_process`, `net`, `dns`, `http` in unexpected ways + +- Package reads environment variables or file system on import + +- Package has obfuscated or minified source code (unusual for npm packages) + +- Package was published very recently (< 1 week) and has minimal downloads + +- Package name is similar to a popular package but from a different publisher + +- Package has been transferred to a new owner recently + +### 4. Dependency Tree Depth + +Check transitive dependencies: + +``` +Direct dependency → sub-dependency → sub-sub-dependency + (you audit) (who audits?) (nobody audits?) +``` + +- Flag packages with excessive dependency trees (100+ transitive deps) +- Check if any transitive dependency has known vulnerabilities +- Prefer packages with fewer dependencies + +### 5. License Compatibility + +Verify licenses are compatible with your project: + +| License | Commercial Use | Copyleft Risk | +|---|---|---| +| MIT, ISC, BSD | Yes | No | +| Apache-2.0 | Yes | No | +| GPL-3.0 | Caution | Yes — derivative works must be GPL | +| AGPL-3.0 | Caution | Yes — even network use triggers copyleft | +| UNLICENSED | No | Unknown — avoid | + +## Output Format + +``` +DEPENDENCY AUDIT REPORT +======================= +Package: @ +Registry: npm / pypi / go +Requested by: + +CHECKS: + [PASS] Name verification — no typosquatting detected + [PASS] Publisher — @official-org, verified + [WARN] Vulnerabilities — 1 medium severity (CVE-2026-XXXXX) + [PASS] Install scripts — none + [PASS] License — MIT + [WARN] Dependencies — 47 transitive dependencies + +OVERALL: APPROVE / REVIEW / REJECT + +RECOMMENDATIONS: + - Update to version X.Y.Z to resolve CVE-2026-XXXXX + - Consider alternative package 'safer-alternative' with fewer dependencies +``` + +## Common Typosquatting Patterns + +Watch for these naming tricks: + +| Technique | Legitimate | Typosquat | +|---|---|---| +| Character swap | express | exrpess | +| Missing character | request | requst | +| Extra character | lodash | lodashs | +| Homoglyph | babel | babe1 (L → 1) | +| Scope confusion | @types/node | @tyeps/node | +| Hyphen trick | react-dom | react_dom | +| Prefix/suffix | webpack | webpack-tool | + +## Rules + +1. Never auto-approve `npm install` or `pip install` from untrusted skills +2. Always check install scripts before running — they execute with full system access +3. Pin dependency versions in production — avoid `^` or `~` ranges for security-critical packages +4. If a skill wants to install 10+ packages, review each one individually +5. When in doubt, read the package source code — it's usually small enough to skim diff --git a/skills/incident-responder/SKILL.md b/skills/incident-responder/SKILL.md new file mode 100644 index 0000000..6463611 --- /dev/null +++ b/skills/incident-responder/SKILL.md @@ -0,0 +1,201 @@ +--- +name: incident-responder +version: 1.0.0 +description: "Step-by-step incident response for OpenClaw security breaches. Guides you through containment, investigation, credential rotation, and recovery after a malicious skill is detected." +kind: module +author: useclawpro +category: Security +trustScore: 96 +permissions: + fileRead: true + fileWrite: true + network: false + shell: false +lastAudited: "2026-02-03" +--- + +# Incident Responder + +You are a security incident response coordinator for OpenClaw. When a user suspects or confirms that a malicious skill was installed, you guide them through containment, investigation, and recovery. + +## Incident Severity Levels + +| Level | Trigger | Example | +|---|---|---| +| SEV-1 (Critical) | Active data exfiltration confirmed | Credentials sent to external server | +| SEV-2 (High) | Malicious skill installed, unknown scope | Typosquat skill discovered | +| SEV-3 (Medium) | Suspicious behavior detected, unconfirmed | Unexpected network requests | +| SEV-4 (Low) | Policy violation, no confirmed malice | Over-privileged skill installed | + +## Response Protocol + +### Phase 1: Containment (Immediate — do first) + +**For all severity levels:** + +1. **Stop the skill immediately** + ``` + - Remove the skill from active configuration + - Kill any background processes it may have spawned + - Disconnect network if exfiltration is suspected + ``` + +2. **Preserve evidence** + ``` + - Do NOT delete the malicious SKILL.md — save a copy for analysis + - Save any logs from the OpenClaw session + - Screenshot any suspicious behavior observed + - Note the exact timestamp of installation and discovery + ``` + +3. **Isolate the environment** + ``` + - If running on a shared system, take it offline + - Revoke any API tokens the skill had access to + - Change passwords for any accounts accessible from the system + ``` + +### Phase 2: Investigation + +Determine the scope of the compromise: + +**Check 1: What did the skill access?** +``` +Review questions: +- Which files did the skill read? (especially .env, .ssh, .aws) +- Did the skill make network requests? To which endpoints? +- Did the skill execute shell commands? Which ones? +- Did the skill write or modify any files? Which ones? +- How long was the skill active before detection? +``` + +**Check 2: Was data exfiltrated?** +``` +Look for evidence of: +- Outbound network connections with POST bodies +- DNS queries to unusual domains +- Large data transfers in logs +- Base64-encoded data in request headers or URLs +``` + +**Check 3: Was persistence established?** +``` +Check these locations for modifications: +- ~/.bashrc, ~/.zshrc, ~/.profile (shell startup) +- ~/.ssh/authorized_keys (SSH backdoor) +- Crontab entries (cron -l) +- Systemd services, launchd agents +- Node.js postinstall scripts in package.json +- Git hooks (.git/hooks/) +- VS Code / editor extensions +``` + +**Check 4: Were other systems affected?** +``` +If the skill had network access: +- Check if it accessed internal services +- Review connected CI/CD pipelines +- Check cloud provider audit logs (AWS CloudTrail, etc.) +- Review git push history for unauthorized commits +``` + +### Phase 3: Credential Rotation + +Rotate all credentials that were potentially exposed: + +``` +CREDENTIAL ROTATION CHECKLIST +============================== + +Priority 1 — Rotate immediately: +[ ] API keys found in .env files +[ ] Cloud provider keys (AWS, GCP, Azure) +[ ] GitHub / GitLab tokens +[ ] Database passwords +[ ] SSH keys (generate new ones, update authorized_keys) + +Priority 2 — Rotate within 24 hours: +[ ] Service account credentials +[ ] CI/CD pipeline secrets +[ ] Third-party API keys (Stripe, SendGrid, etc.) +[ ] Container registry tokens +[ ] Package registry tokens (npm, PyPI) + +Priority 3 — Rotate within 1 week: +[ ] Personal passwords for connected services +[ ] OAuth application secrets +[ ] Encryption keys (if the skill accessed them) +[ ] Signing certificates +``` + +### Phase 4: Recovery + +1. **Remove all traces of the malicious skill** + ``` + - Delete the SKILL.md from configuration + - Check for modified files and restore from git + - Remove any files the skill created + - Clean up any persistence mechanisms found in Phase 2 + ``` + +2. **Harden the environment** + ``` + - Install the config-hardener skill and run it + - Enable sandbox mode for all skills + - Review and tighten AGENTS.md + - Enable audit logging + ``` + +3. **Verify recovery** + ``` + - Run credential-scanner to check for remaining exposed secrets + - Run skill-vetter on all remaining installed skills + - Check git status for uncommitted changes + - Verify no unknown processes are running + ``` + +### Phase 5: Post-Incident + +1. **Document the incident** + ``` + INCIDENT REPORT + =============== + Date: + Severity: SEV- + Skill involved: + Duration of exposure: