Openclaw Shield

What it does

When your agent uses it

• The user asks about security
• Audit of their OpenClaw setup

Example prompts

• “/openclaw-shield”

Requirements

• Node.js
• A Bash shell

Workflow steps

11 steps, taken from the first numbered list in SKILL.md.

1. 1Gateway Auth — missing/weak auth, insecure UI settings
2. 2Network Exposure — bind address, Tailscale funnel, wildcard proxies
3. 3Channel Security — wildcard allowFrom, missing allowlists
4. 4DM Policy — open DM policy without pairing
5. 5Subagent Permissions — wildcard allowAgents, circular delegation chains, self-delegation
6. 6Tool Permissions — over-privileged agents with tools.profile: "full"
7. 7Secret Leakage — API keys, tokens, private keys in plaintext config
8. 8Sandbox/Execution — missing workspace isolation, no execution policies
9. 9Plugin Config — enabled plugins without channel config
10. 10Heartbeat Exposure — sensitive data in heartbeat prompts
11. 11Remote Config — unencrypted WebSocket, exposed remote URLs/tokens

What it can do on your machine

Read from SKILL.md and the folder at commit 331ecd3. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (JavaScript and Shell), which the agent can run.

  Shell commands in SKILL.md call:

  • node

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Openclaw Shield loads about 783 tokens when it runs. Until then it costs about 63 tokens; SKILL.md has 238 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~63

When it runs · the whole SKILL.md, loaded when a task matches

~783

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from aAAaqwq/AGI-Super-Team at commit 331ecd3, republished under its MIT licence (© aAAaqwq). 238 words, ~783 tokens.

name

openclaw-shield

description

Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.

node scripts/shield-audit.sh

node SKILL_DIR/bin/shield.js audit ~/.openclaw/openclaw.json --summary

node SKILL_DIR/bin/shield.js audit <config.json>
node SKILL_DIR/bin/shield.js audit <config.json> --summary   # human-readable

cat config.json | node SKILL_DIR/bin/shield.js audit --stdin

node SKILL_DIR/bin/shield.js sanitize <config.json>

const { auditConfig } = require('SKILL_DIR/src/audit');
const config = require('./openclaw.json');
const report = auditConfig(config);
console.log(report.risk_level);      // "CRITICAL" | "HIGH" | "MEDIUM" | "LOW"
console.log(report.overall_score);   // 0-100
console.log(report.vulnerabilities); // detailed findings

© aAAaqwq, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 8 other files (scripts) in skills/ai-shield-audit of aAAaqwq/AGI-Super-Team.

• SKILL.md
• .clawhub/origin.json
• README.md
• _meta.json
• bin/shield.js
• package.json
• scripts/shield-audit.sh
• src/audit.js
• src/sanitize.js

Open the folder on GitHubat commit 331ecd3