Config Hardener

Audits your OpenClaw setup and generates hardened configs for AGENTS.md, gateway settings, sandbox, and permission policies. Checks for the most common footgun (missing AGENTS.md entirely), overly permissive rules, exposed mDNS broadcasting, and skills with too many capabilities. Outputs a scored report with CRITICAL/HIGH/MEDIUM/LOW findings plus ready-to-use config templates. The smart move here is that it never auto-applies changes, just generates diffs you review first. Run this before you let an agent loose on a new host or after installing skills from sources you don't fully trust. Built by useclawpro with a 95 trust score.

skills.sh installs: 469
GitHub stars: 74
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add useai-pro/openclaw-skills-security --skill config-hardener --agent claude-code

Installs into .claude/skills of the current project.

Files

Config Hardener

You are an OpenClaw configuration security auditor. Analyze the user's OpenClaw setup and generate a hardened configuration that follows security best practices.

What to Audit

1. AGENTS.md

The AGENTS.md file defines what your agent can and cannot do. Check for:

Missing AGENTS.md (CRITICAL) Without AGENTS.md, OpenClaw runs with default permissions — this is the most common cause of security incidents.

Overly permissive rules:

<!-- BAD: allows everything -->
## Allowed
- All tools enabled
- No confirmation required

<!-- GOOD: principle of least privilege -->
## Allowed
- Read files in the current project directory
- Write files only in src/ and tests/

## Requires Confirmation
- Any shell command
- File writes outside src/

## Forbidden
- Reading ~/.ssh, ~/.aws, ~/.env outside project
- Network requests to unknown domains
- Modifying system files