Incident Responder
When you discover a malicious skill in your OpenClaw workspace, this walks you through the full incident response playbook: immediate containment, evidence preservation, investigation checkpoints, credential rotation priorities, and recovery verification. It's structured around severity levels (SEV-1 through SEV-4) and gives you explicit checklists for things like checking persistence mechanisms in bashrc or authorized_keys, rotating API keys in order of urgency, and documenting what happened. The opinionated stance is good here: containment first, assume the worst, never trust the malicious skill's own logs. It's basically a printed laminated card for the exact moment when you're panicking about what a sketchy skill might have accessed.
- skills.sh installs
- 445
- GitHub stars
- 74
- last updated
- Aug 21, 2026
Install
$ npx -y skills add useai-pro/openclaw-skills-security --skill incident-responder --agent claude-codeInstalls into .claude/skills of the current project.
Files
Incident Responder
You are a security incident response coordinator for OpenClaw. When a user suspects or confirms that a malicious skill was installed, you guide them through containment, investigation, and recovery.
Incident Severity Levels
| Level | Trigger | Example |
|---|---|---|
| SEV-1 (Critical) | Active data exfiltration confirmed | Credentials sent to external server |
| SEV-2 (High) | Malicious skill installed, unknown scope | Typosquat skill discovered |
| SEV-3 (Medium) | Suspicious behavior detected, unconfirmed | Unexpected network requests |
| SEV-4 (Low) | Policy violation, no confirmed malice | Over-privileged skill installed |
Response Protocol
Phase 1: Containment (Immediate — do first)
For all severity levels:
- Stop the skill immediately
- Remove the skill from active configuration - Kill any background processes it may have spawned - Disconnect network if exfiltration is suspected
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/useai-pro/openclaw-skills-security
- Categories
- Security, DevOps & CI/CD
- First seen
- Jun 3, 2026
More from useai-pro/openclaw-skills-security
All 13Recommended
More Security
game-hacking-techniquesgmh5225/awesome-game-securityGuide for game-hacking technique taxonomy and threat modeling relevant to game security. Use this skill when researching memory access, code injection, overlays325skills.sh installs
clawsec-clawhub-checkerprompt-security/clawsecClawHub reputation checker for clawsec-suite. Adds a standalone reputation gate before guarded skill installation.256skills.sh installsgame-engine-resourcesgmh5225/awesome-game-securityGuide for game-engine internals, source trees, plugins, and engine-specific security research. Use this skill when researching Unreal, Unity, Source, Godot, cus253skills.sh installsclawsec-feedprompt-security/clawsecSecurity advisory feed package for OpenClaw-related threats and vulnerabilities. The upstream feed is updated daily; local automation is handled by clawsec-suit242skills.sh installsclawtributorprompt-security/clawsecHarness-neutral community incident reporting for AI agents. Contribute to collective security by reporting threats.207skills.sh installsclaw-releaseprompt-security/clawsecRelease automation for Claw skills and website. Guides through version bumping, tagging, and release verification.178skills.sh installs