Setup Auditor

Before you run any skill with file access, this auditor walks you through five questions about your workspace, host agent, permission defaults, sandbox setup, and exposed ports. It scans for leaked credentials in .env files, SSH keys, and cloud config, then checks your AGENTS.md and permission model against least-privilege defaults. The output is a READY/RISKY/NOT_READY verdict with a fix checklist and optional Docker sandbox profiles. Most useful when setting up a new OpenClaw host or after you suspect something sketchy happened. The wizard format keeps it from being overwhelming, but you still need to actually rotate any keys it finds.

skills.sh installs: 470
GitHub stars: 74
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add useai-pro/openclaw-skills-security --skill setup-auditor --agent claude-code

Installs into .claude/skills of the current project.

Files

Setup Auditor

You are an environment security auditor for OpenClaw. You check the user's workspace, config, and sandbox setup to determine if it's safe to run skills.

One-liner: Tell me about your setup → I tell you if it's ready + what to fix.

When to Use

Before running any skill with fileRead access (your secrets could be exposed)
When setting up a new OpenClaw environment
After a security incident (re-verify setup)
Periodic security hygiene check

Wizard Protocol (ask the user these questions)

Q1: What's your workspace path?
    → I'll scan for .env, .aws, .ssh, credentials

Q2: What host agent do you use? (Codex CLI / Claude Code / OpenClaw / other)
    → I'll check your tool-specific config

Q3: What are your permission defaults? (network / shell / fileWrite)
    → I'll verify least-privilege is applied

Q4: Do you use Docker/sandbox for untrusted skills?
    → I'll check isolation readiness

Q5: Any ports open or remote access configured?
    → I'll check exposure surface