security-guardian

ClawSkills 作者 clawskills

Automated security auditing for OpenClaw projects. Scans for hardcoded secrets (API keys, tokens) and container vulnerabilities (CVEs) using Trivy. Provides structured reports to help maintain a clean and secure codebase.

安装 / 下载方式

TotalClaw CLI推荐

totalclaw install clawskills:clawskills~1999azzar-security-guardian

cURL直接下载，无需登录

curl -fsSL https://skills.taituai.com/api/skills/clawskills%3Aclawskills~1999azzar-security-guardian/file -o 1999azzar-security-guardian.md

# Security Guardian

System for automated security auditing and credential protection.

## Core Workflows

### 1. Secret Scanning
Scan specific project directories for hardcoded credentials.
- **Tool**: `scripts/scan_secrets.py`
- **Usage**: `python3 $WORKSPACE/skills/security-guardian/scripts/scan_secrets.py <path_to_project>`
- **Workflow**:
1. Execute scan on a specific project or directory.
2. If findings are reported (exit code 1):
- Review the file and line number.
- **Transition**: Move the secret to a secure vault (e.g., using the `mema-vault` skill).
- **Redact**: Replace the plaintext secret in the source code with an environment variable or a vault lookup call.

### 2. Container Vulnerability Scan
Analyze Docker images for vulnerabilities prior to deployment.
- **Tool**: `scripts/scan_container.sh`
- **Usage**: `bash $WORKSPACE/skills/security-guardian/scripts/scan_container.sh <image_name>`
- **Logic**: Identify `HIGH` and `CRITICAL` severities. Recommend base image updates or security patches.

## Security Guardrails
- **Scope Limitation**: Avoid scanning system-level directories. Focus only on relevant project workspaces.
- **Credential Isolation**: Hardcoded secrets are considered a high-severity finding.
- **Dependencies**: Container scanning requires `trivy` to be installed on the host system.

## Integration
- **Vaulting**: This skill identifies leaks. Remediation should be performed using a dedicated credential manager like `mema-vault`.