openclaw-audit-watchdog by prompt-security/clawsec
npx skills add https://github.com/prompt-security/clawsec --skill openclaw-audit-watchdog您可以通过两种方式获取 openclaw-audit-watchdog:
如果您已经安装了 clawsec-suite,您可能已经拥有此工具!
openclaw-audit-watchdog 与 ClawSec Suite 捆绑在一起,以提供关键的自动化安全审计能力。当您安装该套件时,如果您尚未安装审计看门狗,它将从捆绑副本中部署。
优点:
~/.openclaw/skills/openclaw-audit-watchdog/独立安装 openclaw-audit-watchdog,无需完整套件。
何时使用独立安装:
优点:
请继续阅读以下独立安装说明。
创建(或更新)一个每日 cron 任务,该任务:
openclaw security audit --json广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
openclaw security audit --deep --json汇总发现的问题(严重/警告/信息 + 主要发现)
将报告发送到:
默认计划:在所选时区每日 23:00(晚上11点)。
交付方式:
对于自动化/MDM 部署,请在调用前设置环境变量:
export PROMPTSEC_DM_CHANNEL="telegram"
export PROMPTSEC_DM_TO="@yourhandle"
export PROMPTSEC_TZ="America/New_York"
export PROMPTSEC_HOST_LABEL="prod-server-01"
# 然后调用该技能
/openclaw-audit-watchdog
该技能将自动配置并创建 cron 任务,无需提示。
如果未设置环境变量,该技能将进行最简化的提示:
User: /openclaw-audit-watchdog
Agent: 正在设置每日安全审计看门狗...
我应该使用哪个频道进行交付?(例如,telegram, slack)
User: telegram
Agent: 收件人 ID 或句柄是什么?
User: @myhandle
Agent: 每日 23:00 运行使用哪个时区?(默认:UTC)
User: America/Los_Angeles
Agent: ✓ 已创建 cron 任务 "Daily security audit (Prompt Security)"
计划:每日 23:00 America/Los_Angeles
交付:telegram → @myhandle
如果任务已存在,该技能将更新它而不是创建重复项:
User: /openclaw-audit-watchdog
Agent: 发现现有的 "Daily security audit (Prompt Security)" 任务。
当前:每日 23:00 UTC → telegram:@oldhandle
更新交付目标?(当前:telegram:@oldhandle)
User: slack:#security-alerts
Agent: ✓ 已更新 cron 任务
计划:每日 23:00 UTC
交付:slack:#security-alerts
每天在预定时间,您将收到类似以下的报告:
🔭 每日安全审计报告
Host: prod-server-01
Time: 2026-02-16 23:00:00 America/New_York
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
摘要
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✓ 标准审计:12 项检查通过,2 项警告
✓ 深度审计:8 项探测通过,1 项严重问题
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
严重发现
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[CRIT-001] 检测到未加密的 API 密钥
→ 修复建议:将凭据移至加密保险库或使用环境变量
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
警告
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[WARN-003] 发现过时的依赖项
→ 修复建议:运行 `openclaw security audit --fix` 进行更新
[WARN-007] 配置文件权限过弱
→ 修复建议:chmod 600 ~/.openclaw/config.json
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
运行 `openclaw security audit --deep` 获取完整详情。
想要不同的计划?请在调用前设置:
# 每 6 小时运行一次,而不是每日
export PROMPTSEC_SCHEDULE="0 */6 * * *"
/openclaw-audit-watchdog
要管理多个服务器,请使用不同的主机标签:
# 在开发服务器上
export PROMPTSEC_HOST_LABEL="dev-01"
export PROMPTSEC_DM_TO="@dev-team"
/openclaw-audit-watchdog
# 在生产服务器上
export PROMPTSEC_HOST_LABEL="prod-01"
export PROMPTSEC_DM_TO="@oncall"
/openclaw-audit-watchdog
每个报告都会附带清晰的主机标识。
要抑制已审查并接受的审计发现,请传递 --enable-suppressions 标志,并确保配置文件包含 "enabledFor": ["audit"] 标记:
# 创建或编辑抑制配置
cat > ~/.openclaw/security-audit.json <<'JSON'
{
"enabledFor": ["audit"],
"suppressions": [
{
"checkId": "skills.code_safety",
"skill": "clawsec-suite",
"reason": "第一方安全工具 — 已由安全团队审查",
"suppressedAt": "2026-02-15"
}
]
}
JSON
# 启用抑制功能运行
/openclaw-audit-watchdog --enable-suppressions
被抑制的发现仍会出现在报告的信息部分,但不计入严重/警告总数。
审计管道支持一种用于管理已审查发现的选通抑制机制。抑制采用纵深防御激活方式:必须同时满足两个独立的门控条件。
--enable-suppressions 标志。"enabledFor" 且数组中包含 "audit"。如果任一条件不满足,所有发现都将正常报告,并且忽略抑制列表。
--config <路径> 参数OPENCLAW_AUDIT_CONFIG 环境变量~/.openclaw/security-audit.json.clawsec/allowlist.json{
"enabledFor": ["audit"],
"suppressions": [
{
"checkId": "skills.code_safety",
"skill": "clawsec-suite",
"reason": "第一方安全工具 — 已由安全团队审查",
"suppressedAt": "2026-02-15"
}
]
}
"enabledFor": ["audit"] -- 审计抑制激活(也需要 --enable-suppressions 标志)"enabledFor": ["advisory"] -- 仅咨询管道抑制(对审计无影响)"enabledFor": ["audit", "advisory"] -- 两个管道都遵守抑制规则enabledFor -- 无抑制激活(安全默认值)skills.code_safety)配置(MDM 友好):首选环境变量(无提示)。
必需的环境变量:
PROMPTSEC_DM_CHANNEL(例如 telegram)PROMPTSEC_DM_TO(收件人 ID)可选的环境变量:
PROMPTSEC_TZ(IANA 时区;默认 UTC)PROMPTSEC_HOST_LABEL(报告中包含的标签;默认使用 hostname)PROMPTSEC_INSTALL_DIR(cron 负载在运行运行器之前用于 cd 的稳定路径;默认:~/.config/security-checkup)PROMPTSEC_GIT_PULL=1(如果从 git 安装,运行器将执行 git pull --ff-only)路径扩展规则(重要):
bash/zsh 中,使用 PROMPTSEC_INSTALL_DIR="$HOME/.config/security-checkup"(或绝对路径)。'$HOME/.config/security-checkup'。$env:PROMPTSEC_INSTALL_DIR = Join-Path $HOME ".config/security-checkup"。$HOME 目录段。如果未设置环境变量或默认值,交互式安装是最后的手段。
即使在这种情况下,也保持提示最简化,看门狗工具开箱即用,配置相当直接。
使用 cron 工具创建一个任务,包含:
schedule.kind="cron"schedule.expr="0 23 * * *"schedule.tz=<installer tz>sessionTarget="isolated"wakeMode="now"payload.kind="agentTurn"payload.deliver=true创建一个任务,其负载消息指示隔离运行执行以下操作:
openclaw security audit --jsonopenclaw security audit --deep --json包含:
checkId + title + 1 行修复建议message 工具通过 DM 发送到选定的用户目标按此优先级顺序尝试电子邮件交付:
A) 如果此部署中存在电子邮件频道插件,则使用:
message(action="send", channel="email", target="target@example.com", message=<report>)B) 否则,如果本地 sendmail 可用,则回退到它:
exec 执行:printf "%s" "$REPORT" | /usr/sbin/sendmail -t(构造 To/Subject 标头)如果两种方式都不可行,仍然通过 DM 通知用户并包含一行:
"注意:无法交付到 target@example.com(电子邮件频道未配置)"在添加新任务之前:
cron.list(includeDisabled=true)"Daily security audit" 的任务,则更新它而不是添加重复项:
"Daily security audit (Prompt Security)"cron 的报告应该建议修复措施,但绝不能应用它们。
除非明确要求,否则不要运行 openclaw security audit --fix。
每周安装次数
385
代码仓库
GitHub Stars
830
首次出现
2026年2月10日
安全审计
安装于
opencode371
gemini-cli369
openclaw367
kimi-cli367
codex367
github-copilot367
You can get openclaw-audit-watchdog in two ways:
If you've installed clawsec-suite, you may already have this!
Openclaw-audit-watchdog is bundled alongside ClawSec Suite to provide crucial automated security audit capabilities. When you install the suite, if you don't already have the audit watchdog installed, it will be deployed from the bundled copy.
Advantages:
~/.openclaw/skills/openclaw-audit-watchdog/Install openclaw-audit-watchdog independently without the full suite.
When to use standalone:
Advantages:
Continue below for standalone installation instructions.
Create (or update) a daily cron job that:
openclaw security audit --jsonopenclaw security audit --deep --jsonSummarizes findings (critical/warn/info + top findings)
Sends the report to:
Default schedule: daily at 23:00 (11pm) in the chosen timezone.
Delivery:
For automated/MDM deployments, set environment variables before invoking:
export PROMPTSEC_DM_CHANNEL="telegram"
export PROMPTSEC_DM_TO="@yourhandle"
export PROMPTSEC_TZ="America/New_York"
export PROMPTSEC_HOST_LABEL="prod-server-01"
# Then invoke the skill
/openclaw-audit-watchdog
The skill will automatically configure and create the cron job without prompts.
If environment variables aren't set, the skill will prompt minimally:
User: /openclaw-audit-watchdog
Agent: Setting up daily security audit watchdog...
What channel should I use for delivery? (e.g., telegram, slack)
User: telegram
Agent: What's the recipient ID or handle?
User: @myhandle
Agent: Which timezone for the 23:00 daily run? (default: UTC)
User: America/Los_Angeles
Agent: ✓ Created cron job "Daily security audit (Prompt Security)"
Schedule: Daily at 23:00 America/Los_Angeles
Delivery: telegram → @myhandle
If a job already exists, the skill updates it instead of creating duplicates:
User: /openclaw-audit-watchdog
Agent: Found existing "Daily security audit (Prompt Security)" job.
Current: Daily at 23:00 UTC → telegram:@oldhandle
Update delivery target? (current: telegram:@oldhandle)
User: slack:#security-alerts
Agent: ✓ Updated cron job
Schedule: Daily at 23:00 UTC
Delivery: slack:#security-alerts
Each day at the scheduled time, you'll receive a report like:
🔭 Daily Security Audit Report
Host: prod-server-01
Time: 2026-02-16 23:00:00 America/New_York
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✓ Standard Audit: 12 checks passed, 2 warnings
✓ Deep Audit: 8 probes passed, 1 critical
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CRITICAL FINDINGS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[CRIT-001] Unencrypted API Keys Detected
→ Remediation: Move credentials to encrypted vault or use environment variables
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WARNINGS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[WARN-003] Outdated Dependencies Found
→ Remediation: Run `openclaw security audit --fix` to update
[WARN-007] Weak Permission on Config File
→ Remediation: chmod 600 ~/.openclaw/config.json
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Run `openclaw security audit --deep` for full details.
Want a different schedule? Set it before invoking:
# Run every 6 hours instead of daily
export PROMPTSEC_SCHEDULE="0 */6 * * *"
/openclaw-audit-watchdog
For managing multiple servers, use different host labels:
# On dev server
export PROMPTSEC_HOST_LABEL="dev-01"
export PROMPTSEC_DM_TO="@dev-team"
/openclaw-audit-watchdog
# On prod server
export PROMPTSEC_HOST_LABEL="prod-01"
export PROMPTSEC_DM_TO="@oncall"
/openclaw-audit-watchdog
Each will send reports with clear host identification.
To suppress audit findings that have been reviewed and accepted, pass the --enable-suppressions flag and ensure the config file includes the "enabledFor": ["audit"] sentinel:
# Create or edit the suppression config
cat > ~/.openclaw/security-audit.json <<'JSON'
{
"enabledFor": ["audit"],
"suppressions": [
{
"checkId": "skills.code_safety",
"skill": "clawsec-suite",
"reason": "First-party security tooling — reviewed by security team",
"suppressedAt": "2026-02-15"
}
]
}
JSON
# Run with suppressions enabled
/openclaw-audit-watchdog --enable-suppressions
Suppressed findings still appear in the report under an informational section but are excluded from critical/warning totals.
The audit pipeline supports an opt-in suppression mechanism for managing reviewed findings. Suppression uses defense-in-depth activation: two independent gates must both be satisfied.
--enable-suppressions flag must be passed at invocation."enabledFor" with "audit" in the array.If either gate is absent, all findings are reported normally and the suppression list is ignored.
--config <path> argumentOPENCLAW_AUDIT_CONFIG environment variable~/.openclaw/security-audit.json.clawsec/allowlist.json{
"enabledFor": ["audit"],
"suppressions": [
{
"checkId": "skills.code_safety",
"skill": "clawsec-suite",
"reason": "First-party security tooling — reviewed by security team",
"suppressedAt": "2026-02-15"
}
]
}
"enabledFor": ["audit"] -- audit suppression active (requires --enable-suppressions flag too)"enabledFor": ["advisory"] -- only advisory pipeline suppression (no effect on audit)"enabledFor": ["audit", "advisory"] -- both pipelines honor suppressionsenabledFor -- no suppression active (safe default)skills.code_safety)Provisioning (MDM-friendly): prefer environment variables (no prompts).
Required env:
PROMPTSEC_DM_CHANNEL (e.g. telegram)PROMPTSEC_DM_TO (recipient id)Optional env:
PROMPTSEC_TZ (IANA timezone; default UTC)PROMPTSEC_HOST_LABEL (label included in report; default uses hostname)PROMPTSEC_INSTALL_DIR (stable path used by cron payload to cd before running runner; default: ~/.config/security-checkup)PROMPTSEC_GIT_PULL=1 (runner will git pull --ff-only if installed from git)Path expansion rules (important):
bash/zsh, use PROMPTSEC_INSTALL_DIR="$HOME/.config/security-checkup" (or absolute path).'$HOME/.config/security-checkup'.$env:PROMPTSEC_INSTALL_DIR = Join-Path $HOME ".config/security-checkup".$HOME directory segment.Interactive install is last resort if env vars or defaults are not set.
even in that case keep prompts minimalistic the watchdog tool is pretty straight up configured out of the box.
Use the cron tool to create a job with:
schedule.kind="cron"schedule.expr="0 23 * * *"schedule.tz=<installer tz>sessionTarget="isolated"wakeMode="now"payload.kind="agentTurn"payload.deliver=trueCreate the job with a payload message that instructs the isolated run to:
openclaw security audit --jsonopenclaw security audit --deep --jsonInclude:
checkId + title + 1-line remediationmessage toolAttempt email delivery in this priority order:
A) If an email channel plugin exists in this deployment, use:
message(action="send", channel="email", target="target@example.com", message=<report>)B) Otherwise, fallback to local sendmail if available:
exec with: printf "%s" "$REPORT" | /usr/sbin/sendmail -t (construct To/Subject headers)If neither path is possible, still DM the user and include a line:
"NOTE: could not deliver to target@example.com (email channel not configured)"Before adding a new job:
cron.list(includeDisabled=true)"Daily security audit" exists, update it instead of adding a duplicate:
"Daily security audit (Prompt Security)"The cron’s report should suggest fixes but must not apply them.
Do not run openclaw security audit --fix unless explicitly asked.
Weekly Installs
385
Repository
GitHub Stars
830
First Seen
Feb 10, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
opencode371
gemini-cli369
openclaw367
kimi-cli367
codex367
github-copilot367
前端性能优化指南:识别瓶颈与优化策略,提升LCP、FID、CLS核心指标
32,400 周安装