---
name: openclaw-setup-audit
description: OpenClaw skill for governed agent workflows.
---
openclaw-setup-audit
Description
Audit an explicitly approved OpenClaw workspace for marketplace-safe setup blockers. The default path is intentionally narrow: it checks only workspace directory structure, skill count, and writability. It does not inspect workspace guidance and config files, parent config files, or provider environment variables unless the operator supplies explicit opt-in flags.
Usage
```bash
python3 scripts/openclaw_setup_audit.py --workspace /path/to/workspace
python3 scripts/openclaw_setup_audit.py --workspace /path/to/workspace --json --fail-on-errors
python3 scripts/openclaw_setup_audit.py --workspace /path/to/workspace --include-guidance-files --include-workspace-config
```
Parameters
→ `--workspace`: Approved OpenClaw workspace path to inspect.
→ `--json`: Emit structured JSON output.
→ `--fail-on-errors`: Exit with status `2` when ERROR findings exist.
→ `--min-skills`: Minimum installed skill directory count expected in `skills/`.
→ `--include-guidance-files`: Opt in to checking the presence of core continuity files, guidance files, and dated memory files.
→ `--expect-memory`: With `--include-guidance-files`, treat missing core continuity files as ERROR instead of WARN.
→ `--include-workspace-config`: Opt in to reading the workspace config file for setup diagnostics.
→ `--expect-config`: With `--include-workspace-config`, treat missing workspace config as ERROR instead of WARN.
→ `--allow-parent-config`: DANGEROUS opt-in. With `--include-workspace-config`, explicitly permits reading a parent config file if the workspace config is absent. Do not use in marketplace release checks.
→ `--check-provider-env`: DANGEROUS opt-in. Checks only provider environment variable presence and never prints values. Do not use in marketplace release checks.
Security and scope boundaries
→ Default filesystem scope is limited to the supplied workspace directories `memory/` and `skills/`; default execution does not read guidance markdown, config JSON, parent files, or environment variables.
→ Parent config inspection and provider environment checks are excluded from the release-safe path and require explicit dangerous opt-in flags.
→ The script performs no network calls, shell execution, or writes.
Output
Returns a readiness summary, per-check evidence, and recommended actions ordered by severity.
Release evidence
Reviewed in the 2026-06-15 GetAgentIQ warehouse propagation cycle.