Security Hardener

One-command security audit + auto-fix for OpenClaw. Generates a score, finds vulnerabilities, fixes what it can.

Quick Start

# Full audit — scan everything, show score + findings
python3 scripts/security-hardener.py audit

# Auto-fix all fixable issues (creates backup first)
python3 scripts/security-hardener.py fix

# Scan for exposed API keys only
python3 scripts/security-hardener.py keys

# Check auth configuration
python3 scripts/security-hardener.py auth

# Generate markdown report
python3 scripts/security-hardener.py report

Commands

`audit` — Full Security Audit

Runs all checks, produces a 0-100 security score:

• Auth check — Is authentication enabled? What type?
• Transport check — HTTPS/TLS configured? Certificates valid?
• Key exposure scan — API keys/tokens in config, memory, git history
• Permission check — File permissions on sensitive files (config, memory, soul)
• Plugin audit — Untrusted plugins, unsigned skills, risky permissions
• Network check — Bound interfaces, exposed ports, firewall status
• CVE check — Known OpenClaw CVEs against installed version

Options: --json for machine-readable output, --verbose for detailed findings.

`fix` — Auto-Remediate

Creates a timestamped backup, then fixes:

• Sets restrictive file permissions (600 for config, 700 for workspace)
• Removes API keys from memory/SKILL.md files (moves to .env)
• Enables auth if disabled
• Restricts bind address from 0.0.0.0 to 127.0.0.1
• Disables unsigned plugins

Options: --dry-run to preview fixes without applying, --backup-dir .

`keys` — API Key Scanner

Searches config files, memory files, SKILL.md files, .env files, shell history, and git history for exposed secrets. Pattern library covers 40+ key formats (AWS, OpenAI, Anthropic, Stripe, etc.).

`auth` — Auth Configuration Check

Verifies authentication is properly configured:

• Gateway auth enabled and strong
• Session tokens rotated
• CORS policy appropriate
• Rate limiting configured

`report` — Markdown Report

Generates a security posture report suitable for compliance or auditing. Includes score, all findings, recommendations, and fix commands.

Scoring

| Range | Rating | Meaning |

|-------|--------|---------|

| 90-100 | 🟢 Excellent | Production-ready |

| 70-89 | 🟡 Good | Minor issues, fix recommended |

| 50-69 | 🟠 Fair | Significant gaps, fix required |

| 0-49 | 🔴 Critical | Unsafe for any exposure |

Each finding has a severity (critical/high/medium/low) and a weight that affects the score.

CVE Coverage

Checks against known OpenClaw CVEs including:

• CVE-2026-33579 — Unauthenticated remote access (63% of instances affected)
• Transport layer vulnerabilities
• Plugin sandbox escapes

See references/cve-database.md for full list and mitigation details.