security-guide — Claude Code skill: what it does, how to install
This skill audits an OpenClaw installation across network, container, credential, plugin, and patch controls. Use it for a first security review.
npx skills add jnMetaCode/shellward --skill security-guide -a claude-codeWhat security-guide does
security-guide checks an OpenClaw setup for exposed gateway ports 19000/19001, container isolation, plaintext credentials in .env, .bashrc, and environment variables, sensitive-file permissions, and the audit log at ~/.openclaw/shellward/audit.jsonl. It also reviews installed plugins, the OpenClaw release, and the Node.js version, then orders findings by severity.
Its recommendations cover binding the gateway to 127.0.0.1, adding ufw rules, restricting Docker capabilities, rotating and backing up logs, disabling plugin auto-updates, and scanning plugin code for suspicious patterns. The skill exposes /security, /audit [count] [filter], /harden, /harden fix, /scan-plugins, and /check-updates. Node.js must be version 22.12 or newer for the stated version check to meet the guide’s requirement, and destructive fixes require confirmation first.
What it helps with
- check whether OpenClaw gateway ports are publicly exposed
- find plaintext credentials in environment files and variables
- tighten OpenClaw’s Docker isolation
- review audit events and log handling
- scan plugins and runtime versions for security risks
Example prompts for the agent
- Audit this OpenClaw installation and rank the critical security findings first.
- Run
/security, then show recent events with/audit 20. - Use
/scan-pluginsto inspect installed plugins and suggest fixes without applying destructive changes.
How to install security-guide
1Skills CLI (Vercel)
npx skills add jnMetaCode/shellward --skill security-guide -a claude-code2Manually: put the files in place
~/.claude/skills/security-guide/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-guide/
1Skills CLI (Vercel)
npx skills add jnMetaCode/shellward --skill security-guide -a codex2Manually: put the files in place
.agents/skills/security-guide/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add jnMetaCode/shellward --skill security-guide -a cursor2Manually: put the files in place
.cursor/skills/security-guide/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install jnMetaCode/shellward security-guide2Manually: put the files in place
.github/skills/security-guide/SKILL.md1Skills CLI (Vercel)
npx skills add jnMetaCode/shellward --skill security-guide -a gemini-cli2Platform CLI
gemini skills install https://github.com/jnMetaCode/shellward --path skills/security-guideManually: put the files in place
.devin/skills/security-guide/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add jnMetaCode/shellward --skill security-guide -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about security-guide
How do I install security-guide in Claude Code?
Run npx skills add jnMetaCode/shellward --skill security-guide -a claude-code, then check ~/.claude/skills/security-guide/SKILL.md.
What does security-guide do?
It reviews OpenClaw network exposure, Docker isolation, credentials, file permissions, audit logs, plugins, and software versions. For each finding, it gives a concrete command or action to address it.
Which Node.js version does the OpenClaw check require?
The guide requires Node.js 22.12 or newer. It also checks the current OpenClaw version and reports related vulnerabilities.
Source text
SKILL.md · Apache-2.0
---
name: security-guide
description: OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation
user-invocable: true
disable-model-invocation: false
---
# ShellWard Security Deployment Guide / 安全部署指南
When the user invokes this skill, provide a complete security deployment checklist based on the following best practices. Check the current system state using available tools and give actionable recommendations.
## Security Checklist
### 1. Network Control / 网络控制
- Check if OpenClaw gateway port (19000/19001) is exposed to public network
- Recommend binding to 127.0.0.1 or using a reverse proxy with authentication
- Suggest firewall rules: `ufw allow from 127.0.0.1 to any port 19000`
- For cloud servers: check security group rules
### 2. Container Isolation / 容器隔离
- Recommend running OpenClaw in Docker with restricted capabilities:
```
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE \
--read-only --tmpfs /tmp \
-u 1000:1000 \
openclaw
```
- Suggest resource limits: `--memory=2g --cpus=1`
- Mount only necessary directories
### 3. Credential Management / 凭证管理
- Scan for plaintext secrets in .env, .bashrc, environment variables
- Recommend using a secret manager (Vault, doppler, etc.)
- Check file permissions on sensitive files (should be 0600)
- Suggest `chmod 600 ~/.env ~/.ssh/* ~/.aws/credentials`
### 4. Audit Logging / 审计日志
- Verify ShellWard audit log is active at ~/.openclaw/shellward/audit.jsonl
- Show recent security events
- Recommend log rotation and backup strategy
- Suggest sending critical events to external SIEM
### 5. Plugin Security / 插件安全
- List all installed plugins and check for known risks
- Disable auto-update for plugins
- Only install from trusted sources
- Scan plugin code for suspicious patterns
### 6. Patch Management / 补丁管理
- Check current OpenClaw version
- Report known vulnerabilities for current version
- Recommend upgrade path
- Check Node.js version (must be >= 22.12)
## Available Commands
Remind the user about ShellWard's quick commands:
- `/security` — Full security status overview
- `/audit [count] [filter]` — View audit log
- `/harden` — Scan for issues, `/harden fix` to auto-fix
- `/scan-plugins` — Scan plugins for security risks
- `/check-updates` — Check versions and vulnerabilities
## Response Style
- Be concise and actionable
- Use the user's language (detect from their message)
- Prioritize critical issues first
- For each issue, provide the exact command to fix it
- Ask for confirmation before executing destructive operations
© jnMetaCode · Apache-2.0 · jnMetaCode/shellward
