openclaw-security

# OpenClaw Security Suite

One skill to install, configure, and orchestrate the entire OpenClaw security stack.

## Install All Security Tools

```bash
python3 {baseDir}/scripts/security.py install --workspace /path/to/workspace
```

Installs all 11 free security skills from ClawHub.

## Unified Dashboard

```bash
python3 {baseDir}/scripts/security.py status --workspace /path/to/workspace
```

Aggregated health check across all installed security tools.

## Full Security Scan

```bash
python3 {baseDir}/scripts/security.py scan --workspace /path/to/workspace
```

Runs every scanner: integrity verification, secret detection, permission audit, network DLP, supply chain analysis, injection scanning, credential exposure, and compliance audit.

## First-Time Setup

```bash
python3 {baseDir}/scripts/security.py setup --workspace /path/to/workspace
```

Initializes all tools that need it: integrity baseline, skill signing, audit ledger, compliance policy.

## Update All Tools

```bash
python3 {baseDir}/scripts/security.py update --workspace /path/to/workspace
```

Updates all installed security skills to latest versions via ClawHub.

## List Installed Tools

```bash
python3 {baseDir}/scripts/security.py list --workspace /path/to/workspace
```

Shows which security tools are installed and their versions.

## Pro Protection Sweep

```bash
python3 {baseDir}/scripts/security.py protect --workspace /path/to/workspace
```

Runs automated countermeasures across all installed Pro tools. Requires Pro versions.

## What Gets Orchestrated

| Tool | Domain | Free | Pro |
|------|--------|------|-----|
| **warden** | Workspace integrity, injection detection | Detect | Restore, rollback, quarantine |
| **sentry** | Secret/credential scanning | Detect | Redact, quarantine |
| **arbiter** | Permission auditing | Detect | Revoke, enforce |
| **egress** | Network DLP, exfiltration detection | Detect | Block, allowlist |
| **ledger** | Hash-chained audit trail | Record | Freeze, forensics |
|...

# OpenClaw Security Suite

One skill to rule them all. Installs, configures, and orchestrates the complete OpenClaw security stack for [OpenClaw](https://github.com/openclaw/openclaw), [Claude Code](https://docs.anthropic.com/en/docs/claude-code), and any Agent Skills-compatible tool.

**11 security tools. 1 command.**

## The Problem

Agent workspace security requires multiple layers: integrity monitoring, secret scanning, permission auditing, network DLP, supply chain analysis, credential protection, injection defense, compliance enforcement, audit trails, skill verification, and incident response.

Setting up and running 11 separate tools is tedious. This skill installs them all, initializes them, and provides a unified dashboard and scan pipeline.

## Install

```bash
# Install the orchestrator
git clone https://github.com/AtlasPA/openclaw-security.git
cp -r openclaw-security ~/.openclaw/workspace/skills/

# Install all 11 security tools
python3 scripts/security.py install

# Initialize everything
python3 scripts/security.py setup

# Check workspace health
python3 scripts/security.py status
```

## Commands

| Command | What it does |
|---------|-------------|
| `install` | Install all 11 free security skills from ClawHub |
| `setup` | Initialize tools that need it (baseline, signing, ledger, policy) |
| `status` | Unified dashboard — health check across all tools |
| `scan` | Full security scan — runs every scanner in logical order |
| `list` | Show which tools are installed (free/pro) |
| `update` | Update all installed skills to latest versions |
| `protect` | Run Pro countermeasures across all tools (requires Pro) |

All commands accept `--workspace /path` or `-w /path`. Auto-detects from `$OPENCLAW_WORKSPACE` or `~/.openclaw/workspace`.

## Scan Pipeline Order

The `scan` command runs tools in a logical security sequence:

1. **Sentinel** — Are installed skills safe? (supply chain)
2. **Signet** — Have skills been tampered? (signing verification)
3. **Warde...