Agent Security Hardening Kit

The #1 most downloaded skill on ClawHub was malware. It instructed your agent to send your API keys, credentials, and private data to an external server. Cisco published a report calling OpenClaw agents 'a security nightmare.' ClawSecure audited 2,890 skills and found 41% contain vulnerabilities — 30.6% rated HIGH or CRITICAL. Your agent has full filesystem access, can run shell commands, and can read your .env with every secret you own. If you haven't audited your workspace, you're running blind.

Agent Security Hardening Kit teaches your agent to audit its own workspace for the vulnerabilities that actually get people burned. It scans file permissions, checks bootstrap files for accidentally exposed credentials, verifies skill sources against known-safe registries, audits your prompt injection attack surface, checks network exposure, and generates a full security report with risk levels and specific remediation steps. Install once, run periodically, sleep better.

What's Included

• Complete SKILL.md with audit workflow, severity logic, and report format
• Workspace permission audit for .env, scripts, and SSH keys
• Bootstrap file secret scan across all 7 cognitive bootstrap files
• Skill source verification rules that flag ClawHub installs as HIGH RISK until verified
• Prompt injection surface audit for email, browser, and tool-result workflows
• Network exposure review for ports, firewall posture, and non-Tailscale SSH access
• Credential rotation reminders and stale-secret hygiene checks
• 20-point Security Hardening Checklist for manual operator verification

Why This is Better

• Self-contained — runs inside your agent, no external SaaS or account needed
• Covers the full attack surface: filesystem, skills, network, credentials, and prompt injection
• Built from operating a production agent with a 10-layer security model, not generic security theory
• Outputs a concrete SECURITY-AUDIT.md with remediation steps, not just a score
• Stays at the sharp $9 painkiller tier instead of forcing buyers into a bigger persona purchase
• Includes a manual checklist so operators can verify the audit themselves instead of blindly trusting automation