threat-surface-scanner

Scans your OpenClaw deployment for attack surface exposure without making any external calls. Checks open ports (especially gateway port 18789), dangerous exec and tool settings, channel security configurations, and plugin risks. Produces a prioritized risk report with exact fix commands. All local, nothing leaves your machine.