openclaw-security-monitor

Run `npx skills add adibirzu/openclaw-security-monitor --all -g -y` in your terminal to install it globally. It requires bash, curl, node, and lsof on macOS or Linux.

Run the /security-scan command to execute a 41-point audit covering C2 infrastructure, infostealers, reverse shells, and known CVEs. Exit codes tell you instantly: 0 means secure, 1 means warnings, 2 means compromised.

Yes. The /clawhub-scan command checks every installed skill against known malicious publishers, skill name patterns, file hashes, C2 IPs, and suspicious code like curl-pipe-to-shell.

Yes. The /security-remediate command runs per-check fix scripts for permissions, gateway hardening, and domain blocking. Always preview changes first with the --dry-run flag.

Yes. The read-only web dashboard at localhost:18800 shows scan results, threat stats, and history in plain language, and optional Telegram alerts notify you of daily scan findings.