Security Audit
Run scripts/audit.py before every commit, push, or skill publish. No exceptions.
When to run
| Trigger | Command |
|---|---|
Before git commit | python3 {skill_dir}/scripts/audit.py --staged |
Before git push | python3 {skill_dir}/scripts/audit.py --last-commit |
Before clawhub publish <path> | python3 {skill_dir}/scripts/audit.py <skill_path> |
| Ad-hoc scan any path | python3 {skill_dir}/scripts/audit.py <path> |
{skill_dir} = /home/aladdin/.openclaw/workspace/skills/skill-security-audit
Exit codes
0= clean1= HIGH or MEDIUM findings (block publish/push)2= usage error
What it detects
| Severity | Pattern |
|---|---|
| 🔴 HIGH | API keys, secrets, passwords, JWT tokens, WooCommerce keys, AWS keys, private key blocks, bearer tokens, .env files |
| 🟡 MEDIUM | Absolute /home/<user>/ paths, /root/ paths, refresh tokens, node_modules/ committed |
| 🔵 LOW | Hardcoded IPs, long base64 strings |
Rules
- HIGH findings = hard block. Never commit or publish with HIGH findings. Rotate any exposed secret immediately.
- MEDIUM findings = fix before publish. Replace absolute paths with relative or env-var defaults. Remove
node_modules/. - LOW findings = review. Not blocking but investigate.
- False positives: If a match is a variable name or safe placeholder (not an actual value), document why it's safe in a comment and re-run.
After finding a real secret
- Do NOT push the commit. If already pushed: rotate the secret immediately, then rewrite history or delete the file from git.
- Rotate in the provider portal (TikTok Dev, AWS IAM, WooCommerce, etc.)
- Move to env var:
process.env.SECRET_NAMEor read from a local config file outside the repo. - Add the config file path to
.gitignore. - Report to Aladdin immediately with severity and what was exposed.
Skill publish checklist
Before clawhub publish:
-
audit.py <skill_path>returns 0 (clean) -
node_modules/not present in skill folder - No absolute paths to user home directories
- No hardcoded business-specific IDs or credentials
-
package.jsonname matches skill folder name - SKILL.md description updated if renamed