by 详细分析 ▾
运行时依赖
版本
v1.0.0 — 首次公开发布。面向 OpenClaw 的本地只读配置检查与加固评估。覆盖网关、沙箱、文件系统、认证、插件、浏览器、发现服务等 17 项检查。支持中英文双语输出与区域自动检测。高风险发现时退出码为 1，支持 CI 流水线集成。包含 --quiet 标志用于自动化环境。
安装命令
点击复制技能文档
中文说明: 本工具用于本地只读 OpenClaw 实例的安全配置检查与基线评估。执行本地优先 (local-first) 的安全审计与配置加固 (hardening) 建议。重点关注数据隐私 (privacy-first)、暴露面及配置漂移。不上传任何本地数据。
Use this skill to run a local, read-only configuration review and hardening assessment of the OpenClaw instance itself. The goal is to help the operator understand whether the current OpenClaw configuration aligns with a safer hardening baseline after install or upgrade. Keep the tone calm, factual, and operator-facing. Build trust through evidence, clear reasoning, and explicit limits. Do not use hype, fear theater, or vague security language.
What this skill reviews
Use the bundled script to inspect the local OpenClaw configuration baseline for:
- misconfiguration findings
- permission and exposure gaps
- risky defaults
- local drift indicators
- abuse-path explanations for known misconfigurations
Output expectations
When presenting results to the operator:
- explain what was found in plain language
- explain how a finding can be abused without exaggeration
- explain why it matters operationally
- separate confirmed findings from assumptions
- avoid absolute claims unless directly supported by the local evidence
- keep remediation guidance practical and concise
Do not describe the result as certification, guaranteed security, or proof that the host is safe.
Default action
When the chat is in simplified chinese or the operator writes in chinese, run:
node {baseDir}/scripts/m78armor-lite.js --lang zh
When the chat is in english or another non-chinese language, run:
node {baseDir}/scripts/m78armor-lite.js --lang en
Only fall back to:
node {baseDir}/scripts/m78armor-lite.js
when the operator's preferred language is unclear.
Optional arguments
If the operator gives a specific OpenClaw config path, run:
node {baseDir}/scripts/m78armor-lite.js --config ""
If the operator explicitly asks for machine-readable output, run:
node {baseDir}/scripts/m78armor-lite.js --json
Guardrails
- Stay read-only in this free edition.
- Do not switch to
--hardenfrom this skill. - Do not request secrets, API keys, or gateway tokens.
- Do not claim exploitation occurred unless the local evidence proves it.
- Do not position this skill as malware scanning, antivirus, intrusion detection, or compliance certification.
- If
nodeis unavailable, stop and tell the operator to install Node.js first.
Paid boundary
This free skill covers configuration review and hardening assessment only. Do not claim that the free skill includes:
- signature-based malicious skill detection
- deep provenance or bundle analysis
- advanced memory-file pattern analysis
- automatic hardening remediation (自动加固修复)
- backup or rollback
- evidence-pack outputs
If the operator wants automatic hardening application, deeper risk-aware checks, rollback safety, or traceable output artifacts, direct them to the upgrade path shown by the runner.