daily-security-check_skill

Overview

This skill performs a daily security inspection for an OpenClaw project and produces a concise, scored report. It runs a fixed checklist plus official tools (openclaw security audit and openclaw doctor), detects common misconfigurations, and writes a dated report file for retention and optional delivery to messaging endpoints. The output is a single structured report with a 0–10 security score and clear next actions.

How this skill works

On explicit trigger, the skill loads the checklist and inspects items such as gateway loopback, firewall reminders, API keys in .env, SOUL.md security rules, authentication anomalies, and access controls. It runs read-only commands: openclaw security audit and openclaw doctor, captures summaries and warnings, and aggregates findings. The skill generates a short report (300–600 words), assigns a 0–10 score, lists issues and TODOs, and saves the file to workspace/docs/security-audit/security-report-YYYY-MM-DD.md.

When to use it

• When a user requests “daily-security-check”, “security inspection”, or “execute daily security check”.
• As a cron-triggered job to perform unattended daily inspections and deliver results to Telegram or similar endpoints.
• Before releases or after configuration changes to validate security posture.
• When you need a compact, dated record of daily security status for audits or handover.

Best practices

• Only run on explicit user or scheduled trigger; do not auto-run during regular conversation.
• Run from the project root or set OPENCLAW_STATE_DIR before executing official tools.
• Keep report delivery endpoints (Telegram, Feishu) configured separately; the skill only produces the report.
• Do not embed secrets in the report; reference paths or field names instead of revealing values.
• Treat the report as read-only findings; apply fixes manually or via documented remediation steps.

Example use cases

• Nightly cron job triggers the skill, generates the dated report, and posts it to a project Telegram channel for on-call review.
• Developer requests “execute daily security check” before merging a large feature to validate no API keys leaked into .env.
• Security lead runs the skill after receiving an alert to get a quick snapshot and prioritized TODOs.
• Use the report files as part of compliance logs or incident postmortems.