Agent skill
tinman
Security auditing and hardening for OpenClaw and system infrastructure.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/tinman
Metadata
Additional technical details for this skill
- openclaw
-
{ "emoji": "\ud83d\udee1\ufe0f", "category": "security" }
SKILL.md
Tinman
Security auditing and hardening for OpenClaw and system infrastructure.
Security Levels
| Level | Description | Response |
|---|---|---|
| S0 | Info | Log only |
| S1 | Low | Notify user |
| S2 | Medium | Alert + recommend fix |
| S3 | High | Immediate action required |
| S4 | Critical | Stop + notify immediately |
Checks
OpenClaw Security
| Check | Risk | Action |
|---|---|---|
| Credentials in git | S3 | Add to .gitignore, rotate |
| Token expiration | S2 | Refresh tokens |
| Exposed secrets | S4 | Rotate immediately |
| Uncommitted changes | S1 | Review + commit |
System Security
| Check | Risk | Action |
|---|---|---|
| SSH password auth | S2 | Disable, use keys only |
| Open ports | S1 | Review with ss -tlnp |
| Unattended upgrades | S2 | Enable automatic updates |
| Firewall status | S2 | Verify ufw/iptables |
Workflow
1. Security Scan
# Check for credentials in git
git log --all --full-history -- .credentials/
# Check file permissions
ls -la ~/.credentials/
# Check SSH config
cat /etc/ssh/sshd_config | grep -E "PasswordAuthentication|PermitRootLogin"
2. Report Generation
## Security Audit Report
**Date:** 2026-02-20
**Scope:** OpenClaw + System
### Findings
| Level | Issue | Recommendation |
|-------|-------|----------------|
| S2 | Token expires in 3 days | Refresh Google OAuth |
### Actions Taken
- [x] Verified .credentials/ permissions (600)
- [ ] Refresh expiring tokens
3. Automated Monitoring
{
"name": "daily-security-check",
"schedule": {"kind": "cron", "expr": "0 6 * * *"},
"payload": {
"kind": "agentTurn",
"message": "Run tinman security scan. Check: credential perms, token expiration, git secrets. Report S2+ issues."
},
"sessionTarget": "isolated",
"notify": true
}
Best Practices
- Credential hygiene — 600 permissions, never in git
- Token rotation — Before expiration
- Regular audits — Weekly automated scans
- Principle of least privilege — Minimal permissions
- Audit logging — Track all changes
Emergency Response
If S4 (Critical) detected:
- Stop — Halt related operations
- Assess — Scope of exposure
- Rotate — Change all affected credentials
- Review — How did it happen
- Prevent — Update processes
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?