security-audit: How We Used It to Find Vulnerabilities We Didn't Know We Had

At SFD Lab, we run about a dozen AI Agents across various projects. Most of the time they work fine, but occasionally something chilling shows up — like the day we discovered an Agent was passing user input directly to an external API with zero filtering. The kind of problem that would only surface if you looked for it. That's what got us serious about the security-audit skill.

What Is security-audit?

security-audit is a dedicated security auditing skill in the OpenClaw/ClawHub ecosystem. It systematically scans the deployment environment of AI Agents looking for exposure risks, weak configurations, and potential attack surfaces.

It's not a fully featured penetration testing tool, but it's good at the practical stuff: check exposed ports, review SSH configuration, scan for hardcoded credentials, check system update status, evaluate overall risk exposure. In other words: all the "I know I should do this but never have time" security checks.

Running a Full Audit From Scratch

Trigger the audit:

Run a security audit on the current OpenClaw deployment, focusing on:
1. Exposed ports and services
2. SSH configuration security
3. Hardcoded credential leak risks
4. System patch status
Output risk levels and specific recommendations

The skill runs a systematic series of checks — roughly 2-5 minutes depending on system complexity.

Our first run turned up three things we hadn't noticed:

Issue 1: Debug port left open from development

A service's debug mode port (:9229) had been forgotten — bound to 127.0.0.1 so not directly internet-exposed, but reachable within the container network. Easy to miss in manual auditing.

Issue 2: SSH allows password authentication

In theory we use keys only, but PasswordAuthentication in the config was still yes — meaning brute-force of the username/password was theoretically possible. This was never changed from the initial server setup.

Issue 3: .env file permissions too open

One project's .env file had 644 permissions — world-readable. No other users on our server, but still a bad habit and a real risk in certain scenarios.

Fix Flow: From Discovery to Closure

security-audit doesn't just give you a "what we found" list — it provides specific fix recommendations with priority ordering.

# 1. Disable debug port (modify startup config — remove --inspect flag)
2. Disable SSH password auth
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd
3. Fix .env file permissions
chmod 600 /path/to/project/.env

Three operations, five minutes. But without the audit, these three issues might have sat there indefinitely.

auto-fix Mode: Use It or Not?

security-audit has an auto-fix mode. We've used it, but cautiously. For clearly safe operations (file permissions), auto-fix is convenient. For system configuration changes (SSH config), we prefer to receive the commands and execute them ourselves. An SSH config mistake could lock you out of production — that's a serious incident.

Recommendation: use review mode in production and execute manually; auto-fix is fine in development or test environments.

Integrating Into Regular Operations

We now run a weekly automated security audit via OpenClaw's cron:

schedule: { kind: "cron", expr: "0 10 * * 1", tz: "Asia/Singapore" }
payload: { kind: "agentTurn", message: "Run security-audit on all production servers, compile risk report and send to Telegram" }

Auto-runs every Monday at 10am. Issues get notified, no issues get HEARTBEAT_OK. Security checks become an automated background task.

Its Relationship With Other Security Tools

security-audit doesn't replace professional penetration testing or application-layer code review. Its value is automating the baseline security checks that are known but commonly forgotten.

For most small-to-medium-scale AI Agent deployments, security-audit covers the vast majority of common risks. At SFD Lab, running these checks regularly has significantly reduced the anxiety of "not knowing what vulnerabilities I don't know about."

Getting Started

1. Install security-audit skill from ClawHub (if not already installed)
2. Trigger a full audit scan
3. Work through findings by risk priority, highest first
4. Set up a recurring cron task for automated checks

Finding issues on the first run is normal — that's the point. Problems sleeping in your config are better known early than late.