tinman
Security auditing and hardening for OpenClaw and system infrastructure.
SKILL.md
Full skill instructions
Tinman
Security auditing and hardening for OpenClaw and system infrastructure.
Security Levels
| Level | Description | Response |
|---|---|---|
| S0 | Info | Log only |
| S1 | Low | Notify user |
| S2 | Medium | Alert + recommend fix |
| S3 | High | Immediate action required |
| S4 | Critical | Stop + notify immediately |
Checks
OpenClaw Security
| Check | Risk | Action |
|---|---|---|
| Credentials in git | S3 | Add to .gitignore, rotate |
| Token expiration | S2 | Refresh tokens |
| Exposed secrets | S4 | Rotate immediately |
| Uncommitted changes | S1 | Review + commit |
System Security
| Check | Risk | Action |
|---|---|---|
| SSH password auth | S2 | Disable, use keys only |
| Open ports | S1 | Review with ss -tlnp |
| Unattended upgrades | S2 | Enable automatic updates |
| Firewall status | S2 | Verify ufw/iptables |
Workflow
1. Security Scan
# Check for credentials in git
git log --all --full-history -- .credentials/
# Check file permissions
ls -la ~/.credentials/
# Check SSH config
cat /etc/ssh/sshd_config | grep -E "PasswordAuthentication|PermitRootLogin"
2. Report Generation
## Security Audit Report
**Date:** 2026-02-20
**Scope:** OpenClaw + System
### Findings
| Level | Issue | Recommendation |
|-------|-------|----------------|
| S2 | Token expires in 3 days | Refresh Google OAuth |
### Actions Taken
- [x] Verified .credentials/ permissions (600)
- [ ] Refresh expiring tokens
3. Automated Monitoring
{
"name": "daily-security-check",
"schedule": {"kind": "cron", "expr": "0 6 * * *"},
"payload": {
"kind": "agentTurn",
"message": "Run tinman security scan. Check: credential perms, token expiration, git secrets. Report S2+ issues."
},
"sessionTarget": "isolated",
"notify": true
}
Best Practices
- Credential hygiene — 600 permissions, never in git
- Token rotation — Before expiration
- Regular audits — Weekly automated scans
- Principle of least privilege — Minimal permissions
- Audit logging — Track all changes
Emergency Response
If S4 (Critical) detected:
- Stop — Halt related operations
- Assess — Scope of exposure
- Rotate — Change all affected credentials
- Review — How did it happen
- Prevent — Update processes