opena2a-security

# OpenA2A Security for OpenClaw

Security auditing and hardening for OpenClaw installations. Scan your configuration, detect known vulnerabilities, audit installed skills for malicious code, and get specific remediation steps.

This skill runs entirely locally. No data leaves your machine. No API keys required.

## What You Can Ask

### Quick Security Check

Ask for a fast overview of your security posture:

```
"Run a security audit on my OpenClaw setup"
```

```
"Is my OpenClaw configuration secure?"
```

```
"Check my OpenClaw for known vulnerabilities"
```

### CVE-2026-25253 Detection

Check if your OpenClaw instance is vulnerable to the WebSocket hijack RCE (CVSS 8.8):

```
"Am I vulnerable to CVE-2026-25253?"
```

```
"Check for the OpenClaw WebSocket vulnerability"
```

### Skill Scanning

Scan installed skills for malicious code patterns (command injection, data exfiltration, obfuscated payloads, crypto mining):

```
"Scan my installed skills for malware"
```

```
"Is the weather-bot skill safe?"
```

```
"Check all my skills for security issues"
```

### Credential Audit

Check for exposed credentials, weak file permissions, and plaintext storage:

```
"Are my API keys and tokens stored securely?"
```

```
"Check my credential file permissions"
```

### Configuration Hardening

Get specific recommendations for hardening your OpenClaw config:

```
"How do I harden my OpenClaw configuration?"
```

```
"What security settings should I change?"
```

## How It Works

This skill uses HackMyAgent, an open-source security scanner with 47 OpenClaw-specific checks across these categories:

### Skill Security (6 checks)

| Check | What It Detects |
|-------|-----------------|
| SKILL-001 | Command injection via shell execution |
| SKILL-002 | Dynamic code execution (eval, Function, vm) |
| SKILL-003 | Data exfiltration to external endpoints |
| SKILL-004 | Obfuscated code (base64, hex, charcode) |
| SKILL-005 | Crypto mining indicators |
| SKILL-006 | Path traversal...