The OpenClaw security audit CLI is your front-line defense for identifying vulnerabilities in your deployment, skills, and configuration. This guide covers basic audits to find known issues, --deep scans for advanced analysis, --fix auto-remediation to patch vulnerabilities automatically, JSON output for integration with security platforms, and scheduling regular audits as part of your CI/CD pipeline.
Why This Is Hard to Do Yourself
These are the common pitfalls that trip people up.
Vulnerability detection coverage
Audit needs to check skills, configurations, dependencies, and network exposure — many tools miss coverage areas
False positives and noise
Too many unactionable warnings creates alert fatigue. Filtering and severity levels are critical
Auto-remediation risks
Auto-fix can break things if not careful. Need dry-run and validation before applying fixes
CI/CD integration complexity
Integrating audit into pipelines requires proper exit codes, JSON parsing, and failure policies
Step-by-Step Guide
Run a basic security audit
Scan for common vulnerabilities and configuration issues.
openclaw audit
# Output:
# Scanning OpenClaw installation...
# ✓ Version check: 2.4.1 (latest)
# ✗ Authentication: Gateway auth disabled
# ✗ Firewall: Port 3000 exposed to 0.0.0.0
# ⚠ Skill permissions: 3 skills request shell accessRun a deep audit with detailed analysis
Perform comprehensive vulnerability scanning with network checks and dependency analysis.
openclaw audit --deep
# Additional checks:
# - Scans installed skills for malware patterns
# - Checks all dependencies for known CVEs
# - Tests network connectivity to required endpoints
# - Validates SSL certificates
# - Reviews file permissions and ownershipWarning: Deep audits take longer (5-10 minutes) and require network access. May trigger rate limits on vulnerability databases.
Review audit results by severity
Filter audit output by severity level.
openclaw audit --severity critical
# Shows only critical vulnerabilities
openclaw audit --severity warning
# Shows warning and critical issues
openclaw audit --severity info
# Shows all issues including informationalExport results to JSON for integration
Generate machine-readable output for security tools and dashboards.
openclaw audit --json > audit-results.json
# Output format:
# {
# "timestamp": "2025-02-04T10:30:00Z",
# "version": "2.4.1",
# "summary": { "critical": 2, "warning": 5, "info": 10 },
# "issues": [
# {
# "id": "SEC-001",
# "title": "Gateway authentication disabled",
# "severity": "critical",
# "remediation": "Enable gateway authentication in config.json"
# }
# ]
# }Use auto-remediation to fix detected issues
Automatically apply fixes for known vulnerabilities.
openclaw audit --fix --dry-run
# Preview what will be fixed without applying
openclaw audit --fix
# Apply fixes automatically
# Affected files will be backed up firstWarning: Always run --dry-run first to review changes. Auto-fix modifies configuration files and could break your setup if applied blindly.
Schedule regular audits with cron
Run automated audits on a schedule and get notified of new issues.
# Edit crontab:
crontab -e
# Add this line (runs daily at 2 AM):
0 2 * * * /usr/local/bin/openclaw audit --json > /tmp/openclaw-audit-$(date +\%Y-\%m-\%d).json
# Or send results via email:
0 2 * * * /usr/local/bin/openclaw audit --json | mail -s "Daily OpenClaw Audit" security@example.comIntegrate audits into CI/CD pipeline
Make deployments fail if critical vulnerabilities are detected.
# In your CI/CD script (GitHub Actions, GitLab CI, Jenkins, etc.):
openclaw audit --json > audit.json
AUDIT_CRITICAL=$(jq '.summary.critical' audit.json)
if [ "$AUDIT_CRITICAL" -gt 0 ]; then
echo "Critical vulnerabilities detected! Fix before deploying."
exit 1
fi
echo "Audit passed. Proceeding with deployment."Skip specific checks if needed
Exclude false positives or known accepted risks.
openclaw audit --skip SEC-001,SEC-042
# Skips specific security issues
openclaw audit --skip-skills-audit
# Skips skill malware scanning (fast audit)
openclaw audit --skip-network-check
# Skips network connectivity testsSecurity Audits Aren't One-Time Events
Regular auditing catches new vulnerabilities before they become exploits. Our security team configures continuous auditing, remediation workflows, and alerting so you stay ahead of threats.
Get matched with a specialist who can help.
Sign Up for Expert Help →