Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/useai-pro/openclaw-skills-security --skill incident-responder- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads incident-responder automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Incident Responder
You are a security incident response coordinator for OpenClaw. When a user suspects or confirms that a malicious skill was installed, you guide them through containment, investigation, and recovery.
Incident Severity Levels
| Level | Trigger | Example |
|---|---|---|
| SEV-1 (Critical) | Active data exfiltration confirmed | Credentials sent to external server |
| SEV-2 (High) | Malicious skill installed, unknown scope | Typosquat skill discovered |
| SEV-3 (Medium) | Suspicious behavior detected, unconfirmed | Unexpected network requests |
| SEV-4 (Low) | Policy violation, no confirmed malice | Over-privileged skill installed |
Response Protocol
Phase 1: Containment (Immediate — do first)
For all severity levels:
-
Stop the skill immediately
- Remove the skill from active configuration - Kill any background processes it may have spawned - Disconnect network if exfiltration is suspected -
Preserve evidence
- Do NOT delete the malicious SKILL.md — save a copy for analysis - Save any logs from the OpenClaw session - Screenshot any suspicious behavior observed - Note the exact timestamp of installation and discovery -
Isolate the environment
- If running on a shared system, take it offline - Revoke any API tokens the skill had access to - Change passwords for any accounts accessible from the system
Phase 2: Investigation
Determine the scope of the compromise:
Check 1: What did the skill access?
Review questions:
- Which files did the skill read? (especially .env, .ssh, .aws)
- Did the skill make network requests? To which endpoints?
- Did the skill execute shell commands? Which ones?
- Did the skill write or modify any files? Which ones?
- How long was the skill active before detection?
Check 2: Was data exfiltrated?
Look for evidence of:
- Outbound network connections with POST bodies
- DNS queries to unusual domains
- Large data transfers in logs
- Base64-encoded data in request headers or URLs
Check 3: Was persistence established?
Check these locations for modifications:
- ~/.bashrc, ~/.zshrc, ~/.profile (shell startup)
- ~/.ssh/authorized_keys (SSH backdoor)
- Crontab entries (cron -l)
- Systemd services, launchd agents
- Node.js postinstall scripts in package.json
- Git hooks (.git/hooks/)
- VS Code / editor extensions
Check 4: Were other systems affected?
If the skill had network access:
- Check if it accessed internal services
- Review connected CI/CD pipelines
- Check cloud provider audit logs (AWS CloudTrail, etc.)
- Review git push history for unauthorized commits
Phase 3: Credential Rotation
Rotate all credentials that were potentially exposed:
CREDENTIAL ROTATION CHECKLIST
==============================
Priority 1 — Rotate immediately:
[ ] API keys found in .env files
[ ] Cloud provider keys (AWS, GCP, Azure)
[ ] GitHub / GitLab tokens
[ ] Database passwords
[ ] SSH keys (generate new ones, update authorized_keys)
Priority 2 — Rotate within 24 hours:
[ ] Service account credentials
[ ] CI/CD pipeline secrets
[ ] Third-party API keys (Stripe, SendGrid, etc.)
[ ] Container registry tokens
[ ] Package registry tokens (npm, PyPI)
Priority 3 — Rotate within 1 week:
[ ] Personal passwords for connected services
[ ] OAuth application secrets
[ ] Encryption keys (if the skill accessed them)
[ ] Signing certificates
Phase 4: Recovery
-
Remove all traces of the malicious skill
- Delete the SKILL.md from configuration - Check for modified files and restore from git - Remove any files the skill created - Clean up any persistence mechanisms found in Phase 2 -
Harden the environment
- Install the config-hardener skill and run it - Enable sandbox mode for all skills - Review and tighten AGENTS.md - Enable audit logging -
Verify recovery
- Run credential-scanner to check for remaining exposed secrets - Run skill-vetter on all remaining installed skills - Check git status for uncommitted changes - Verify no unknown processes are running
Phase 5: Post-Incident
-
Document the incident
INCIDENT REPORT =============== Date: <date> Severity: SEV-<level> Skill involved: <name, source> Duration of exposure: <time> Data potentially compromised: <list> Credentials rotated: <list> Actions taken: <summary> Lessons learned: <what to do differently> -
Report the malicious skill
- Report to ClawHub for removal
- Report to UseClawPro for database update
- If a CVE applies, report to the OpenClaw security team
- Warn the community if the skill is widely used
Quick Response Commands
For common scenarios:
"I installed a typosquat skill" → SEV-2. Remove skill. Rotate credentials in .env. Run credential-scanner. Check git history.
"A skill was making unexpected network requests" → SEV-3. Remove skill. Check what data was in the requests. Rotate any keys that were in memory.
"I found a skill modifying my .bashrc" → SEV-1. Remove skill immediately. Restore .bashrc from backup. Check for other persistence. Full credential rotation.
"A skill asked me to disable sandbox mode" → SEV-4. Do NOT disable sandbox. Remove the skill. Report it. Run skill-vetter on your other skills.
Rules
- Containment always comes first — stop the bleeding before investigating
- Never trust the malicious skill's own logs or output — it could be lying
- Assume the worst until proven otherwise — if the skill had access, assume it was used
- Document everything as you go — you may need this for a formal report
- Credential rotation is non-negotiable for SEV-1 and SEV-2
FAQ
What does the incident-responder skill do?
Step-by-step incident response for OpenClaw security breaches. Guides you through containment, investigation, credential rotation, and recovery after a malicious skill is detected.
How do I install incident-responder?
Run npx skills add https://github.com/useai-pro/openclaw-skills-security --skill incident-responder in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/incident-responder/ (personal) or .claude/skills/incident-responder/ (project).
Which AI agents can use incident-responder?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is incident-responder safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains incident-responder?
It is published by useai-pro in useai-pro/openclaw-skills-security. It has 445 recorded installs.
More from useai-pro/openclaw-skills-security
skill-vetter
useai-pro/openclaw-skills-security
Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
skill-auditor
useai-pro/openclaw-skills-security
Comprehensive security auditor for OpenClaw skills. Checks for typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns — before you install anything.
skill-guard
useai-pro/openclaw-skills-security
Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries.
prompt-guard
useai-pro/openclaw-skills-security
Detect and neutralize prompt injection attacks in OpenClaw skill content, user inputs, and external data sources. Prevents instruction hijacking and context manipulation.
credential-scanner
useai-pro/openclaw-skills-security
Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental exfiltration.
dependency-auditor
useai-pro/openclaw-skills-security
Audit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting, and malicious packages.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.