Documents

Cyber Security Engineer

Enforce least privilege and report host, network, and compliance violations with evidence and mitigations.

What it does

Enforces non-root execution, explicit approval for narrowly scoped elevation, idle expiry, and privileged-action logging for security-sensitive tasks. It checks listening ports and outbound destinations against reviewed baselines, then reports check IDs, risk, evidence, and mitigations mapped to ISO 27001 and NIST controls.

When to use it

  • Approval-gated privileged maintenance
  • Listening-port exposure reviews
  • Outbound egress allowlist checks
  • ISO 27001 and NIST control assessments

The skill document

Cyber Security Engineer

Implement these controls in every security-sensitive task:

  1. Keep default execution in normal (non-root) mode.
  2. Request explicit user approval before any elevated command.
  3. Scope elevation to the minimum command set required for the active task.
  4. Drop elevated state immediately after the privileged command completes.
  5. Expire elevated state after 30 idle minutes and require re-approval.
  6. Monitor listening network ports and flag insecure or unapproved exposure.
  7. Monitor outbound connections and flag destinations not in the egress allowlist.
  8. If no approved baseline exists, generate one and require user review/pruning.
  9. Benchmark controls against ISO 27001 and NIST and report violations with mitigations.

Non-Goals (Web Browsing)

  • Do not use web browsing / web search as part of this skill. Keep assessments and recommendations based on local host/OpenClaw state and the bundled references in this skill.

Files To Use

  • references/least-privilege-policy.md
  • references/port-monitoring-policy.md
  • references/compliance-controls-map.json
  • references/approved_ports.template.json
  • references/command-policy.template.json
  • references/prompt-policy.template.json
  • references/egress-allowlist.template.json
  • scripts/preflight_check.py
  • scripts/root_session_guard.py
  • scripts/audit_logger.py
  • scripts/command_policy.py
  • scripts/prompt_policy.py
  • scripts/guarded_privileged_exec.py
  • scripts/install-openclaw-runtime-hook.sh
  • scripts/port_monitor.py
  • scripts/generate_approved_ports.py
  • scripts/egress_monitor.py
  • scripts/notify_on_violation.py
  • scripts/compliance_dashboard.py
  • scripts/live_assessment.py

Behavior

  • Never keep root/elevated access open between unrelated tasks.
  • Never execute root commands without an explicit approval step in the current flow.
  • Enforce command allow/deny policy when configured.
  • Require confirmation when untrusted content sources are detected (OPENCLAW_UNTRUSTED_SOURCE=1 + prompt policy).
  • Enforce task session id scoping when configured (OPENCLAW_REQUIRE_SESSION_ID=1).
  • If timeout is exceeded, force session expiration and approval renewal.
  • Log privileged actions to ~/.openclaw/security/privileged-audit.jsonl (best-effort).
  • Flag listening ports not present in the approved baseline and recommend secure alternatives for insecure ports.
  • Flag outbound destinations not present in the egress allowlist.

Output Contract

When reporting status, include:

  • The specific check_id(s) affected, status, risk, and concise evidence.
  • Concrete mitigations (what to change, where) and any owners/due dates if present.
  • For network findings: port, bind address, process/service, and why it is flagged (unapproved/insecure/public).

Questions people ask

How does privileged execution stay limited?
Commands run non-root by default. Each elevated command requires explicit approval in the current flow, is restricted to the minimum command set, and loses elevated state after completion or 30 idle minutes.
What happens when no network baseline exists?
It generates an approved-port or egress baseline and requires the user to review and prune it. Listening ports and outbound destinations outside the approved lists are then flagged.
What does a security status report contain?
Reports include affected check IDs, status, risk, concise evidence, and concrete mitigations, plus owners and due dates when present. Network findings also identify the port, bind address, process or service, and whether exposure is unapproved, insecure, or public.

Related skills

Cyber Security Engineer

Govern OpenClaw privileged execution and report local port, egress, and compliance violations.

92 installs

clawsec-suite

Monitor signed advisories, match affected installed skills, and gate risky installs or removals on approval.

357 installs8 stars

clawsec-feed

Monitor NVD CVEs, community advisories, and pre-CVE GitHub advisories in one agent security feed.

by davida-ps103 installs1 stars

OpenClaw Dashboard

Guide safe installation, operation, auditing, and extension of the read-only OpenClaw operations dashboard.

174 installs9 stars

OpenClaw Token Optimizer

Reduce OpenClaw token waste with lazy context, model routing, heartbeat planning, and local budget checks.

459 installs30 stars

openclaw-nextcloud

Manage Nextcloud notes, tasks, calendars, files, contacts, shares, and Deck boards from one JSON CLI.

187 installs9 stars