# Clone into OpenClaw skills directory
git clone https://github.com/adibirzu/openclaw-security-monitor.git \
  ~/.openclaw/workspace/skills/openclaw-security-monitor

cd ~/.openclaw/workspace/skills/openclaw-security-monitor

# Make scripts executable
chmod +x scripts/*.sh scripts/remediate/*.sh

# Run a 41-point scan (read-only, no system changes)
./scripts/scan.sh

# Preview what remediation would do (dry-run, no changes)
./scripts/remediate.sh --dry-run

# Start the web dashboard (read-only, localhost:18800)
node dashboard/server.js

# Scan all installed ClawHub skills
./scripts/clawhub-scan.sh

# Update IOC database (interactive, asks for confirmation)
./scripts/update-ioc.sh

# Install the bundle plugin variant
openclaw plugins install clawhub:openclaw-security-monitor-bundle

# Install daily cron (06:00 UTC) — requires explicit user action
crontab -l | { cat; echo "0 6 * * * $(pwd)/scripts/daily-scan-cron.sh"; } | crontab -

openclaw-security-monitor/
  .codex-plugin/
    plugin.json          # Bundle-plugin manifest for ClawHub/OpenClaw plugin publishing
  scripts/
    scan.sh              # 41-point threat scanner (v5.5.0)
    remediate.sh         # Orchestrator: scan + per-check remediation
    remediate/
      _common.sh         # Shared helpers (log, confirm, fix_perms)
      check-01-c2-ips.sh ... check-41-device-identity-spoofing.sh  # 41 consolidated per-check scripts
      check-42-*.sh ... check-62-*.sh  # retained legacy advisory-specific helpers
    clawhub-scan.sh      # Scan all installed ClawHub skills against IOC database
    dashboard.sh         # CLI security dashboard with witr
    network-check.sh     # Network activity monitor
    daily-scan-cron.sh   # Cron wrapper + Telegram alerts
    telegram-setup.sh    # Telegram notification setup
    update-ioc.sh        # IOC database updater
  ioc/
    c2-ips.txt           # Known C2 IP addresses
    malicious-domains.txt # Payload/exfil domains
    file-hashes.txt      # Known malicious file hashes
    malicious-publishers.txt  # Blacklisted ClawHub accounts
    malicious-skill-patterns.txt  # Malicious skill naming patterns
  dashboard/
    server.js            # Node.js HTTP server (zero npm deps)
    index.html           # Single-file dark-themed SPA
  docs/
    threat-model.md      # Threat model and attack vectors

# Identify the affected skill
grep -rlE "91\.92\.242|95\.92\.242|54\.91\.154\.110" ~/.openclaw/workspace/skills/

# Remove the malicious skill
openclaw skill remove <skill-name>

# Or manually delete it
rm -rf ~/.openclaw/workspace/skills/<skill-name>

# Verify removal
grep -rlE "91\.92\.242" ~/.openclaw/workspace/skills/ # should return empty

# Remove the malicious skill immediately
openclaw skill remove <skill-name>

# Check if AMOS was executed (macOS)
# Look for suspicious LaunchAgents
ls ~/Library/LaunchAgents/ | grep -ivE "com\.apple|com\.openclaw\.security"

# Check for unexpected login items (macOS)
osascript -e 'tell application "System Events" to get the name of every login item'

# Check browser extensions were not tampered with
ls ~/Library/Application\ Support/Google/Chrome/Default/Extensions/

# If AMOS was executed: rotate ALL credentials (SSH, AWS, crypto wallets, browser passwords)

# Remove the skill
openclaw skill remove <skill-name>

# Check for active reverse shells (macOS/Linux)
lsof -i -nP | grep -E "ESTABLISHED|SYN_SENT" | grep -vE ":443 |:80 |:53 "

# Kill any suspicious connections
kill -9 <PID>

# Re-enable Gatekeeper if bypassed (macOS)
sudo spctl --master-enable
sudo defaults write com.apple.LaunchServices LSQuarantine -bool true

# Check for quarantine removals (macOS)
xattr -l /Applications/*.app | grep quarantine

# Remove the skill
openclaw skill remove <skill-name>

# Block exfiltration domains at the host level
# macOS/Linux:
sudo sh -c 'echo "127.0.0.1 webhook.site" >> /etc/hosts'
sudo sh -c 'echo "127.0.0.1 pipedream.net" >> /etc/hosts'
sudo sh -c 'echo "127.0.0.1 hookbin.com" >> /etc/hosts'
sudo sh -c 'echo "127.0.0.1 requestbin.com" >> /etc/hosts'

# Flush DNS cache (macOS)
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder
# Flush DNS cache (Linux)
sudo systemd-resolve --flush-caches

# Remove the skill
openclaw skill remove <skill-name>

# Move crypto wallets to hardware wallets (Ledger, Trezor)
# Rotate exchange API keys immediately

# Restrict filesystem access (macOS)
chmod 700 ~/Library/Application\ Support/Phantom
chmod 700 ~/Library/Application\ Support/MetaMask

# Check if wallet files were accessed recently
# macOS:
mdls -name kMDItemLastUsedDate ~/Library/Application\ Support/Phantom/*
# Linux:
stat -c "%x" ~/.config/phantom/*

# Remove the skill
openclaw skill remove <skill-name>

# Review and restrict agent tool access
openclaw config set tools.deny '["exec","process"]'

# Block curl-pipe at the shell level (add to ~/.bashrc or ~/.zshrc)
# This creates an alias that warns on pipe-to-shell patterns:
alias curl='() { if [[ "$*" == *"|"*"sh"* ]] || [[ "$*" == *"|"*"bash"* ]]; then echo "BLOCKED: curl-pipe detected"; return 1; fi; command curl "$@"; }'

# Fix permissions (macOS/Linux)
chmod 600 ~/.openclaw/openclaw.json
chmod 600 ~/.openclaw/agents/main/agent/auth-profiles.json
chmod 600 ~/.openclaw/exec-approvals.json
chmod 700 ~/.openclaw

# Set default umask in shell profile (add to ~/.bashrc or ~/.zshrc)
echo 'umask 077' >> ~/.zshrc

# Review what changed
diff ~/.openclaw/logs/skill-hashes.sha256.prev ~/.openclaw/logs/skill-hashes.sha256

# For each changed skill, inspect the diff
cd ~/.openclaw/workspace/skills/<skill-name>
git diff HEAD~1 SKILL.md   # If under version control

# If change is unexpected, reinstall from ClawHub
openclaw skill remove <skill-name>
openclaw skill install <skill-name>

# Enable skill pinning (if supported)
openclaw config set skills.autoUpdate false

# Review the suspicious SKILL.md
cat ~/.openclaw/workspace/skills/<skill-name>/SKILL.md | grep -iE "terminal|curl|wget|install|download"

# Remove the skill if instructions are clearly malicious
openclaw skill remove <skill-name>

# Never run commands from SKILL.md Prerequisites without reviewing them first
# Configure agent to not auto-execute installation commands
openclaw config set tools.deny '["exec"]'

# Review poisoned files
cat ~/.openclaw/workspace/SOUL.md
cat ~/.openclaw/workspace/MEMORY.md
cat ~/.openclaw/workspace/IDENTITY.md

# Remove injected content manually (edit the file, remove injected lines)
# Or restore from backup:
git checkout HEAD -- ~/.openclaw/workspace/SOUL.md

# Protect memory files from modification
chmod 444 ~/.openclaw/workspace/SOUL.md
chmod 444 ~/.openclaw/workspace/MEMORY.md
chmod 444 ~/.openclaw/workspace/IDENTITY.md

# Investigate which skill wrote to memory
grep -rl "SOUL\.md\|MEMORY\.md" ~/.openclaw/workspace/skills/

# Review the base64 content
grep -rn "base64" ~/.openclaw/workspace/skills/<skill-name>/

# Decode and inspect the payload
echo "<base64-string>" | base64 -d

# Remove if malicious
openclaw skill remove <skill-name>

# Monitor for base64 activity in agent logs
grep -i "base64" ~/.openclaw/logs/*.log

# Remove the skill
openclaw skill remove <skill-name>

# Check Downloads folder for suspicious binaries (macOS)
ls -la ~/Downloads/*.{exe,dmg,pkg,zip,msi} 2>/dev/null

# Verify Gatekeeper is active (macOS)
spctl --status  # should say "assessments enabled"

# Check if any unsigned apps were installed (macOS)
sudo find /Applications -name "*.app" -exec codesign -v {} \; 2>&1 | grep "invalid"

# Linux: check /tmp and /var/tmp for suspicious downloads
find /tmp /var/tmp -name "*.sh" -o -name "*.elf" -o -name "*.bin" -mtime -7 2>/dev/null

# Bind gateway to localhost only
openclaw config set gateway.bind localhost

# Enable authentication
openclaw config set gateway.auth.mode token
# Or use OIDC (enterprise)
openclaw config set gateway.auth.mode oidc

# Verify configuration
openclaw config get gateway.bind
openclaw config get gateway.auth.mode

# Check what's actually listening
lsof -i :18789 -nP   # Should show 127.0.0.1, not 0.0.0.0

# Update to latest version to patch CVE-2026-25253
openclaw update

# Update OpenClaw to latest version (patch included in 2026.2.3+)
openclaw update

# Verify the fix
curl -s -o /dev/null -w "%{http_code}" \
  -H "Connection: Upgrade" -H "Upgrade: websocket" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Origin: http://evil.attacker.com" \
  http://127.0.0.1:18789/
# Should return 403 or 401, NOT 101

# If update is not available, restrict gateway to localhost
openclaw config set gateway.bind localhost

# Add firewall rule (macOS)
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/local/bin/node
# Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 18789 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 18789 -j DROP

# Remove all skills from the malicious publisher
openclaw skill remove <skill-name>

# Check for other skills from the same publisher
grep -rl "<publisher-name>" ~/.openclaw/workspace/skills/

# Review recently installed skills
ls -lt ~/.openclaw/workspace/skills/ | head -20

# Only install skills from verified publishers
# Check skill reputation before installing:
# https://www.koi.ai (Clawdex reputation checker)

# Remove the skill
openclaw skill remove <skill-name>

# Rotate exposed credentials immediately
# OpenAI:
# Go to https://platform.openai.com/api-keys and regenerate
# Anthropic:
# Go to https://console.anthropic.com/settings/keys and regenerate

# Move secrets to a secrets manager instead of .env files
# macOS: Use Keychain Access
security add-generic-password -a "$USER" -s "OPENAI_API_KEY" -w "<new-key>"

# Linux: Use pass or secret-tool
secret-tool store --label="OPENAI_API_KEY" service openai key api

# Restrict skill filesystem access
openclaw config set sandbox.mode all

# Set DM policy to restricted for each channel
openclaw config set channels.whatsapp.dmPolicy restricted
openclaw config set channels.telegram.dmPolicy restricted
openclaw config set channels.discord.dmPolicy restricted

# Set explicit allowFrom list
openclaw config set channels.telegram.allowFrom '["your-user-id"]'

# Disable unused channels entirely
openclaw config set channels.signal.enabled false

# Restrict elevated tools to specific principals
openclaw config set tools.elevated.allowFrom '["your-user-id"]'

# Add dangerous tools to the deny list
openclaw config set tools.deny '["exec","process","browser","filesystem-write"]'

# Require approval for elevated actions
openclaw config set tools.elevated.requireApproval true

# Review current tool permissions
openclaw config get tools

# Enable sandboxing
openclaw config set sandbox.mode all

# Restrict workspace access to read-only where possible
openclaw config set sandbox.workspaceAccess ro

# For Docker deployments (recommended for production):
# Use gVisor runtime for stronger isolation
docker run --runtime=runsc --read-only \
  -v ~/.openclaw:/home/openclaw/.openclaw:ro \
  openclaw/gateway

# Disable mDNS broadcasting
openclaw config set discovery.mdns.mode off

# Or set to minimal (name only, no paths)
openclaw config set discovery.mdns.mode minimal

# Verify mDNS is not broadcasting (macOS)
dns-sd -B _openclaw._tcp local
# Should return no results

# Disable Bonjour for the gateway specifically (macOS)
sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool YES

# Fix all permissions at once
chmod 700 ~/.openclaw
chmod 700 ~/.openclaw/credentials 2>/dev/null
chmod 700 ~/.openclaw/agents/*/sessions 2>/dev/null
find ~/.openclaw/credentials -type f -name "*.json" -exec chmod 600 {} \; 2>/dev/null
find ~/.openclaw -name "auth-profiles.json" -exec chmod 600 {} \;

# Verify
ls -la ~/.openclaw/
ls -la ~/.openclaw/credentials/

# macOS: Review LaunchAgents
ls -la ~/Library/LaunchAgents/ | grep -iE "openclaw|clawdbot|moltbot"
# Remove unauthorized agents:
launchctl unload ~/Library/LaunchAgents/<suspicious-plist>
rm ~/Library/LaunchAgents/<suspicious-plist>

# Check system-level LaunchDaemons (requires root)
sudo ls /Library/LaunchDaemons/ | grep -iE "openclaw|clawdbot"

# Linux: Review systemd services
systemctl --user list-units --type=service | grep -iE "openclaw|clawdbot"
# Disable unauthorized services:
systemctl --user disable --now <service-name>

# Review crontab
crontab -l | grep -iE "openclaw|clawdbot|moltbot"
# Edit and remove suspicious entries:
crontab -e

# List installed extensions
ls ~/.openclaw/extensions/

# Review suspicious extension code
grep -rn "eval\|exec\|child_process\|fetch(" ~/.openclaw/extensions/<ext-name>/

# Remove the extension
rm -rf ~/.openclaw/extensions/<ext-name>

# Disable extension loading if not needed
openclaw config set extensions.enabled false

# Only install extensions from verified sources

# Enable log redaction
openclaw config set logging.redactSensitive true

# Fix log directory permissions
chmod 700 ~/.openclaw/logs
chmod 700 /tmp/openclaw 2>/dev/null

# Verify logs don't contain sensitive data
grep -iE "sk-[a-zA-Z0-9]{10}|password|token.*=" ~/.openclaw/logs/*.log

# Set up log rotation (macOS - newsyslog)
sudo sh -c 'echo "$HOME/.openclaw/logs/*.log 640 7 1000 * J" >> /etc/newsyslog.conf'
# Linux - logrotate
cat > /etc/logrotate.d/openclaw << 'LOGROTATE'
/home/*/.openclaw/logs/*.log {
    weekly
    rotate 4
    compress
    missingok
    notifempty
    create 0600 root root
}
LOGROTATE

# Configure trusted proxies
openclaw config set gateway.trustedProxies '["192.168.1.1"]'

# Never disable device auth
openclaw config set gateway.dangerouslyDisableDeviceAuth false

# If using Nginx, ensure X-Forwarded-For is properly set
# In nginx.conf:
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# Verify
openclaw config get gateway.trustedProxies

# Set exec approvals to deny for non-owner nodes
# Edit ~/.openclaw/exec-approvals.json manually:
# Set "security": "deny" for all non-owner nodes
# Set "ask": "always"

# Fix permissions
chmod 600 ~/.openclaw/exec-approvals.json

# Verify
cat ~/.openclaw/exec-approvals.json | python3 -m json.tool

# Run OpenClaw container with hardened settings
docker run -d \
  --name openclaw \
  --user 1000:1000 \
  --cap-drop ALL \
  --no-new-privileges \
  --read-only \
  --tmpfs /tmp:noexec,nosuid,size=100m \
  --memory 512m \
  --cpus 1.0 \
  --pids-limit 100 \
  -v ~/.openclaw:/home/openclaw/.openclaw:rw \
  openclaw/gateway

# NEVER mount Docker socket
# BAD: -v /var/run/docker.sock:/var/run/docker.sock

# Use gVisor for stronger isolation
docker run --runtime=runsc ...

# macOS
brew install node@22
# Or update existing
brew upgrade node

# Linux (NodeSource)
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -
sudo apt-get install -y nodejs

# Verify
node --version  # Should be >= v22.12.0

# macOS: Move secrets to Keychain
security add-generic-password -a "$USER" -s "OPENAI_API_KEY" -w "<key>"

# Linux: Use pass or secret-tool
pass insert openai/api-key
# Or
secret-tool store --label="OPENAI_API_KEY" service openai key api

# Use environment variables instead of config files
export OPENAI_API_KEY=$(security find-generic-password -s "OPENAI_API_KEY" -w)

# Set up detect-secrets baseline
pip install detect-secrets
detect-secrets scan ~/.openclaw/ > .secrets.baseline

# Remove any clawdbot/openclaw VS Code extensions immediately
rm -rf ~/.vscode/extensions/*clawdbot*
rm -rf ~/.vscode/extensions/*openclaw*
rm -rf ~/.vscode/extensions/*moltbot*

# Check for ScreenConnect/ConnectWise artifacts
# macOS:
find /Applications -name "*ScreenConnect*" -o -name "*ConnectWise*"
# Linux:
find /opt -name "*screenconnect*" -o -name "*connectwise*"

# Scan for persistence left by the trojan
ls ~/Library/LaunchAgents/ | grep -ivE "com\.apple"

# Bind to localhost only
openclaw config set gateway.bind localhost

# Verify
lsof -i :18789 -nP | grep LISTEN
# Should show 127.0.0.1:18789, NOT *:18789 or 0.0.0.0:18789

# Add firewall rules (macOS pf)
echo "block in on ! lo0 proto tcp to any port 18789" | sudo pfctl -ef -

# Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 18789 ! -s 127.0.0.1 -j DROP

# Change default port (reduce scan surface)
openclaw config set gateway.port 28789

# Use explicit MCP server allowlist
openclaw config set mcp.enableAllProjectMcpServers false

# Review each MCP server's tool descriptions
cat ~/.openclaw/mcp.json | python3 -m json.tool

# Pin MCP server versions (prevent rug pulls)
# In mcp.json, use specific versions, not "latest"

# Run MCP servers in separate containers
# Use Cisco MCP Scanner for analysis:
# https://github.com/cisco-ai-defense/mcp-scanner

# Audit MCP server network access
# Check which external endpoints each server contacts
lsof -i -nP | grep -E "node|mcp" | grep ESTABLISHED

# Update to v2026.2.25+ which adds rate limiting
openclaw update

# Verify version
openclaw --version  # Should be 2026.2.25 or later

# Enable strong authentication
openclaw config set gateway.auth.mode token
openclaw config set gateway.auth.tokenLength 64

# Monitor for brute-force attempts
grep "auth.*fail" ~/.openclaw/logs/*.log | tail -20

# Update to v2026.2.10+ for SSRF patches
openclaw update

# Restrict outbound network access
openclaw config set network.allowedHosts '["api.anthropic.com","github.com"]'

# Block metadata endpoints (cloud environments)
sudo iptables -A OUTPUT -d 169.254.169.254 -j DROP  # AWS/GCP metadata

# Update to v2026.2.13+ which fixes the bypass
openclaw update

# Review exec-approvals for overly permissive entries
cat ~/.openclaw/exec-approvals.json | python3 -m json.tool

# Use full path binaries in allowlists instead of names
# Bad:  "sort" -> allows sort --compress-prog=sh
# Good: "/usr/bin/sort" with argument restrictions

# Update to v2026.2.12+ for the fix
openclaw update

# Disable auto-approval of ACP permissions
openclaw config set acp.autoApprove false

# Review which skills have ACP permissions
grep -rl "acp" ~/.openclaw/workspace/skills/*/SKILL.md

# Check for writable dirs before system dirs
echo $PATH | tr ':' '\n' | while read d; do [ -w "$d" ] && echo "WRITABLE: $d"; done

# Remove writable dirs from PATH (add to ~/.zshrc)
export PATH="/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"

# Fix directory permissions
chmod 755 /usr/local/bin
chmod 755 ~/.local/bin

# Update to v2026.2.12+ for the fix
openclaw update

# Audit skill env overrides
grep -rn "env:" ~/.openclaw/workspace/skills/*/SKILL.md

# Remove skills with suspicious env overrides
openclaw skill remove <skill-name>

# Update to v2026.2.10+ for the fix
openclaw update

# Disable deep link handling if not needed
defaults write com.openclaw.gateway LSApplicationQueriesSchemes -array

# Always inspect full URLs before clicking deep links

# Update to latest version (includes log sanitization)
openclaw update

# Enable log redaction
openclaw config set logging.redactSensitive true

# Sanitize existing logs
sed -i.bak 's/\x1b\[[0-9;]*m//g' ~/.openclaw/logs/*.log

# Restrict log file permissions
chmod 600 ~/.openclaw/logs/*.log

# Update to v2026.2.12+ for the fix
openclaw update

# Disable browser relay if not needed
openclaw config set browser.relay.enabled false

# Check for active CDP connections
lsof -i -nP | grep -E "cdp|devtools"

# Update to v2026.2.12+ for the fix
openclaw update

# Check for suspicious files written by browser control
find /tmp -name "*.trace" -newer /tmp -mtime -1 2>/dev/null

# Update to v2026.2.14+ for the fix
openclaw update

# Use strict exec approval patterns (no wildcards)
# Review exec-approvals.json for entries containing * or $
grep -E '[\*\$]' ~/.openclaw/exec-approvals.json

# Update to v2026.2.14+ for the fix
openclaw update

# Always carefully read approval prompts before accepting
# Enable verbose approval mode
openclaw config set approvals.verbose true

# Update to v2026.2.14+ for the fix
openclaw update

# Disable sandbox browser bridge if not needed
openclaw config set sandbox.browser.bridge false

# Update to v2026.2.13+ for the fix
openclaw update

# Add reverse proxy with body size limits (nginx)
# client_max_body_size 1m;

# Update to v2026.2.14+ for the fix
openclaw update

# Check for files written outside expected directories
find ~/.openclaw -name "*.tar" -o -name "*.tgz" -mtime -7 2>/dev/null

# Update to v2026.2.14+ for the fix
openclaw update

# Update to v2026.2.12+ for the fix
openclaw update

# Disable browser extension if not needed
openclaw config set browser.extension.enabled false

# Check for unauthorized access attempts
grep "agent/act" ~/.openclaw/logs/*.log

# Update to v2026.2.14+ for the fix
openclaw update

# Remove writable directories before system dirs in PATH
# See Check 37 for detailed PATH hardening steps

# Update to v2026.2.15+ for the fix
openclaw update

# Disable sandbox caching until upgraded
openclaw config set sandbox.cache.enabled false

# Update to v2026.2.14+ for the fix
openclaw update

# Disable Google Chat integration if not actively used
openclaw config set integrations.googlechat.enabled false

# Audit webhook paths for duplicates
openclaw config get integrations.googlechat

# Update to v2026.3.11+ for the fix
openclaw update

# Restrict gateway to localhost until upgraded
openclaw config set gateway.bind localhost

# Audit connected devices
openclaw device list

# Update to v2026.3.11+ for the fix
openclaw update

# Disable trusted-proxy mode if not required
openclaw config set gateway.trustedProxy false

# Verify origin validation is active
curl -s -o /dev/null -w "%{http_code}" \
  -H "Origin: http://evil.attacker.com" \
  -H "Connection: Upgrade" -H "Upgrade: websocket" \
  http://127.0.0.1:18789/
# Should return 403, NOT 101

# Update to v2026.3.12+ for the fix
openclaw update

# Rotate device credentials after upgrading
openclaw device rotate-credentials

# Review paired devices
openclaw device list

# Revoke any suspicious device pairings
openclaw device revoke <device-id>

# Update to v2026.3.12+ for the fix
openclaw update

# Audit operator accounts
openclaw users list --role operator

# Remove unnecessary write permissions
openclaw users update <user> --role operator.read

# Inspect MCP server configs for hidden content
cat -v ~/.openclaw/mcp-servers/*.json  # -v shows invisible chars

# Remove or quarantine suspicious configs
mv ~/.openclaw/mcp-servers/suspicious.json{,.quarantined}

# Use Cisco MCP Scanner for deeper analysis
# https://github.com/cisco-ai-defense/mcp-scanner

# Pin MCP server versions to prevent rug-pull updates
# Review tool descriptions after every MCP server update

# Remove rogue MCP entries from config files
# Check: ~/.claude.json, ~/.cursor/mcp.json, ~/.continue/config.json, ~/.windsurf/mcp.json

# Uninstall malicious npm packages
npm uninstall -g @anthropic/sdk-extra claude-code-utils claude-mcp-helper

# CRITICAL: Rotate ALL credentials
# - SSH keys: ssh-keygen (regenerate and update authorized_keys)
# - AWS keys: aws iam create-access-key / delete-access-key
# - npm tokens: npm token revoke / npm token create
# - LLM API keys: regenerate on each provider dashboard

# Audit git repos for unauthorized commits
git log --since="2 weeks ago" --oneline

# Check for unauthorized SSH keys
cat ~/.ssh/authorized_keys

# Check for hidden Unicode in rules files
cat -v .cursorrules CLAUDE.md .clawrules 2>/dev/null | grep -P '[\x00-\x08\x0B\x0C\x0E-\x1F]'

# Strip hidden Unicode characters
perl -pi -e 's/[\x{200B}\x{200C}\x{200D}\x{2060}\x{FEFF}\x{00AD}]//g' .cursorrules
perl -pi -e 's/[\x{202A}-\x{202E}\x{2066}-\x{2069}]//g' CLAUDE.md

# Verify cleanup
hexdump -C .cursorrules | grep -E '200[bcd]|2060|feff|00ad'

# Set restrictive permissions on rules files
chmod 644 .cursorrules CLAUDE.md .clawrules 2>/dev/null

# Scan + remediate (interactive)
./scripts/remediate.sh

# Auto-approve all fixes (explicit opt-in)
OPENCLAW_ALLOW_UNATTENDED_REMEDIATE=1 ./scripts/remediate.sh --yes

# Dry run — preview what would be fixed
./scripts/remediate.sh --dry-run

# Remediate a single check
./scripts/remediate.sh --check 7 --dry-run

# Run all 41 scripts without scanning
./scripts/remediate.sh --all

# Check for updates without applying
./scripts/update-ioc.sh --check-only

# Download and apply updates
./scripts/update-ioc.sh

# Override IOC source only with explicit trust bypass
OPENCLAW_ALLOW_UNTRUSTED_IOC_SOURCE=1 ./scripts/update-ioc.sh --github-repo https://example.com/ioc

# Generate plist with your home directory and install
sed "s|__HOME__|$HOME|g" docs/com.openclaw.security-dashboard.plist \
  > ~/Library/LaunchAgents/com.openclaw.security-dashboard.plist

# Load the service
launchctl load ~/Library/LaunchAgents/com.openclaw.security-dashboard.plist

# Verify
curl -s http://localhost:18800/api/status | python3 -m json.tool

# From GitHub
git clone https://github.com/adibirzu/openclaw-security-monitor.git \
  ~/.openclaw/workspace/skills/<skill-dir>
chmod +x ~/.openclaw/workspace/skills/<skill-dir>/scripts/*.sh

Replace `<skill-dir>` with the actual folder name where the skill is installed (commonly `openclaw-security-monitor` or `security-monitor`).

# Check skill is visible
openclaw skills list | grep openclaw-security-monitor

# Test scan through the agent
# In the agent, type: /security-scan

# Node.js (required for web dashboard)
brew install node@22

# witr - process ancestry tracer (optional but recommended)
brew install witr

# Verify
node --version   # v22.x
witr --version   # should print version

# Node.js (via NodeSource or your package manager)
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -
sudo apt-get install -y nodejs

# witr (check https://github.com/pranshuparmar/witr for Linux install)