What does this skill do, and when should you use it?
ShellWard is an AI Agent security and compliance gateway built for China's regulatory regime (CSL, PIPL, MLPS 2.0, cross-border data, AI labeling); this skill packages its security deployment best practices into an on-demand checklist. When invoked, the assistant inspects the current system state — exposed gateway ports, container hardening, plaintext credentials, audit log status, plugin risks — and returns concrete fix commands for each issue. The repository also ships a standalone compliance scanner (npx shellward scan) that detects cross-border data risks, hardcoded secrets, and Chinese PII with a red/yellow/green scorecard. Best suited for teams deploying AI agent gateways or facing Chinese data-compliance requirements.
On invocation it walks a six-part checklist, checking live state and recommending actions: 1) Network control — verify the OpenClaw gateway ports (19000/19001) are not public, recommend binding to 127.0.0.1 or an authenticated reverse proxy, and supply ufw/security-group rules; 2) Container isolation — provide a hardened docker run command with --cap-drop=ALL, read-only filesystem, and resource limits; 3) Credential management — scan .env, .bashrc, and environment variables for plaintext secrets, recommend Vault/doppler, and set sensitive files to 0600; 4) Audit logging — verify ~/.openclaw/shellward/audit.l is active, show recent events, and advise rotation and SIEM forwarding; 5) Plugin security — list installed plugins and scan for suspicious code patterns; 6) Patch management — check the OpenClaw version against known vulnerabilities and enforce Node.js ≥ 22.12. It also reminds users of built-in commands: /security, /audit, /harden (and /harden fix), /scan-plugins, /check-updates.
- An ops engineer who just deployed OpenClaw/ShellWard on a cloud server and needs to confirm ports 19000/19001 aren't public and set up firewall rules
- A security engineer wanting to run OpenClaw in a capability-restricted Docker container with a copy-paste hardened launch command
- A team lead worried about overly permissive .env, ~/.ssh, or ~/.aws/credentials files and plaintext keys who wants them fixed item by item
- A compliance auditor pre-checking that ShellWard audit logging is active and planning log rotation and SIEM forwarding
- An administrator verifying whether the current OpenClaw version has known CVEs (17 built-in) and that Node.js meets the minimum before upgrading
- A maintainer suspicious of installed plugins who wants them scanned for malicious patterns and auto-update disabled
How do you install this skill?
- This is a static source-only review; nothing was executed and confidence is low.
- The skill description diverges from the repo's headline compliance-scanning positioning; the actual content is a generic deployment hardening checklist.
- Auto-fix commands like `/harden fix` lack documented destructive-risk boundaries and rollback; review each action before running.
- At least one suggested command (ufw allow from 127.0.0.1) is questionable relative to its stated intent; verify independently.
- Publisher is unverified (identity unknown); the skill depends on host tool (OpenClaw/ShellWard) behavior not assessed here.
- Shell / CLI
- Local filesystem
OpenClaw gateway (ports 19000/19001)Docker (optional, for container isolation)Node.js 22.12+
The skill file lives at skills/security-guide/SKILL.md in the repository. Place the skills/security-guide/ folder into your Agent Skills directory following the open standard (in Claude Code: ~/.claude/skills/ or the project's .claude/skills/). ShellWard itself must be installed first (npm install shellward, or openclaw plugins install shellward). The repo does not document skill-specific install steps beyond this; defer to your host platform's skill mechanism.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/jnMetaCode/shellward.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/security-guide" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Run a ShellWard/OpenClaw security deployment check
- Check whether my OpenClaw gateway is exposed to the public internet.
From any Agent Skills-compatible assistant, issue a trigger-style request such as "Run a ShellWard/OpenClaw security deployment check" or "Check whether my OpenClaw gateway is exposed to the public internet." The assistant reads the checklist in SKILL.md, inspects the system with its available tools, prioritizes critical issues, and provides the exact fix command for each — asking for confirmation before any destructive operation. You can also use ShellWard's native commands directly: /security for status, /audit for logs, /harden to scan and fix, /scan-plugins for plugin risks, /check-updates for versions and CVEs.
What are this skill's strengths and limitations?
- Checklist spans the full deployment lifecycle across six dimensions: network, containers, credentials, logging, plugins, patching
- Every finding comes with an executable fix command rather than abstract advice
- Purpose-built for Chinese regulatory mapping (CSL/PIPL/MLPS 2.0/cross-border/AI labeling) — a perspective English-language tools lack
- The underlying ShellWard gateway is zero-dependency, zero-config, and Apache-2.0 licensed
- Responds in the user's detected language automatically
- The skill itself only inspects and advises — it does not auto-remediate; hardening depends on the user executing the fixes
- Tightly coupled to the OpenClaw/ShellWard ecosystem (ports, log paths, slash commands); not applicable to other agent gateways
- Performance and detection metrics in the README (e.g., 100% F1) are based on the author's self-built corpus, not third-party evaluation
- The README explicitly documents 5 known bypass categories (leetspeak, base64, non-Chinese/English languages, shell variable indirection) that regex heuristics cannot catch
- Test counts are inconsistent between README (328) and SKILL.md-era claims (183), leaving evidence uneven
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| ShellWard Security Deployment Guide this page | 54 · Use with care | ★ 140 | 26d ago | Apache-2.0 |
| OpenClaw Audit Watchdog | 48 · Use with care | ★ 1.1k | 12d ago | AGPL-3.0 |
| Clawtributor Security Reporter | 54 · Use with care | ★ 1.1k | 12d ago | AGPL-3.0 |
| Azure Compliance Auditor ✓ Microsoft · Official | 50 · Use with care | ★ 2.7k | 3mo ago | MIT |
| ClawSec Advisory Feed | 47 · Use with care | ★ 1.1k | 12d ago | AGPL-3.0 |
The README compares itself to agentguard (hook-based guard), pipelock (HTTP proxy), Sage (hook + cloud API), and AgentSeal (scanner), claiming to be the only tool combining DLP-style data-flow tracking, Chinese-language security, and zero dependencies. These comparisons are author-supplied and not independently verified; benchmark them yourself before adopting.
How did FollowSkills review this skill?
The skill is advisory-only, asks for confirmation before destructive operations, and recommends read-only checks, least-privilege containers and 0600 permissions; but confirmation relies on model self-restraint, no rollback guidance, and incomplete data-flow disclosure (e.g., SIEM forwarding) — 10 deducted.
Static cap of 10. The checklist is self-consistent with concrete commands (ports, docker flags, chmod 600), but actual behavior, failure feedback and abnormal-input handling of /harden, /audit etc. live in the host tool and are undefined in SKILL.md — 10 deducted.
Clear scenario (OpenClaw deployment hardening), bilingual, explicit invocability; but no declared non-fit boundaries (non-OpenClaw setups), and some advice (OpenClaw-specific ports/paths) does not generalize — 5 deducted.
Well-structured bilingual docs; repo provides Apache-2.0, SECURITY.md with version table. But the skill file has no own version/changelog, its description diverges from the README's compliance-scanner positioning, and maintenance responsibility is a single individual — 6 deducted.
Static cap of 7. The checklist covers six areas with directly runnable commands, real marginal value over generic advice; but no verified representative outputs and at least one questionable command (ufw allow from 127.0.0.1) — scored 6.
Static cap of 5. Repo has CI workflows, test scripts and a labeled benchmark corpus, but none cover this skill path; the skill's own recommendations lack executable third-party verification — scored 4.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →