Claude-skill-registry tinman

Security auditing and hardening for OpenClaw and system infrastructure.

install

source · Clone the upstream repo

git clone https://github.com/majiayu000/claude-skill-registry

Claude Code · Install into ~/.claude/skills/

T=$(mktemp -d) && git clone --depth=1 https://github.com/majiayu000/claude-skill-registry "$T" && mkdir -p ~/.claude/skills && cp -r "$T/skills/other/other/tinman" ~/.claude/skills/majiayu000-claude-skill-registry-tinman && rm -rf "$T"

OpenClaw · Install into ~/.openclaw/skills/

T=$(mktemp -d) && git clone --depth=1 https://github.com/majiayu000/claude-skill-registry "$T" && mkdir -p ~/.openclaw/skills && cp -r "$T/skills/other/other/tinman" ~/.openclaw/skills/majiayu000-claude-skill-registry-tinman && rm -rf "$T"

manifest: skills/other/other/tinman/SKILL.md

Tinman

Security auditing and hardening for OpenClaw and system infrastructure.

Security Levels

Level	Description	Response
S0	Info	Log only
S1	Low	Notify user
S2	Medium	Alert + recommend fix
S3	High	Immediate action required
S4	Critical	Stop + notify immediately

Checks

OpenClaw Security

Check	Risk	Action
Credentials in git	S3	Add to .gitignore, rotate
Token expiration	S2	Refresh tokens
Exposed secrets	S4	Rotate immediately
Uncommitted changes	S1	Review + commit

System Security

Check	Risk	Action
SSH password auth	S2	Disable, use keys only
Open ports	S1	Review with `ss -tlnp`
Unattended upgrades	S2	Enable automatic updates
Firewall status	S2	Verify ufw/iptables

Workflow

1. Security Scan

# Check for credentials in git
git log --all --full-history -- .credentials/

# Check file permissions
ls -la ~/.credentials/

# Check SSH config
cat /etc/ssh/sshd_config | grep -E "PasswordAuthentication|PermitRootLogin"

2. Report Generation

## Security Audit Report
**Date:** 2026-02-20
**Scope:** OpenClaw + System

### Findings
| Level | Issue | Recommendation |
|-------|-------|----------------|
| S2 | Token expires in 3 days | Refresh Google OAuth |

### Actions Taken
- [x] Verified .credentials/ permissions (600)
- [ ] Refresh expiring tokens

3. Automated Monitoring

{
  "name": "daily-security-check",
  "schedule": {"kind": "cron", "expr": "0 6 * * *"},
  "payload": {
    "kind": "agentTurn",
    "message": "Run tinman security scan. Check: credential perms, token expiration, git secrets. Report S2+ issues."
  },
  "sessionTarget": "isolated",
  "notify": true
}

Best Practices

Credential hygiene — 600 permissions, never in git
Token rotation — Before expiration
Regular audits — Weekly automated scans
Principle of least privilege — Minimal permissions
Audit logging — Track all changes

Emergency Response

If S4 (Critical) detected:

Stop — Halt related operations
Assess — Scope of exposure
Rotate — Change all affected credentials
Review — How did it happen
Prevent — Update processes