SafeClaw Security Checker

Perform security compliance checks on MCP/LLM application configurations.

Usage

When the user invokes this skill, run security checks on their configuration.

Basic Command

cd {baseDir}/../../ && uv run python main.py check --config "<config_path>" --format json

Arguments

• config_path: Path to the configuration file to check (JSON/YAML/TOML)
• If no path provided, use --auto to auto-discover config:

  cd {baseDir}/../../ && uv run python main.py check --auto --format json
  

Execution Flow

1. Determine config path:

   • If user provides a path, use it
   • If user wants auto-discovery, use --auto
   • If unsure, ask the user

2. Run the check:

   cd {baseDir}/../../ && uv run python main.py check --config "<path>" --format json
   

3. Parse JSON output: The output has this structure:

   {
     "summary": {
       "overall_status": "安全|注意|高危",
       "total": 10,
       "passed": 7,
       "failed": 3,
       "by_level": {"safe": 7, "attention": 2, "high_risk": 1}
     },
     "failed_results": [
       {
         "name": "检查项名称",
         "category": "安全类别",
         "level": "高危|注意",
         "message": "问题描述",
         "risk_description": "风险说明",
         "remediation": "整改建议",
         "fix_commands": ["command to fix"]
       }
     ]
   }
   

4. Report findings:

   • Show summary: X passed, Y attention items, Z high-risk
   • List high-risk items FIRST with remediation steps
   • List attention items with suggestions
   • If all passed, congratulate the user

Exit Codes

• 0: All checks passed (safe)
• 1: Attention items found
• 2: High-risk items found

Example Config

Use {baseDir}/example-config.json as a reference template for users who need a starting point.

Categories Checked

Example Invocation

User: "/safeclaw check my config at ./config/mcp.json"

Response:

1. Run: cd {baseDir}/../../ && uv run python main.py check --config "./config/mcp.json" --format json
2. Parse results and present findings in a clear, actionable format

Tips

• Always use --format json for machine-readable output
• The skill runs from the skill directory, so use {baseDir}/../../ to reach project root
• If the config file doesn't exist, suggest using the template at {baseDir}/templates/minimal-config.json