Baseline Kit

基于 profile 生成 OpenClaw 配置基线，并对现有配置执行离线审计，检查网关绑定、认证限流、技能来源限制、审计日志、备份提示和明文密钥等问题，输出含严重级别、证据路径、建议和合规标签的发现，支持表格与 JSON 输出。

mike007jd

热度 70.91

最近更新 2026-05-11 17:27:29

分类：安全依赖：代码执行 / 读写文件应用场景：DevOps / 自动化脚本 / 模板

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add baseline-kit

Metadata

name: baseline-kit
description: Generate safer OpenClaw configuration baselines and audit existing config files for exposure, missing controls, and secret hygiene issues.
homepage: https://github.com/mike007jd/openclaw-skills/tree/main/baseline-kit
metadata: {"openclaw":{"emoji":"🧱","requires":{"bins":["node"]}}}

Baseline Kit

Generate profile-based OpenClaw configuration JSON and audit an existing config before rollout.

When to use

You need a starting profile for development, team, enterprise, or airgapped.
You want an offline audit for gateway.bind, auth rate limits, allowed skill sources, audit logging, backups, or secret-like values.
You need a reviewable JSON artifact without contacting external services.

Commands

node {baseDir}/bin/baseline-kit.js generate --profile enterprise --out ./openclaw.secure.json
node {baseDir}/bin/baseline-kit.js generate --profile development --out ./openclaw.dev.json
node {baseDir}/bin/baseline-kit.js audit --config ~/.openclaw/openclaw.json --format table
node {baseDir}/bin/baseline-kit.js audit --config ./openclaw.secure.json --format json

Profiles

Profile	Focus
`development`	Faster local iteration with lighter rate limits and shorter retention
`team`	Shared team defaults with moderate auth protection and audit logging
`enterprise`	Tighter auth windows, longer retention, and recovery guidance
`airgapped`	Loopback-only and local-mirror oriented settings

Audit checks

NET_EXPOSURE: whether gateway.bind is loopback-only
AUTH_RATE_LIMIT: whether auth rate limiting is configured completely
SOURCE_RESTRICTION: whether allowed skill sources are too broad
AUDIT_LOGGING: whether audit logging is enabled
BACKUP_HINT: whether backup settings are present
SECRET_HYGIENE: whether the config tree contains plaintext secret-like values

Output

Each finding includes a severity, evidence path, recommendation, and compliance tag set.
Compliance tags currently map to SOC2, ISO27001, and NIST CSF.

Boundaries

This tool audits JSON structure only. It does not enforce runtime policy.
Generated profiles are safer defaults, not a complete configuration management system.