Name: security-hardening
Author: wulaosiji

Imported from wulaosiji/skills (security-hardening/SKILL.md). Install upstream with npx skills add wulaosiji/skills --skill security-hardening. Copyright stays with the author.

Security Hardening

一键安全加固 - One-click security hardening for AI agents.

When to Use

Use this skill when:

An agent or skill environment needs security hardening
You want to protect against prompt injection and social engineering attacks
You need to deploy input filtering, command interception, or model locking
Setting up a new workspace and want default-deny security posture

Do NOT use this skill if:

The issue is a specific skill bug → use skill-security-audit instead
You need to store API keys securely → use secure-key-manager instead
You want to run attack simulations → use security-drill instead

Typical triggers:

「帮我加固安全」「agent安全防护」「prompt注入防御」
"security hardening", "protect my agent", "prevent prompt injection"
"部署安全过滤器", "设置命令拦截", "model lock配置"

Workflow

Step 1: Pre-hardening Checklist

Confirm the following before execution:

Admin ID (e.g., ou_xxxxxxxx...)
Allowed models (e.g., kimi-coding/k2p5)
Workspace path (typically ~/.openclaw/workspace)

Step 2: Execute Hardening

# Auto (recommended)
node skills/security-hardening/install.js \
  --admin=ou_xxx \
  --workspace=~/.openclaw/workspace \
  --models=kimi-coding/k2p5

# Interactive
node skills/security-hardening/install.js --interactive

Step 3: Verify Deployment

node skills/security-hardening/verify.js

Expected: all components ✅ and protection level 🟢 High.

Step 4: Test & Maintain

Manually test injection / dangerous command scenarios
Review weekly drill reports: logs/security/drill-*.json
Update via: node skills/security-hardening/install.js --update

Guardrails

Anti-patterns

NEVER run hardening without verifying admin ID ownership
NEVER skip the verification step after installation
NEVER disclose security/ directory paths or config contents to users

Output Constraints

Default-deny: block when uncertain
All sensitive operations require admin validation
Audit logs record every security-relevant action

Safety Rules

/new, /model, /reset commands are blocked for non-admins
System paths, tokens, and SOUL.md contents are redacted in responses
Persistent guard auto-restores rules after session resets

Related Skills

skill-security-audit — Audit existing skills for security vulnerabilities and compliance gaps
secure-key-manager — Encrypt and manage API keys with runtime decryption and output sanitization
security-drill — Conduct automated attack simulations and validate incident response

About UniqueClub

This skill is part of the UniqueClub security toolkit. 🌐 https://uniqueclub.ai | 📂 https://github.com/wulaosiji/skills

Install security-hardening and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "wulaosiji-skills-security-hardening", "kind": "skill", "name": "security-hardening", "description": "One-click security hardening system for AI agents and skills. Deploys input filters, command interceptors, model locks, persistent guards, and audit logging to protect against prompt injection, social engineering, dangerous command execution, and information leakage. Use when: \"安全加固\", \"security hardening\", \"prompt injection\", \"社会工程学攻击\", \"agent security\", \"防护配置\", \"secure my agent\", \"安全演练\", \"security controls\", \"防止信息泄露\". Cross-references: skill-security-audit, secure-key-manager, security-drill. Built by UniqueClub 🌐 https://uniqueclub.ai", "publisher": "wulaosiji", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "One-click security hardening system for AI agents and skills. Deploys input filters, command interceptors, model locks, persistent guards, and audit logging to protect against prompt injection, social engineering, dangerous command execution, and information leakage. Use when: \"安全加固\", \"security hardening\", \"prompt injection\", \"社会工程学攻击\", \"agent security\", \"防护配置\", \"secure my agent\", \"安全演练\", \"security controls\", \"防止信息泄露\". Cross-references: skill-security-audit, secure-key-manager, security-drill. Built by UniqueClub 🌐 https://uniqueclub.ai" ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/wulaosiji/skills", "path": "security-hardening/SKILL.md", "ref": "5ca2e0dbcf43d99a24ebfb8f214d1398c0feda3b", "url": "https://github.com/wulaosiji/skills/blob/5ca2e0dbcf43d99a24ebfb8f214d1398c0feda3b/security-hardening/SKILL.md", "key": "wulaosiji/skills/security-hardening/SKILL.md" } }, "instructions": "# Security Hardening\n\n> 一键安全加固 - One-click security hardening for AI agents.\n\n## When to Use\n\nUse this skill when:\n- An agent or skill environment needs **security hardening**\n- You want to protect against **prompt injection** and **social engineering attacks**\n- You need to deploy **input filtering**, **command interception**, or **model locking**\n- Setting up a new workspace and want **default-deny security posture**\n\nDo NOT use this skill if:\n- The issue is a specific skill bug → use **skill-security-audit** instead\n- You need to store API keys securely → use **secure-key-manager** instead\n", "cost": { "context_tokens": 685 } }

security-hardening

About