Tinman

Security auditing and hardening for OpenClaw and system infrastructure.

Security Levels

Checks

OpenClaw Security

System Security

Workflow

1. Security Scan

bash
1# Check for credentials in git
2git log --all --full-history -- .credentials/
3
4# Check file permissions
5ls -la ~/.credentials/
6
7# Check SSH config
8cat /etc/ssh/sshd_config | grep -E "PasswordAuthentication|PermitRootLogin"

2. Report Generation

markdown
1## Security Audit Report
2**Date:** 2026-02-20
3**Scope:** OpenClaw + System
4
5### Findings
6| Level | Issue | Recommendation |
7|-------|-------|----------------|
8| S2 | Token expires in 3 days | Refresh Google OAuth |
9
10### Actions Taken
11- [x] Verified .credentials/ permissions (600)
12- [ ] Refresh expiring tokens

3. Automated Monitoring

json
1{
2  "name": "daily-security-check",
3  "schedule": {"kind": "cron", "expr": "0 6 * * *"},
4  "payload": {
5    "kind": "agentTurn",
6    "message": "Run tinman security scan. Check: credential perms, token expiration, git secrets. Report S2+ issues."
7  },
8  "sessionTarget": "isolated",
9  "notify": true
10}

Best Practices

1. Credential hygiene — 600 permissions, never in git
2. Token rotation — Before expiration
3. Regular audits — Weekly automated scans
4. Principle of least privilege — Minimal permissions
5. Audit logging — Track all changes

Emergency Response

If S4 (Critical) detected:

1. Stop — Halt related operations
2. Assess — Scope of exposure
3. Rotate — Change all affected credentials
4. Review — How did it happen
5. Prevent — Update processes