Tinman
Security auditing and hardening for OpenClaw and system infrastructure.
Security Levels
| Level | Description | Response |
|---|
| S0 | Info | Log only |
| S1 | Low | Notify user |
| S2 | Medium | Alert + recommend fix |
| S3 | High | Immediate action required |
| S4 | Critical | Stop + notify immediately |
Checks
OpenClaw Security
| Check | Risk | Action |
|---|
| Credentials in git | S3 | Add to .gitignore, rotate |
| Token expiration | S2 | Refresh tokens |
| Exposed secrets | S4 | Rotate immediately |
| Uncommitted changes | S1 | Review + commit |
System Security
| Check | Risk | Action |
|---|
| SSH password auth | S2 | Disable, use keys only |
| Open ports | S1 | Review with ss -tlnp |
| Unattended upgrades | S2 | Enable automatic updates |
| Firewall status | S2 | Verify ufw/iptables |
Workflow
1. Security Scan
bash
1# Check for credentials in git
2git log --all --full-history -- .credentials/
3
4# Check file permissions
5ls -la ~/.credentials/
6
7# Check SSH config
8cat /etc/ssh/sshd_config | grep -E "PasswordAuthentication|PermitRootLogin"
2. Report Generation
markdown
1## Security Audit Report
2**Date:** 2026-02-20
3**Scope:** OpenClaw + System
4
5### Findings
67|-------|-------|----------------|
8| S2 | Token expires in 3 days | Refresh Google OAuth |
9
10### Actions Taken
11- [x] Verified .credentials/ permissions (600)
12- [ ] Refresh expiring tokens
3. Automated Monitoring
json
1{
2 "name": "daily-security-check",
3 "schedule": {"kind": "cron", "expr": "0 6 * * *"},
4 "payload": {
5 "kind": "agentTurn",
6 "message": "Run tinman security scan. Check: credential perms, token expiration, git secrets. Report S2+ issues."
7 },
8 "sessionTarget": "isolated",
9 "notify": true
10}
Best Practices
- Credential hygiene — 600 permissions, never in git
- Token rotation — Before expiration
- Regular audits — Weekly automated scans
- Principle of least privilege — Minimal permissions
- Audit logging — Track all changes
Emergency Response
If S4 (Critical) detected:
- Stop — Halt related operations
- Assess — Scope of exposure
- Rotate — Change all affected credentials
- Review — How did it happen
- Prevent — Update processes
