name: openclaw-action description: "GitHub Action for automated security scanning of agent workspaces. Detects exposed secrets, prompt/shell injection, and data exfiltration patterns in PRs and commits." user-invocable: false metadata: {"openclaw":{"emoji":"🛡️","requires":{"bins":["python3"]},"os":["darwin","linux","win32"]}}

OpenClaw Security Action

GitHub Action that scans agent skills for security issues on every PR.

What It Scans

Quick Start

Add to .github/workflows/security.yml:

name: Security Scan
on:
  pull_request:
    paths:
      - 'skills/**'
      - '.openclaw/**'
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: AtlasPA/openclaw-action@v1
        with:
          workspace: '.'
          fail-on-findings: 'true'

Inputs

Outputs

Philosophy

This action detects and alerts only. It will:

• Flag security issues in PR checks
• Annotate specific lines with findings
• Generate a summary report

It will NOT:

• Automatically modify your code
• Quarantine or delete files
• Make any changes to your repository

For automated remediation, see OpenClaw Pro.

Requirements

• Python 3.8+ (auto-installed by action)
• No external dependencies