hackmyagent-core 0.1.3 → 0.2.0

package/dist/hardening/scanner.js

@@ -65,6 +65,12 @@ const CHECK_PROJECT_TYPES = {
     'SESSION-': ['webapp', 'api'], // Session management
     'NET-': ['webapp', 'api'], // Network security (HTTPS, etc.)
     'IO-': ['webapp', 'api'], // Input/output (XSS, etc.)
+    // OpenClaw-specific checks
+    'SKILL-': ['openclaw', 'mcp'], // Skill file security
+    'HEARTBEAT-': ['openclaw'], // Heartbeat/periodic task security
+    'GATEWAY-': ['openclaw'], // Gateway configuration security
+    'CONFIG-': ['openclaw', 'mcp'], // Configuration file security
+    'SUPPLY-': ['openclaw', 'mcp'], // Supply chain security
     'API-': ['api'], // API security headers
     'RATE-': ['webapp', 'api'], // Rate limiting
     'PROC-': ['webapp', 'api'], // Process security (headers, etc.)
@@ -104,6 +110,72 @@ const CREDENTIAL_PATTERNS = [
     // SendGrid
     { name: 'SENDGRID_KEY', pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/ },
 ];
+// OpenClaw skill security patterns
+const SKILL_REMOTE_FETCH_PATTERNS = [
+    /curl\s+(-[a-zA-Z]+\s+)*https?:\/\//gi,
+    /wget\s+(-[a-zA-Z]+\s+)*https?:\/\//gi,
+    /fetch\s*\(\s*['"`]https?:\/\//gi,
+    /\|\s*(ba)?sh/gi, // pipe to shell
+    /\|\s*sudo/gi, // pipe to sudo
+];
+const SKILL_CREDENTIAL_ACCESS_PATTERNS = [
+    /~\/\.ssh/gi,
+    /~\/\.aws/gi,
+    /~\/\.config\/solana/gi,
+    /~\/\.config\/gcloud/gi,
+    /~\/\.kube/gi,
+    /~\/\.gnupg/gi,
+    /keychain/gi,
+    /wallet.*\.json/gi,
+    /seed.*phrase/gi,
+    /private.*key/gi,
+    /\.env/gi,
+    /credentials\.json/gi,
+];
+const SKILL_EXFILTRATION_PATTERNS = [
+    /webhook\.site/gi,
+    /requestbin/gi,
+    /ngrok\.io/gi,
+    /curl\s+[^\n]*?-d\s/gi, // Non-greedy with newline boundary
+    /curl\s+[^\n]*?--data/gi,
+    /curl\s+[^\n]*?-X\s*POST/gi,
+    /fetch\s*\([^)]*method:\s*['"]POST/gi,
+];
+const SKILL_REVERSE_SHELL_PATTERNS = [
+    /nc\s+(-[a-zA-Z]+\s+)*.*-e/gi,
+    /bash\s+-i\s+/gi,
+    /\/dev\/tcp\//gi,
+    /\/dev\/udp\//gi,
+    /python.*socket.*connect/gi,
+    /perl.*socket.*connect/gi,
+];
+const SKILL_CLICKFIX_PATTERNS = [
+    /copy\s+(and\s+)?paste\s+(this\s+)?(into|in)\s+(your\s+)?terminal/gi,
+    /run\s+this\s+command/gi,
+    /execute\s+(the\s+following|this)/gi,
+    /curl.*\|\s*(ba)?sh/gi,
+    /wget.*\|\s*(ba)?sh/gi,
+];
+const HEARTBEAT_DANGEROUS_CAPS = [
+    'shell:*',
+    'shell:bash',
+    'shell:sh',
+    'filesystem:*',
+    'filesystem:~/*',
+    'filesystem:/',
+    'network:*',
+];
+const PROMPT_INJECTION_PATTERNS = [
+    /ignore\s+(all\s+)?(previous|prior|above)/gi,
+    /disregard\s+(all\s+)?(previous|prior)/gi,
+    /system:\s/gi,
+    /<\|.*\|>/gi, // special tokens
+    /\[INST\]/gi,
+    /\[\/INST\]/gi,
+    /<<SYS>>/gi,
+    /Human:/gi,
+    /Assistant:/gi,
+];
 // Severity weights for score calculation
 const SEVERITY_WEIGHTS = {
     critical: 25,
@@ -111,7 +183,17 @@ const SEVERITY_WEIGHTS = {
     medium: 8,
     low: 3,
 };
+const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB max file size to prevent memory exhaustion
+const MAX_LINE_LENGTH = 10000; // 10KB max line length for regex safety
 class HardeningScanner {
+    /**
+     * Validate that a file path is within the target directory (no path traversal)
+     */
+    isPathWithinDirectory(filePath, directory) {
+        const normalizedFile = path.resolve(filePath);
+        const normalizedDir = path.resolve(directory);
+        return normalizedFile.startsWith(normalizedDir + path.sep) || normalizedFile === normalizedDir;
+    }
     async scan(options) {
         const { targetDir, autoFix = false, dryRun = false, ignore = [] } = options;
         // Normalize ignore list to uppercase for case-insensitive matching
@@ -223,6 +305,21 @@ class HardeningScanner {
         // Tool boundary checks
         const toolFindings = await this.checkToolBoundaries(targetDir, shouldFix);
         findings.push(...toolFindings);
+        // OpenClaw skill checks
+        const skillFindings = await this.checkOpenclawSkills(targetDir, shouldFix);
+        findings.push(...skillFindings);
+        // OpenClaw heartbeat checks
+        const heartbeatFindings = await this.checkOpenclawHeartbeat(targetDir, shouldFix);
+        findings.push(...heartbeatFindings);
+        // OpenClaw gateway checks
+        const gatewayFindings = await this.checkOpenclawGateway(targetDir, shouldFix);
+        findings.push(...gatewayFindings);
+        // OpenClaw config checks
+        const configFindings = await this.checkOpenclawConfig(targetDir, shouldFix);
+        findings.push(...configFindings);
+        // OpenClaw supply chain checks
+        const supplyFindings = await this.checkOpenclawSupplyChain(targetDir, shouldFix);
+        findings.push(...supplyFindings);
         // Filter findings to only show real, actionable issues:
         // 1. Only failed checks (passed: false)
         // 2. Only checks with a file path (concrete findings, not generic advice)
@@ -288,6 +385,46 @@ class HardeningScanner {
             platforms.push('claude-code');
         }
         catch { }
+        // OpenClaw detection
+        try {
+            await fs.access(path.join(targetDir, '.openclaw'));
+            if (!platforms.includes('openclaw')) {
+                platforms.push('openclaw');
+            }
+        }
+        catch { }
+        try {
+            await fs.access(path.join(targetDir, '.moltbot'));
+            if (!platforms.includes('openclaw')) {
+                platforms.push('openclaw');
+            }
+        }
+        catch { }
+        try {
+            await fs.access(path.join(targetDir, '.clawdbot'));
+            if (!platforms.includes('openclaw')) {
+                platforms.push('openclaw');
+            }
+        }
+        catch { }
+        // Check for openclaw.json
+        try {
+            await fs.access(path.join(targetDir, 'openclaw.json'));
+            if (!platforms.includes('openclaw')) {
+                platforms.push('openclaw');
+            }
+        }
+        catch { }
+        // Check for SKILL.md files (OpenClaw skill project)
+        try {
+            const files = await fs.readdir(targetDir);
+            if (files.some(f => f === 'SKILL.md' || f.endsWith('.skill.md'))) {
+                if (!platforms.includes('openclaw')) {
+                    platforms.push('openclaw');
+                }
+            }
+        }
+        catch { }
         if (platforms.length === 0) {
             return 'generic';
         }
@@ -297,6 +434,23 @@ class HardeningScanner {
      * Detect the project type based on package.json and project structure
      */
     async detectProjectType(targetDir) {
+        // Check for OpenClaw project indicators (check first as it's more specific)
+        const openclawIndicators = ['.openclaw', '.moltbot', '.clawdbot', 'SKILL.md', 'openclaw.json'];
+        for (const indicator of openclawIndicators) {
+            try {
+                await fs.access(path.join(targetDir, indicator));
+                return 'openclaw';
+            }
+            catch { }
+        }
+        // Check for *.skill.md files (OpenClaw skill project)
+        try {
+            const files = await fs.readdir(targetDir);
+            if (files.some(f => f.endsWith('.skill.md'))) {
+                return 'openclaw';
+            }
+        }
+        catch { }
         try {
             const pkgPath = path.join(targetDir, 'package.json');
             const content = await fs.readFile(pkgPath, 'utf-8');
@@ -3519,6 +3673,1234 @@ dist/
         // Remove the used backup
         await fs.rm(backupDir, { recursive: true, force: true });
     }
+    /**
+     * Recursively find SKILL.md and *.skill.md files
+     * Skips node_modules and limits depth to 5
+     */
+    async findSkillFiles(dir, depth = 0, rootDir) {
+        if (depth > 5) {
+            return [];
+        }
+        const baseDir = rootDir || dir;
+        const skillFiles = [];
+        try {
+            const entries = await fs.readdir(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                // Skip symlinks to prevent path traversal
+                if (entry.isSymbolicLink()) {
+                    continue;
+                }
+                const fullPath = path.join(dir, entry.name);
+                // Validate path is within directory (no path traversal)
+                if (!this.isPathWithinDirectory(fullPath, baseDir)) {
+                    continue;
+                }
+                if (entry.isDirectory()) {
+                    // Skip node_modules and hidden directories (except .openclaw, .moltbot, .clawdbot)
+                    if (entry.name === 'node_modules')
+                        continue;
+                    if (entry.name.startsWith('.') &&
+                        !['openclaw', 'moltbot', 'clawdbot'].includes(entry.name.slice(1))) {
+                        continue;
+                    }
+                    const subFiles = await this.findSkillFiles(fullPath, depth + 1, baseDir);
+                    skillFiles.push(...subFiles);
+                }
+                else if (entry.isFile()) {
+                    // Match SKILL.md or *.skill.md
+                    if (entry.name === 'SKILL.md' || entry.name.endsWith('.skill.md')) {
+                        skillFiles.push(fullPath);
+                    }
+                }
+            }
+        }
+        catch {
+            // Directory not accessible, skip
+        }
+        return skillFiles;
+    }
+    /**
+     * OpenClaw skill security checks (SKILL-001 to SKILL-006)
+     */
+    async checkOpenclawSkills(targetDir, autoFix) {
+        const findings = [];
+        const skillFiles = await this.findSkillFiles(targetDir);
+        for (const skillFile of skillFiles) {
+            const relativePath = path.relative(targetDir, skillFile);
+            let content;
+            try {
+                const stats = await fs.stat(skillFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                content = await fs.readFile(skillFile, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split('\n').map(line => line.length > MAX_LINE_LENGTH ? line.substring(0, MAX_LINE_LENGTH) : line);
+            // SKILL-001: Unsigned Skill
+            const hasSignature = content.includes('opena2a_signature:') ||
+                content.includes('-----BEGIN SIGNATURE-----');
+            findings.push({
+                checkId: 'SKILL-001',
+                name: 'Unsigned Skill',
+                description: 'Skill file lacks cryptographic signature for authenticity verification',
+                category: 'skill',
+                severity: 'medium',
+                passed: hasSignature,
+                message: hasSignature
+                    ? 'Skill has cryptographic signature'
+                    : 'Skill is unsigned - cannot verify authenticity or integrity',
+                file: relativePath,
+                fixable: false,
+                fix: 'Sign the skill using: openclaw sign skill.md --key ~/.openclaw/signing-key.pem',
+            });
+            // SKILL-002: Remote Fetch Pattern
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                for (const pattern of SKILL_REMOTE_FETCH_PATTERNS) {
+                    // Reset regex lastIndex for global patterns
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        findings.push({
+                            checkId: 'SKILL-002',
+                            name: 'Remote Fetch Pattern',
+                            description: 'Skill contains pattern that fetches and executes remote code',
+                            category: 'skill',
+                            severity: 'critical',
+                            passed: false,
+                            message: `Remote fetch pattern detected: "${line.trim().substring(0, 80)}..."`,
+                            file: relativePath,
+                            line: i + 1,
+                            fixable: false,
+                            fix: 'Remove curl|sh, wget|sh, and other remote code execution patterns',
+                        });
+                        break; // One finding per line
+                    }
+                }
+            }
+            // SKILL-003: Heartbeat Installation
+            const heartbeatPattern = /heartbeat|cron|schedule|every\s+\d+\s*(min|hour|sec)/gi;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                heartbeatPattern.lastIndex = 0;
+                if (heartbeatPattern.test(line)) {
+                    findings.push({
+                        checkId: 'SKILL-003',
+                        name: 'Heartbeat Installation',
+                        description: 'Skill attempts to install periodic/scheduled tasks',
+                        category: 'skill',
+                        severity: 'high',
+                        passed: false,
+                        message: `Heartbeat/scheduled task pattern detected: "${line.trim().substring(0, 80)}..."`,
+                        file: relativePath,
+                        line: i + 1,
+                        fixable: false,
+                        fix: 'Heartbeats should be configured separately with restricted permissions, not bundled in skills',
+                    });
+                }
+            }
+            // SKILL-004: Filesystem Write Outside Sandbox
+            const filesystemWildcardPattern = /filesystem:\s*\*|filesystem:\s*~\/\*|filesystem:\s*\//gi;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                filesystemWildcardPattern.lastIndex = 0;
+                if (filesystemWildcardPattern.test(line)) {
+                    findings.push({
+                        checkId: 'SKILL-004',
+                        name: 'Filesystem Write Outside Sandbox',
+                        description: 'Skill requests broad filesystem access outside sandbox',
+                        category: 'skill',
+                        severity: 'critical',
+                        passed: false,
+                        message: `Broad filesystem access requested: "${line.trim()}"`,
+                        file: relativePath,
+                        line: i + 1,
+                        fixable: false,
+                        fix: 'Restrict filesystem access to specific directories (e.g., filesystem:./data/*)',
+                    });
+                }
+            }
+            // SKILL-005: Credential File Access
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                for (const pattern of SKILL_CREDENTIAL_ACCESS_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        findings.push({
+                            checkId: 'SKILL-005',
+                            name: 'Credential File Access',
+                            description: 'Skill attempts to access credential or sensitive configuration files',
+                            category: 'skill',
+                            severity: 'critical',
+                            passed: false,
+                            message: `Credential file access pattern detected: "${line.trim().substring(0, 80)}..."`,
+                            file: relativePath,
+                            line: i + 1,
+                            fixable: false,
+                            fix: 'Skills should never access credential files like ~/.ssh, ~/.aws, wallets, or .env files',
+                        });
+                        break; // One finding per line per check
+                    }
+                }
+            }
+            // SKILL-006: Data Exfiltration Pattern
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                for (const pattern of SKILL_EXFILTRATION_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        findings.push({
+                            checkId: 'SKILL-006',
+                            name: 'Data Exfiltration Pattern',
+                            description: 'Skill contains patterns commonly used for data exfiltration',
+                            category: 'skill',
+                            severity: 'critical',
+                            passed: false,
+                            message: `Data exfiltration pattern detected: "${line.trim().substring(0, 80)}..."`,
+                            file: relativePath,
+                            line: i + 1,
+                            fixable: false,
+                            fix: 'Remove webhook.site, requestbin, ngrok, and suspicious POST patterns',
+                        });
+                        break; // One finding per line per check
+                    }
+                }
+            }
+            // SKILL-007: ClickFix Social Engineering
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                for (const pattern of SKILL_CLICKFIX_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        findings.push({
+                            checkId: 'SKILL-007',
+                            name: 'ClickFix Social Engineering',
+                            description: 'Skill uses social engineering tactics to trick users into running commands',
+                            category: 'skill',
+                            severity: 'critical',
+                            passed: false,
+                            message: `ClickFix social engineering pattern detected: "${line.trim().substring(0, 80)}..."`,
+                            file: relativePath,
+                            line: i + 1,
+                            fixable: false,
+                            fix: 'Remove social engineering instructions that trick users into copying/pasting commands',
+                        });
+                        break; // One finding per line per check
+                    }
+                }
+            }
+            // SKILL-008: Reverse Shell Pattern
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                for (const pattern of SKILL_REVERSE_SHELL_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    if (pattern.test(line)) {
+                        findings.push({
+                            checkId: 'SKILL-008',
+                            name: 'Reverse Shell Pattern',
+                            description: 'Skill contains patterns commonly used to establish reverse shells',
+                            category: 'skill',
+                            severity: 'critical',
+                            passed: false,
+                            message: `Reverse shell pattern detected: "${line.trim().substring(0, 80)}..."`,
+                            file: relativePath,
+                            line: i + 1,
+                            fixable: false,
+                            fix: 'Remove netcat, bash -i, /dev/tcp, and other reverse shell patterns',
+                        });
+                        break; // One finding per line per check
+                    }
+                }
+            }
+            // SKILL-009: Typosquatting Name
+            const popularSkills = [
+                'filesystem',
+                'github',
+                'slack',
+                'discord',
+                'postgres',
+                'sqlite',
+                'fetch',
+                'browser',
+                'puppeteer',
+                'playwright',
+            ];
+            const skillBasename = path.basename(skillFile, path.extname(skillFile)).toLowerCase();
+            for (const popular of popularSkills) {
+                if (skillBasename !== popular && this.levenshteinDistance(skillBasename, popular) <= 2) {
+                    findings.push({
+                        checkId: 'SKILL-009',
+                        name: 'Typosquatting Name',
+                        description: 'Skill name is suspiciously similar to a popular skill (potential typosquatting)',
+                        category: 'skill',
+                        severity: 'high',
+                        passed: false,
+                        message: `Skill name "${skillBasename}" is similar to popular skill "${popular}" (potential typosquatting)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Rename the skill to avoid confusion with popular skills, or verify this is intentional',
+                    });
+                    break; // One typosquatting finding per skill file
+                }
+            }
+            // SKILL-010: Env File Exfiltration
+            const envFilePattern = /\.env|dotenv|process\.env|environ|getenv/gi;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                envFilePattern.lastIndex = 0;
+                if (envFilePattern.test(line)) {
+                    findings.push({
+                        checkId: 'SKILL-010',
+                        name: 'Env File Exfiltration',
+                        description: 'Skill attempts to access environment files or variables',
+                        category: 'skill',
+                        severity: 'critical',
+                        passed: false,
+                        message: `Environment file/variable access detected: "${line.trim().substring(0, 80)}..."`,
+                        file: relativePath,
+                        line: i + 1,
+                        fixable: false,
+                        fix: 'Skills should not access .env files or environment variables containing secrets',
+                    });
+                }
+            }
+            // SKILL-011: Browser Data Access
+            const browserDataPattern = /chrome|firefox|cookies|localStorage|sessionStorage|browser.*data|chromium|safari.*cookies/gi;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                browserDataPattern.lastIndex = 0;
+                if (browserDataPattern.test(line)) {
+                    findings.push({
+                        checkId: 'SKILL-011',
+                        name: 'Browser Data Access',
+                        description: 'Skill attempts to access browser data, cookies, or local storage',
+                        category: 'skill',
+                        severity: 'critical',
+                        passed: false,
+                        message: `Browser data access pattern detected: "${line.trim().substring(0, 80)}..."`,
+                        file: relativePath,
+                        line: i + 1,
+                        fixable: false,
+                        fix: 'Skills should not access browser data, cookies, localStorage, or sessionStorage',
+                    });
+                }
+            }
+            // SKILL-012: Crypto Wallet Access
+            const cryptoWalletPattern = /wallet|solana|phantom|metamask|ledger|seed\s*phrase|mnemonic|\.sol\b|\.eth\b|private\s*key/gi;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                cryptoWalletPattern.lastIndex = 0;
+                if (cryptoWalletPattern.test(line)) {
+                    findings.push({
+                        checkId: 'SKILL-012',
+                        name: 'Crypto Wallet Access',
+                        description: 'Skill attempts to access cryptocurrency wallets or seed phrases',
+                        category: 'skill',
+                        severity: 'critical',
+                        passed: false,
+                        message: `Crypto wallet access pattern detected: "${line.trim().substring(0, 80)}..."`,
+                        file: relativePath,
+                        line: i + 1,
+                        fixable: false,
+                        fix: 'Skills should never access cryptocurrency wallets, seed phrases, or private keys',
+                    });
+                }
+            }
+        }
+        return findings;
+    }
+    /**
+     * Recursively find HEARTBEAT.md and *.heartbeat.md files
+     * Skips node_modules and limits depth to 5
+     */
+    async findHeartbeatFiles(dir, depth = 0, rootDir) {
+        if (depth > 5) {
+            return [];
+        }
+        const baseDir = rootDir || dir;
+        const heartbeatFiles = [];
+        try {
+            const entries = await fs.readdir(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                // Skip symlinks to prevent path traversal
+                if (entry.isSymbolicLink()) {
+                    continue;
+                }
+                const fullPath = path.join(dir, entry.name);
+                // Validate path is within directory (no path traversal)
+                if (!this.isPathWithinDirectory(fullPath, baseDir)) {
+                    continue;
+                }
+                if (entry.isDirectory()) {
+                    // Skip node_modules and hidden directories (except .openclaw, .moltbot, .clawdbot)
+                    if (entry.name === 'node_modules')
+                        continue;
+                    if (entry.name.startsWith('.') &&
+                        !['openclaw', 'moltbot', 'clawdbot'].includes(entry.name.slice(1))) {
+                        continue;
+                    }
+                    const subFiles = await this.findHeartbeatFiles(fullPath, depth + 1, baseDir);
+                    heartbeatFiles.push(...subFiles);
+                }
+                else if (entry.isFile()) {
+                    // Match HEARTBEAT.md or *.heartbeat.md
+                    if (entry.name === 'HEARTBEAT.md' || entry.name.endsWith('.heartbeat.md')) {
+                        heartbeatFiles.push(fullPath);
+                    }
+                }
+            }
+        }
+        catch {
+            // Directory not accessible, skip
+        }
+        return heartbeatFiles;
+    }
+    /**
+     * OpenClaw heartbeat security checks (HEARTBEAT-001 to HEARTBEAT-006)
+     */
+    async checkOpenclawHeartbeat(targetDir, autoFix) {
+        const findings = [];
+        const heartbeatFiles = await this.findHeartbeatFiles(targetDir);
+        for (const heartbeatFile of heartbeatFiles) {
+            const relativePath = path.relative(targetDir, heartbeatFile);
+            let content;
+            try {
+                const stats = await fs.stat(heartbeatFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                content = await fs.readFile(heartbeatFile, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split('\n').map(line => line.length > MAX_LINE_LENGTH ? line.substring(0, MAX_LINE_LENGTH) : line);
+            // HEARTBEAT-001: Unverified Heartbeat URL
+            const urlPattern = /https?:\/\/[^\s]+/gi;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                urlPattern.lastIndex = 0;
+                const match = urlPattern.exec(line);
+                if (match) {
+                    findings.push({
+                        checkId: 'HEARTBEAT-001',
+                        name: 'Unverified Heartbeat URL',
+                        description: 'Heartbeat contacts external URL without verification',
+                        category: 'heartbeat',
+                        severity: 'critical',
+                        passed: false,
+                        message: `External URL detected in heartbeat: "${match[0].substring(0, 60)}..."`,
+                        file: relativePath,
+                        line: i + 1,
+                        fixable: false,
+                        fix: 'Verify the URL is from a trusted source and add hash pinning for integrity',
+                    });
+                }
+            }
+            // HEARTBEAT-002: No Hash Pinning
+            const hasHashPinning = content.includes('pinned_hash:') ||
+                content.includes('sha256:') ||
+                content.includes('hash:');
+            findings.push({
+                checkId: 'HEARTBEAT-002',
+                name: 'No Hash Pinning',
+                description: 'Heartbeat lacks hash pinning for content integrity verification',
+                category: 'heartbeat',
+                severity: 'high',
+                passed: hasHashPinning,
+                message: hasHashPinning
+                    ? 'Heartbeat has hash pinning for integrity verification'
+                    : 'Heartbeat lacks hash pinning - content integrity cannot be verified',
+                file: relativePath,
+                fixable: false,
+                fix: 'Add pinned_hash: sha256:<hash> to verify heartbeat content integrity',
+            });
+            // HEARTBEAT-003: Unsigned Heartbeat
+            const hasSignature = content.includes('opena2a_signature:') ||
+                content.includes('signature:') ||
+                content.includes('-----BEGIN SIGNATURE-----');
+            findings.push({
+                checkId: 'HEARTBEAT-003',
+                name: 'Unsigned Heartbeat',
+                description: 'Heartbeat file lacks cryptographic signature',
+                category: 'heartbeat',
+                severity: 'high',
+                passed: hasSignature,
+                message: hasSignature
+                    ? 'Heartbeat has cryptographic signature'
+                    : 'Heartbeat is unsigned - cannot verify authenticity or integrity',
+                file: relativePath,
+                fixable: false,
+                fix: 'Sign the heartbeat using: openclaw sign heartbeat.md --key ~/.openclaw/signing-key.pem',
+            });
+            // HEARTBEAT-004: Dangerous Capabilities
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i].toLowerCase();
+                for (const cap of HEARTBEAT_DANGEROUS_CAPS) {
+                    if (line.includes(cap.toLowerCase())) {
+                        findings.push({
+                            checkId: 'HEARTBEAT-004',
+                            name: 'Dangerous Capabilities',
+                            description: 'Heartbeat requests dangerous capabilities',
+                            category: 'heartbeat',
+                            severity: 'critical',
+                            passed: false,
+                            message: `Dangerous capability "${cap}" detected in heartbeat`,
+                            file: relativePath,
+                            line: i + 1,
+                            fixable: false,
+                            fix: 'Heartbeats should use minimal capabilities - avoid shell:*, filesystem:*, network:*',
+                        });
+                    }
+                }
+            }
+            // HEARTBEAT-005: Excessive Frequency
+            // Match both "every: 30s" and "Every 30 minutes:" formats
+            const frequencyPattern = /every[:\s]+(\d+)\s*(s|sec|seconds?|m|min|minutes?|h|hours?)/gi;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                frequencyPattern.lastIndex = 0;
+                const match = frequencyPattern.exec(line);
+                if (match) {
+                    const value = parseInt(match[1], 10);
+                    const unit = match[2].toLowerCase();
+                    // Calculate interval in minutes
+                    let intervalMinutes = value;
+                    if (unit.startsWith('s')) {
+                        intervalMinutes = value / 60;
+                    }
+                    else if (unit.startsWith('h')) {
+                        intervalMinutes = value * 60;
+                    }
+                    if (intervalMinutes < 5) {
+                        findings.push({
+                            checkId: 'HEARTBEAT-005',
+                            name: 'Excessive Frequency',
+                            description: 'Heartbeat runs too frequently (< 5 minutes)',
+                            category: 'heartbeat',
+                            severity: 'medium',
+                            passed: false,
+                            message: `Heartbeat interval of ${value}${unit} is less than 5 minutes`,
+                            file: relativePath,
+                            line: i + 1,
+                            fixable: false,
+                            fix: 'Increase heartbeat interval to at least 5 minutes to prevent resource exhaustion',
+                        });
+                    }
+                }
+            }
+            // HEARTBEAT-006: No Active Hours Limit
+            const hasActiveHours = /activeHours:/i.test(content) ||
+                /schedule:/i.test(content) ||
+                /time_window:/i.test(content) ||
+                /run_between:/i.test(content);
+            findings.push({
+                checkId: 'HEARTBEAT-006',
+                name: 'No Active Hours Limit',
+                description: 'Heartbeat lacks time-of-day restrictions',
+                category: 'heartbeat',
+                severity: 'medium',
+                passed: hasActiveHours,
+                message: hasActiveHours
+                    ? 'Heartbeat has active hours restriction'
+                    : 'Heartbeat can run 24/7 without time restrictions',
+                file: relativePath,
+                fixable: false,
+                fix: 'Add activeHours: or schedule: to limit when the heartbeat can run',
+            });
+        }
+        return findings;
+    }
+    /**
+     * Find OpenClaw gateway configuration files
+     */
+    async findGatewayConfigFiles(dir) {
+        const configFiles = [];
+        const candidates = [
+            'openclaw.json',
+            '.openclaw/config.json',
+            'moltbot.json',
+            '.moltbot/config.json',
+        ];
+        for (const candidate of candidates) {
+            const fullPath = path.join(dir, candidate);
+            try {
+                // Validate path is within directory (no path traversal)
+                if (!this.isPathWithinDirectory(fullPath, dir)) {
+                    continue;
+                }
+                // Check if it's a symlink
+                const stats = await fs.lstat(fullPath);
+                if (stats.isSymbolicLink()) {
+                    continue; // Skip symlinks to prevent path traversal
+                }
+                await fs.access(fullPath);
+                configFiles.push(fullPath);
+            }
+            catch {
+                // File doesn't exist
+            }
+        }
+        return configFiles;
+    }
+    /**
+     * OpenClaw gateway security checks (GATEWAY-001 to GATEWAY-006)
+     */
+    async checkOpenclawGateway(targetDir, autoFix) {
+        const findings = [];
+        const configFiles = await this.findGatewayConfigFiles(targetDir);
+        for (const configFile of configFiles) {
+            const relativePath = path.relative(targetDir, configFile);
+            let content;
+            let config;
+            try {
+                const stats = await fs.stat(configFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                content = await fs.readFile(configFile, 'utf-8');
+                config = JSON.parse(content);
+            }
+            catch {
+                continue;
+            }
+            // GATEWAY-001: Bound to 0.0.0.0
+            const gateway = config.gateway;
+            if (gateway && gateway.host === '0.0.0.0') {
+                findings.push({
+                    checkId: 'GATEWAY-001',
+                    name: 'Bound to 0.0.0.0',
+                    description: 'Gateway is bound to all interfaces (0.0.0.0)',
+                    category: 'gateway',
+                    severity: 'critical',
+                    passed: false,
+                    message: 'Gateway host is 0.0.0.0 - accessible from any network interface',
+                    file: relativePath,
+                    fixable: false,
+                    fix: 'Bind to 127.0.0.1 for local-only access or specific interface IP',
+                });
+            }
+            // GATEWAY-002: Missing WebSocket Origin Validation
+            const security = config.security;
+            const hasWebSocketOrigins = security && security.websocketOrigins;
+            findings.push({
+                checkId: 'GATEWAY-002',
+                name: 'Missing WebSocket Origin Validation',
+                description: 'Gateway lacks WebSocket origin validation (GHSA-g8p2)',
+                category: 'gateway',
+                severity: 'critical',
+                passed: Boolean(hasWebSocketOrigins),
+                message: hasWebSocketOrigins
+                    ? 'WebSocket origin validation is configured'
+                    : 'Missing security.websocketOrigins - vulnerable to GHSA-g8p2 cross-origin attacks',
+                file: relativePath,
+                fixable: false,
+                fix: 'Add security.websocketOrigins array with allowed origins',
+            });
+            // GATEWAY-003: Token Exposed in Config
+            const gatewayAuth = gateway?.auth;
+            const hasPlaintextToken = (gatewayAuth && typeof gatewayAuth.token === 'string' && gatewayAuth.token.length > 0) ||
+                (typeof config.token === 'string' && config.token.length > 0);
+            if (hasPlaintextToken) {
+                findings.push({
+                    checkId: 'GATEWAY-003',
+                    name: 'Token Exposed in Config',
+                    description: 'Plaintext authentication token stored in configuration file',
+                    category: 'gateway',
+                    severity: 'critical',
+                    passed: false,
+                    message: 'Plaintext token found in configuration - use environment variables instead',
+                    file: relativePath,
+                    fixable: false,
+                    fix: 'Move tokens to environment variables: OPENCLAW_AUTH_TOKEN',
+                });
+            }
+            // GATEWAY-004: Approval Confirmations Disabled
+            const exec = config.exec;
+            const approvals = exec?.approvals;
+            const configApprovals = config.approvals;
+            const approvalsDisabled = approvals?.set === 'off' ||
+                approvals?.enabled === false ||
+                configApprovals?.enabled === false;
+            if (approvalsDisabled) {
+                findings.push({
+                    checkId: 'GATEWAY-004',
+                    name: 'Approval Confirmations Disabled',
+                    description: 'Execution approval confirmations are disabled',
+                    category: 'gateway',
+                    severity: 'critical',
+                    passed: false,
+                    message: 'Approval confirmations disabled - commands execute without user confirmation',
+                    file: relativePath,
+                    fixable: false,
+                    fix: 'Enable approvals: exec.approvals.set = "on" or approvals.enabled = true',
+                });
+            }
+            // GATEWAY-005: Sandbox Disabled
+            const sandbox = config.sandbox;
+            if (sandbox && sandbox.enabled === false) {
+                findings.push({
+                    checkId: 'GATEWAY-005',
+                    name: 'Sandbox Disabled',
+                    description: 'Sandbox execution environment is disabled',
+                    category: 'gateway',
+                    severity: 'critical',
+                    passed: false,
+                    message: 'Sandbox is disabled - code executes with full system access',
+                    file: relativePath,
+                    fixable: false,
+                    fix: 'Enable sandbox: sandbox.enabled = true',
+                });
+            }
+            // GATEWAY-006: Container Escape Risk
+            const docker = config.docker;
+            const isPrivileged = docker?.privileged === true;
+            const mounts = docker?.mounts;
+            const hasDangerousMounts = mounts?.some((mount) => mount.includes('/var/run/docker.sock') ||
+                mount.includes('/etc/passwd') ||
+                mount.includes('/etc/shadow') ||
+                mount.startsWith('/:/') ||
+                mount.includes(':/host'));
+            if (isPrivileged || hasDangerousMounts) {
+                const issues = [];
+                if (isPrivileged)
+                    issues.push('privileged mode');
+                if (hasDangerousMounts)
+                    issues.push('sensitive host mounts');
+                findings.push({
+                    checkId: 'GATEWAY-006',
+                    name: 'Container Escape Risk',
+                    description: 'Docker configuration allows container escape',
+                    category: 'gateway',
+                    severity: 'critical',
+                    passed: false,
+                    message: `Container escape risk: ${issues.join(', ')}`,
+                    file: relativePath,
+                    fixable: false,
+                    fix: 'Disable privileged mode and remove sensitive host mounts',
+                });
+            }
+        }
+        return findings;
+    }
+    /**
+     * Calculate Levenshtein distance between two strings
+     */
+    levenshteinDistance(a, b) {
+        const matrix = [];
+        for (let i = 0; i <= b.length; i++) {
+            matrix[i] = [i];
+        }
+        for (let j = 0; j <= a.length; j++) {
+            matrix[0][j] = j;
+        }
+        for (let i = 1; i <= b.length; i++) {
+            for (let j = 1; j <= a.length; j++) {
+                if (b.charAt(i - 1) === a.charAt(j - 1)) {
+                    matrix[i][j] = matrix[i - 1][j - 1];
+                }
+                else {
+                    matrix[i][j] = Math.min(matrix[i - 1][j - 1] + 1, matrix[i][j - 1] + 1, matrix[i - 1][j] + 1);
+                }
+            }
+        }
+        return matrix[b.length][a.length];
+    }
+    /**
+     * Find files matching a pattern recursively (max depth 3, skips node_modules/.git)
+     */
+    async findFilesMatching(targetDir, patterns, maxDepth = 3) {
+        const matchedFiles = [];
+        const scanDir = async (dir, currentDepth) => {
+            if (currentDepth > maxDepth)
+                return;
+            let entries;
+            try {
+                entries = await fs.readdir(dir, { withFileTypes: true });
+            }
+            catch {
+                return;
+            }
+            for (const entry of entries) {
+                // Skip symlinks to prevent path traversal
+                if (entry.isSymbolicLink()) {
+                    continue;
+                }
+                const entryName = entry.name;
+                const fullPath = path.join(dir, entryName);
+                // Validate path is within directory (no path traversal)
+                if (!this.isPathWithinDirectory(fullPath, targetDir)) {
+                    continue;
+                }
+                // Skip node_modules and .git directories
+                if (entryName === 'node_modules' || entryName === '.git') {
+                    continue;
+                }
+                let stat;
+                try {
+                    stat = await fs.stat(fullPath);
+                }
+                catch {
+                    continue;
+                }
+                if (stat.isDirectory()) {
+                    await scanDir(fullPath, currentDepth + 1);
+                }
+                else if (stat.isFile()) {
+                    // Check if filename matches any pattern
+                    const lowerName = entryName.toLowerCase();
+                    for (const pattern of patterns) {
+                        if (lowerName.includes(pattern.toLowerCase())) {
+                            matchedFiles.push(fullPath);
+                            break;
+                        }
+                    }
+                }
+            }
+        };
+        await scanDir(targetDir, 0);
+        return matchedFiles;
+    }
+    /**
+     * OpenClaw config security checks (CONFIG-001 to CONFIG-006)
+     */
+    async checkOpenclawConfig(targetDir, autoFix) {
+        const findings = [];
+        // CONFIG-001: Session File Exposure
+        const sessionPatterns = [
+            'whatsapp-session',
+            'discord-token',
+            'telegram-session',
+            'slack-token',
+            'session.json',
+        ];
+        const sessionFiles = await this.findFilesMatching(targetDir, sessionPatterns);
+        for (const sessionFile of sessionFiles) {
+            const relativePath = path.relative(targetDir, sessionFile);
+            findings.push({
+                checkId: 'CONFIG-001',
+                name: 'Session File Exposure',
+                description: 'Session/token file found that may contain sensitive credentials',
+                category: 'config',
+                severity: 'critical',
+                passed: false,
+                message: `Session/token file exposed: ${path.basename(sessionFile)}`,
+                file: relativePath,
+                fixable: false,
+                fix: 'Move session files outside the project directory or add to .gitignore',
+            });
+        }
+        // CONFIG-002: SOUL.md Injection Vectors
+        const soulFiles = await this.findFilesMatching(targetDir, ['SOUL.md']);
+        for (const soulFile of soulFiles) {
+            const relativePath = path.relative(targetDir, soulFile);
+            let content;
+            try {
+                const stats = await fs.stat(soulFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                content = await fs.readFile(soulFile, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            for (const pattern of PROMPT_INJECTION_PATTERNS) {
+                const match = content.match(pattern);
+                if (match) {
+                    findings.push({
+                        checkId: 'CONFIG-002',
+                        name: 'SOUL.md Injection Vectors',
+                        description: 'SOUL.md contains potential prompt injection patterns',
+                        category: 'config',
+                        severity: 'high',
+                        passed: false,
+                        message: `Prompt injection pattern detected: "${match[0]}"`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Review and remove suspicious patterns from SOUL.md',
+                    });
+                    break; // Only report first match per file
+                }
+            }
+        }
+        // CONFIG-003: Daemon Running as Root
+        const daemonPatterns = ['daemon.sh', 'start.sh', 'run.sh'];
+        const daemonFiles = await this.findFilesMatching(targetDir, daemonPatterns);
+        const rootPatterns = [/\bsudo\b/gi, /User=root/gi, /uid=0/gi];
+        for (const daemonFile of daemonFiles) {
+            const relativePath = path.relative(targetDir, daemonFile);
+            let content;
+            try {
+                const stats = await fs.stat(daemonFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                content = await fs.readFile(daemonFile, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            for (const pattern of rootPatterns) {
+                const match = content.match(pattern);
+                if (match) {
+                    findings.push({
+                        checkId: 'CONFIG-003',
+                        name: 'Daemon Running as Root',
+                        description: 'Daemon script runs with root privileges',
+                        category: 'config',
+                        severity: 'critical',
+                        passed: false,
+                        message: `Root privilege pattern found: "${match[0]}"`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Run daemon as non-root user with minimal privileges',
+                    });
+                    break; // Only report first match per file
+                }
+            }
+        }
+        // CONFIG-004: Plaintext API Keys
+        const envFiles = await this.findFilesMatching(targetDir, ['.env']);
+        for (const envFile of envFiles) {
+            const relativePath = path.relative(targetDir, envFile);
+            let content;
+            try {
+                const stats = await fs.stat(envFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                content = await fs.readFile(envFile, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            for (const { name, pattern } of CREDENTIAL_PATTERNS) {
+                const match = content.match(pattern);
+                if (match) {
+                    findings.push({
+                        checkId: 'CONFIG-004',
+                        name: 'Plaintext API Keys',
+                        description: 'Plaintext API key found in environment file',
+                        category: 'config',
+                        severity: 'critical',
+                        passed: false,
+                        message: `${name} found in plaintext`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Use a secrets manager or ensure .env is in .gitignore',
+                    });
+                    break; // Only report first match per file
+                }
+            }
+        }
+        // CONFIG-005: Memory Poisoning Patterns
+        const memoryFiles = await this.findFilesMatching(targetDir, ['memory.json']);
+        const memoryPoisonPatterns = [
+            ...PROMPT_INJECTION_PATTERNS,
+            /\bbase64\b/gi,
+            /\beval\s*\(/gi,
+            /\bexec\s*\(/gi,
+        ];
+        for (const memoryFile of memoryFiles) {
+            const relativePath = path.relative(targetDir, memoryFile);
+            let content;
+            try {
+                const stats = await fs.stat(memoryFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                content = await fs.readFile(memoryFile, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            for (const pattern of memoryPoisonPatterns) {
+                const match = content.match(pattern);
+                if (match) {
+                    findings.push({
+                        checkId: 'CONFIG-005',
+                        name: 'Memory Poisoning Patterns',
+                        description: 'memory.json contains suspicious patterns that could poison agent memory',
+                        category: 'config',
+                        severity: 'high',
+                        passed: false,
+                        message: `Suspicious pattern in memory: "${match[0]}"`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Review and sanitize memory.json contents',
+                    });
+                    break; // Only report first match per file
+                }
+            }
+        }
+        // CONFIG-006: Moltbook Integration Risk
+        const openclawConfigFiles = await this.findFilesMatching(targetDir, ['openclaw.json']);
+        for (const configFile of openclawConfigFiles) {
+            const relativePath = path.relative(targetDir, configFile);
+            let config;
+            try {
+                const stats = await fs.stat(configFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                const content = await fs.readFile(configFile, 'utf-8');
+                config = JSON.parse(content);
+            }
+            catch {
+                continue;
+            }
+            const moltbook = config.moltbook;
+            if (moltbook && moltbook.enabled === true && moltbook.autoFollow === true) {
+                findings.push({
+                    checkId: 'CONFIG-006',
+                    name: 'Moltbook Integration Risk',
+                    description: 'Moltbook auto-follow enabled, allowing automatic following of untrusted agents',
+                    category: 'config',
+                    severity: 'high',
+                    passed: false,
+                    message: 'Moltbook enabled with autoFollow - may auto-follow untrusted agents',
+                    file: relativePath,
+                    fixable: false,
+                    fix: 'Disable autoFollow or review moltbook security settings',
+                });
+            }
+        }
+        return findings;
+    }
+    /**
+     * OpenClaw supply chain security checks (SUPPLY-001 to SUPPLY-004)
+     */
+    async checkOpenclawSupplyChain(targetDir, autoFix) {
+        const findings = [];
+        const skillFiles = await this.findSkillFiles(targetDir);
+        // Known malicious skill patterns from ClawHavoc campaign
+        const clawHavocPatterns = [
+            'polymarket',
+            'better-polymarket',
+            'crypto-tracker',
+            'solana-tracker',
+            'phantom-wallet',
+            'youtube-downloader',
+            'clawhub',
+        ];
+        for (const skillFile of skillFiles) {
+            const relativePath = path.relative(targetDir, skillFile);
+            let content;
+            try {
+                const stats = await fs.stat(skillFile);
+                if (stats.size > MAX_FILE_SIZE) {
+                    findings.push({
+                        checkId: 'SCAN-001',
+                        name: 'Oversized File',
+                        description: 'File exceeds maximum scan size',
+                        category: 'scan',
+                        severity: 'medium',
+                        passed: false,
+                        message: `File ${relativePath} is ${Math.round(stats.size / 1024 / 1024)}MB - skipped (max ${MAX_FILE_SIZE / 1024 / 1024}MB)`,
+                        file: relativePath,
+                        fixable: false,
+                        fix: 'Reduce file size or exclude from scan',
+                    });
+                    continue;
+                }
+                content = await fs.readFile(skillFile, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            // Parse YAML frontmatter
+            const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
+            const frontmatter = frontmatterMatch ? frontmatterMatch[1] : '';
+            // Extract skill name from filename or frontmatter
+            const skillNameMatch = frontmatter.match(/^name:\s*(.+)$/m);
+            const skillName = skillNameMatch
+                ? skillNameMatch[1].trim().replace(/["']/g, '').toLowerCase()
+                : path.basename(path.dirname(skillFile)).toLowerCase();
+            // SUPPLY-001: Unverified Publisher
+            const hasPublisher = /^publisher:\s*.+$/m.test(frontmatter);
+            const hasPublisherVerified = /^publisher_verified:\s*true$/m.test(frontmatter);
+            findings.push({
+                checkId: 'SUPPLY-001',
+                name: 'Unverified Publisher',
+                description: 'Skill publisher identity has not been verified',
+                category: 'supply',
+                severity: 'high',
+                passed: hasPublisher && hasPublisherVerified,
+                message: hasPublisher && hasPublisherVerified
+                    ? 'Skill publisher is verified'
+                    : hasPublisher
+                        ? 'Skill has publisher but publisher_verified is not true'
+                        : 'Skill lacks publisher metadata - cannot verify source',
+                file: relativePath,
+                fixable: false,
+                fix: 'Add publisher: and publisher_verified: true to skill frontmatter after verification',
+            });
+            // SUPPLY-002: Skill Not in Registry
+            const hasRegistryAttestation = /^registry_attestation:\s*.+$/m.test(frontmatter);
+            findings.push({
+                checkId: 'SUPPLY-002',
+                name: 'Skill Not in Registry',
+                description: 'Skill has not been registered with a trusted skill registry',
+                category: 'supply',
+                severity: 'medium',
+                passed: hasRegistryAttestation,
+                message: hasRegistryAttestation
+                    ? 'Skill has registry attestation'
+                    : 'Skill lacks registry_attestation - not listed in trusted registry',
+                file: relativePath,
+                fixable: false,
+                fix: 'Register skill with a trusted registry (e.g., clawhub.io, skillregistry.openclaw.org)',
+            });
+            // SUPPLY-003: Known Malicious Skill Pattern (ClawHavoc campaign)
+            let isMaliciousMatch = false;
+            let matchedPattern = '';
+            for (const pattern of clawHavocPatterns) {
+                // Check for exact match or substring
+                if (skillName.includes(pattern)) {
+                    isMaliciousMatch = true;
+                    matchedPattern = pattern;
+                    break;
+                }
+                // Check for typosquatting (Levenshtein distance <= 1)
+                const distance = this.levenshteinDistance(skillName, pattern);
+                if (distance <= 1 && distance > 0) {
+                    isMaliciousMatch = true;
+                    matchedPattern = `${skillName} (similar to ${pattern})`;
+                    break;
+                }
+            }
+            if (isMaliciousMatch) {
+                findings.push({
+                    checkId: 'SUPPLY-003',
+                    name: 'Known Malicious Skill Pattern',
+                    description: 'Skill matches known malicious patterns from ClawHavoc campaign',
+                    category: 'supply',
+                    severity: 'critical',
+                    passed: false,
+                    message: `Skill matches known malicious pattern: "${matchedPattern}"`,
+                    file: relativePath,
+                    fixable: false,
+                    fix: 'Remove this skill immediately - it matches known malware from the ClawHavoc campaign',
+                });
+            }
+            // SUPPLY-004: Version Drift Detection
+            const hasInstalledHash = /^installed_hash:\s*.+$/m.test(frontmatter);
+            findings.push({
+                checkId: 'SUPPLY-004',
+                name: 'Version Drift Detection',
+                description: 'Skill lacks installed_hash for detecting unauthorized modifications',
+                category: 'supply',
+                severity: 'high',
+                passed: hasInstalledHash,
+                message: hasInstalledHash
+                    ? 'Skill has installed_hash for integrity verification'
+                    : 'Skill lacks installed_hash - cannot detect version drift or tampering',
+                file: relativePath,
+                fixable: false,
+                fix: 'Add installed_hash: with SHA-256 hash of the original skill content',
+            });
+        }
+        return findings;
+    }
 }
 exports.HardeningScanner = HardeningScanner;
 // Files that may be created or modified during auto-fix