OpenClaw Security Action

GitHub Action that scans agent skills for security issues on every PR.

What It Scans

Scanner	What It Catches
sentry	API keys, tokens, passwords, credentials in code
bastion	Prompt injection markers, shell injection patterns
egress	Suspicious network calls, data exfiltration patterns

Quick Start

Add to .github/workflows/security.yml:

name: Security Scan
on:
  pull_request:
    paths:
      - 'skills/**'
      - '.openclaw/**'
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: AtlasPA/openclaw-action@v1
        with:
          workspace: '.'
          fail-on-findings: 'true'

Inputs

Input	Default	Description
`workspace`	`.`	Path to scan
`fail-on-findings`	`true`	Fail the check if issues found
`scan-secrets`	`true`	Enable secret scanning
`scan-injection`	`true`	Enable injection scanning
`scan-egress`	`true`	Enable egress scanning

Outputs

Output	Description
`findings-count`	Total number of issues found
`has-critical`	`true` if critical/high severity issues

Philosophy

This action detects and alerts only. It will: - Flag security issues in PR checks - Annotate specific lines with findings - Generate a summary report

It will NOT: - Automatically modify your code - Quarantine or delete files - Make any changes to your repository

For automated remediation, see OpenClaw Pro.

Requirements

Python 3.8+ (auto-installed by action)
No external dependencies