Security scanning skill for AI coding agents checks deployments automatically
A developer has built a security scanning skill for AI coding agents that automatically checks deployments for common vulnerabilities. The skill was created after the developer repeatedly found exposed .env files and open ports in applications after their agent deployed them.
How it works
The skill file allows AI coding agents to check their own deployments automatically. It runs a scan after every deploy, looking for several specific security issues:
- Exposed secrets (specifically mentioned: .env files)
- Open database ports
- Missing security headers
- Leaked source code
The scan takes approximately 30 seconds to complete. The developer notes this is a proactive measure to catch security issues immediately after deployment rather than discovering them later.
Availability and discussion
The skill has been published on ClawHub at https://clawhub.ai/doureios39/preflyt. The developer is asking the community if others have built similar security-related skills for their AI coding agents.
This type of automated security scanning is particularly relevant for AI coding agents, which can rapidly deploy applications but may not have built-in security validation. Automated post-deployment checks can help catch common misconfigurations before they become security incidents.
📖 Read the full source: r/clawdbot
👀 See Also
vllm-mlx fork adds tool calling and prompt cache for local AI coding agents
A developer has modified vllm-mlx to fix tool calling issues and add prompt caching, reducing TTFT from 28s to 0.3s for OpenClaw on Apple Silicon. The fork supports Qwen3-Coder-Next at 65 tok/s on M3 Ultra with working function calling.
OpenClaw Skill for Local Meeting Transcription with Whisper
A new OpenClaw skill called ghostmeet provides local meeting transcription using Whisper. It captures audio from browser tabs via a Chrome Extension and can generate summaries using Claude, with all audio and transcription processed locally on your machine.
GrapeRoot Pro Adds Undo Shield to Prevent Claude Code from Deleting Your Project
After Reddit reports of Claude Code deleting entire projects, GrapeRoot Pro introduces an Undo Shield that watches Claude's session graph and blocks destructive commands like rm -rf on heavily edited files.
Manifest Adds Support for MiniMax Token Plans with M2.7 Model
Manifest, an open source routing layer for OpenClaw, now supports MiniMax token plans starting at $10/month. The new MiniMax M2.7 model is specifically trained for OpenClaw workflows and scores 62.7 on MM-ClawBench and 56.2 on SWE-Bench Pro.