Openclaw Audit Watchdog

# Exclude local caches and build outputs from ClawHub upload
.DS_Store
.git/
__pycache__/
*.pyc
*.pyo
*.egg-info/
dist/
build/
.env
.venv/
.cache/

# Exclude local test harness files from published payloads.
test/

{
  "suppressions": [
    {
      "checkId": "skills.code_safety",
      "skill": "clawsec-suite",
      "reason": "First-party security tooling, reviewed 2026-02-13",
      "suppressedAt": "2026-02-13"
    },
    {
      "checkId": "skills.code_safety",
      "skill": "openclaw-audit-watchdog",
      "reason": "First-party security tooling, reviewed 2026-02-13",
      "suppressedAt": "2026-02-13"
    }
  ]
}

#!/usr/bin/env bash
set -euo pipefail

# Run a Codex CLI code review for this skill.
# Safe by default: read-only sandbox.

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

if [[ -n "${CODEX_BIN:-}" ]]; then
  RESOLVED_CODEX_BIN="$CODEX_BIN"
elif command -v codex >/dev/null 2>&1; then
  RESOLVED_CODEX_BIN="$(command -v codex)"
elif [[ -x "/opt/homebrew/bin/codex" ]]; then
  RESOLVED_CODEX_BIN="/opt/homebrew/bin/codex"
else
  echo "codex CLI not found. Install Codex CLI and ensure 'codex' is in PATH." >&2
  exit 127
fi

# Use GPT-5.1 Codex Max (high reasoning). Note: some models (e.g. o3) may be blocked
# depending on the account type.
exec "$RESOLVED_CODEX_BIN" review -s read-only -m gpt-5.1-codex-max \
  "Review this skill for security/reliability issues. Focus on: shell quoting, command injection, sendmail header injection, dependency checks, cron payload safety, and failure modes. Provide concrete patch suggestions (with diffs if possible)." \
  -c "workdir=\"$ROOT_DIR\"" \
  -c "reasoning_effort=\"xhigh\""

#!/usr/bin/env node

import fs from "node:fs/promises";
import path from "node:path";
import os from "node:os";

const DEFAULT_PRIMARY_PATH = path.join(os.homedir(), ".openclaw", "security-audit.json");
const DEFAULT_FALLBACK_PATH = ".clawsec/allowlist.json";
const UNEXPANDED_HOME_TOKEN_PATTERN =
  /(?:^|[\\/])(?:\\?\$HOME|\\?\$\{HOME\}|\\?\$USERPROFILE|\\?\$\{USERPROFILE\}|%HOME%|%USERPROFILE%|\$env:HOME|\$env:USERPROFILE)(?:$|[\\/])/i;

function detectHomeDirectory(env = process.env) {
  if (typeof env.HOME === "string" && env.HOME.trim()) return env.HOME.trim();
  if (typeof env.USERPROFILE === "string" && env.USERPROFILE.trim()) return env.USERPROFILE.trim();
  if (
    typeof env.HOMEDRIVE === "string" &&
    env.HOMEDRIVE.trim() &&
    typeof env.HOMEPATH === "string" &&
    env.HOMEPATH.trim()
  ) {
    return `${env.HOMEDRIVE.trim()}${env.HOMEPATH.trim()}`;
  }
  return os.homedir();
}

function resolveUserPath(inputPath, label) {
  const raw = String(inputPath ?? "").trim();
  if (!raw) return raw;

  const homeDir = detectHomeDirectory(process.env);
  let expanded = raw;

  if (expanded === "~") {
    expanded = homeDir;
  } else if (expanded.startsWith("~/") || expanded.startsWith("~\\")) {
    expanded = path.join(homeDir, expanded.slice(2));
  }

  expanded = expanded
    .replace(/(?<!\\)\$\{HOME\}/g, homeDir)
    .replace(/(?<!\\)\$HOME(?=$|[\\/])/g, homeDir)
    .replace(/(?<!\\)\$\{USERPROFILE\}/gi, homeDir)
    .replace(/(?<!\\)\$USERPROFILE(?=$|[\\/])/gi, homeDir)
    .replace(/%HOME%/gi, homeDir)
    .replace(/%USERPROFILE%/gi, homeDir)
    .replace(/(?<!\\)\$env:HOME/gi, homeDir)
    .replace(/(?<!\\)\$env:USERPROFILE/gi, homeDir);

  const normalized = path.normalize(expanded);
  if (UNEXPANDED_HOME_TOKEN_PATTERN.test(normalized)) {
    throw new Error(
      `Unexpanded home token detected in ${label}: ${raw}. ` +
        "Use an absolute path or an unquoted home-path expression.",
    );
  }
  return normalized;
}

function isObject(value) {
  return typeof value === "object" && value !== null && !Array.isArray(value);
}

function normalizeString(value, fallback = "") {
  return String(value ?? fallback).trim();
}

function normalizeDate(value) {
  const str = normalizeString(value);
  if (!str) return null;

  // Validate ISO 8601 date format (YYYY-MM-DD)
  const iso8601Pattern = /^\d{4}-\d{2}-\d{2}$/;
  if (!iso8601Pattern.test(str)) {
    return null;
  }

  return str;
}

function validateSuppression(entry, index) {
  if (!isObject(entry)) {
    throw new Error(`Suppression entry at index ${index} must be an object`);
  }

  const checkId = normalizeString(entry.checkId);
  if (!checkId) {
    throw new Error(`Suppression entry at index ${index} missing required field: checkId`);
  }

  const skill = normalizeString(entry.skill);
  if (!skill) {
    throw new Error(`Suppression entry at index ${index} missing required field: skill`);
  }

  const reason = normalizeString(entry.reason);
  if (!reason) {
    throw new Error(`Suppression entry at index ${index} missing required field: reason`);
  }

  if (!entry.suppressedAt) {
    throw new Error(`Suppression entry at index ${index} missing required field: suppressedAt`);
  }

  const suppressedAt = normalizeDate(entry.suppressedAt);
  if (!suppressedAt) {
    // Warn but don't fail - allow suppression to work with malformed date
    process.stderr.write(
      `Warning: Suppression entry at index ${index} has malformed date '${entry.suppressedAt}'. Expected ISO 8601 format (YYYY-MM-DD).\n`
    );
  }

  return {
    checkId,
    skill,
    reason,
    suppressedAt: suppressedAt || normalizeString(entry.suppressedAt),
  };
}

function normalizeSuppressionConfig(payload, source) {
  if (!isObject(payload)) {
    throw new Error(`Config file at ${source} must be a JSON object`);
  }

  const rawSuppressions = payload.suppressions;
  if (!Array.isArray(rawSuppressions)) {
    throw new Error(`Config file at ${source} missing 'suppressions' array`);
  }

  const suppressions = [];
  for (let i = 0; i < rawSuppressions.length; i++) {
    try {
      const normalized = validateSuppression(rawSuppressions[i], i);
      suppressions.push(normalized);
    } catch (err) {
      throw new Error(`Invalid suppression at index ${i} in ${source}: ${err.message}`, { cause: err });
    }
  }

  // Extract enabledFor sentinel (array of pipeline names this config activates for)
  const enabledFor = Array.isArray(payload.enabledFor)
    ? payload.enabledFor.filter((v) => typeof v === "string" && v.trim() !== "").map((v) => v.trim().toLowerCase())
    : [];

  return {
    suppressions,
    enabledFor,
    source,
  };
}

async function loadConfigFromPath(configPath) {
  try {
    const raw = await fs.readFile(configPath, "utf8");
    const parsed = JSON.parse(raw);
    return normalizeSuppressionConfig(parsed, configPath);
  } catch (err) {
    if (err.code === "ENOENT") {
      // File doesn't exist - return null to try fallback
      return null;
    }
    if (err.code === "EACCES") {
      throw new Error(`Permission denied reading config file: ${configPath}`, { cause: err });
    }
    if (err instanceof SyntaxError) {
      throw new Error(`Malformed JSON in config file ${configPath}: ${err.message}`, { cause: err });
    }
    // Re-throw validation errors or other errors
    throw err;
  }
}

const EMPTY_RESULT = Object.freeze({ suppressions: [], source: "none" });

/**
 * Resolve config from the 4-tier priority chain.
 * Returns the loaded config or null if no config found.
 */
async function resolveConfig(customPath) {
  // Priority 1: Custom path provided as argument
  if (customPath) {
    const resolved = resolveUserPath(customPath, "custom suppression config path");
    const config = await loadConfigFromPath(resolved);
    if (!config) {
      throw new Error(`Custom config file not found: ${resolved}`);
    }
    return config;
  }

  // Priority 2: Environment variable
  const envPath = process.env.OPENCLAW_AUDIT_CONFIG;
  if (envPath) {
    const resolved = resolveUserPath(envPath, "OPENCLAW_AUDIT_CONFIG");
    const config = await loadConfigFromPath(resolved);
    if (!config) {
      throw new Error(`Config file from OPENCLAW_AUDIT_CONFIG not found: ${resolved}`);
    }
    return config;
  }

  // Priority 3: Primary default path
  const primaryConfig = await loadConfigFromPath(DEFAULT_PRIMARY_PATH);
  if (primaryConfig) return primaryConfig;

  // Priority 4: Fallback path
  const fallbackConfig = await loadConfigFromPath(DEFAULT_FALLBACK_PATH);
  if (fallbackConfig) return fallbackConfig;

  return null;
}

/**
 * Load suppression configuration with multi-path fallback and opt-in gating.
 *
 * Suppression requires explicit opt-in to prevent ambient activation:
 *   1. The `enabled` flag must be true (set via --enable-suppressions CLI flag)
 *   2. The config file must contain an `enabledFor` array including "audit"
 *
 * Without both gates, returns empty suppressions.
 *
 * @param {string} [customPath] - Optional custom config file path
 * @param {object} [options]
 * @param {boolean} [options.enabled=false] - Whether suppression is explicitly enabled
 * @param {string} [options.pipeline="audit"] - Pipeline to check in enabledFor sentinel
 * @returns {Promise<{suppressions: Array, source: string}>}
 */
export async function loadSuppressionConfig(customPath = null, { enabled = false, pipeline = "audit" } = {}) {
  // Gate 1: suppression must be explicitly opted-in via CLI flag
  if (!enabled) {
    return EMPTY_RESULT;
  }

  const config = await resolveConfig(customPath);
  if (!config) {
    return EMPTY_RESULT;
  }

  // Gate 2: config must declare this pipeline in enabledFor sentinel
  if (!Array.isArray(config.enabledFor) || !config.enabledFor.includes(pipeline)) {
    return EMPTY_RESULT;
  }

  process.stderr.write(
    `WARNING: Suppression mechanism is enabled for "${pipeline}" pipeline via --enable-suppressions flag.\n`
  );

  return config;
}

// CLI usage when run directly
if (import.meta.url === `file://${process.argv[1]}`) {
  const args = process.argv.slice(2);
  const enableFlag = args.includes("--enable-suppressions");
  const customPath = args.find((a) => !a.startsWith("--")) || null;

  if (!enableFlag) {
    process.stdout.write("Suppression is disabled. Pass --enable-suppressions to activate.\n");
    process.exit(0);
  }

  try {
    const config = await loadSuppressionConfig(customPath, { enabled: true });

    if (config.suppressions.length === 0) {
      process.stdout.write("No active suppressions (config missing, no enabledFor sentinel, or empty)\n");
      process.stdout.write(JSON.stringify(config, null, 2) + "\n");
      process.exit(0);
    }

    process.stdout.write(`Config loaded successfully from: ${config.source}\n`);
    process.stdout.write(`Found ${config.suppressions.length} suppression(s):\n`);
    process.stdout.write(JSON.stringify(config, null, 2) + "\n");
    process.exit(0);
  } catch (err) {
    process.stderr.write(`Error loading suppression config: ${err.message}\n`);
    process.exit(1);
  }
}

#!/usr/bin/env node
/**
 * Render a human-readable security audit report from openclaw JSON.
 *
 * Usage:
 *   node render_report.mjs --audit audit.json --deep deep.json --label "host label" [--enable-suppressions] [--config config.json]
 */

import fs from "node:fs";
import { loadSuppressionConfig } from "./load_suppression_config.mjs";

function readJsonSafe(p, label) {
  if (!p) return { findings: [], summary: {}, error: `${label} missing` };
  try {
    const s = fs.readFileSync(p, "utf8");
    return JSON.parse(s);
  } catch (e) {
    return { findings: [], summary: {}, error: `${label} parse failed: ${e?.message || String(e)}` };
  }
}

function pickFindings(report) {
  const findings = Array.isArray(report?.findings) ? report.findings : [];
  const bySev = (sev) => findings.filter((f) => f?.severity === sev);
  return {
    critical: bySev("critical"),
    warn: bySev("warn"),
    info: bySev("info"),
    summary: report?.summary ?? null,
  };
}

/**
 * Extract skill name from a finding object.
 * Tries multiple fields in priority order.
 *
 * @param {object} finding - The finding object
 * @returns {string|null} - The skill name or null if not found
 */
function extractSkillName(finding) {
  if (!finding) return null;

  // Try common fields where skill name might be stored
  if (finding.skill) return String(finding.skill).trim();
  if (finding.skillName) return String(finding.skillName).trim();
  if (finding.target) return String(finding.target).trim();

  // Attempt to extract from path (e.g., "skills/my-skill/...")
  if (finding.path && typeof finding.path === "string") {
    const pathMatch = finding.path.match(/skills\/([^/]+)/);
    if (pathMatch) return pathMatch[1];
  }

  // Attempt to extract from title (e.g., "[my-skill] some issue")
  if (finding.title && typeof finding.title === "string") {
    const titleMatch = finding.title.match(/^\[([^\]]+)\]/);
    if (titleMatch) return titleMatch[1];
  }

  return null;
}

function normalizeSkillName(value) {
  const normalized = String(value ?? "").trim();
  return normalized ? normalized.toLowerCase() : "";
}

/**
 * Filter findings into active and suppressed based on suppression config.
 * Matches require BOTH checkId AND skill name to match.
 * checkId remains exact; skill name is normalized case-insensitively.
 *
 * @param {Array} findings - Array of finding objects
 * @param {Array} suppressions - Array of suppression rules
 * @returns {{active: Array, suppressed: Array}}
 */
function filterFindings(findings, suppressions) {
  if (!Array.isArray(findings)) {
    return { active: [], suppressed: [] };
  }

  if (!Array.isArray(suppressions) || suppressions.length === 0) {
    return { active: findings, suppressed: [] };
  }

  const active = [];
  const suppressed = [];

  for (const finding of findings) {
    const checkId = finding?.checkId ?? "";
    const skillName = extractSkillName(finding);
    const normalizedSkillName = normalizeSkillName(skillName);

    // Check if this finding matches any suppression rule
    const isSuppressed = suppressions.some((rule) => {
      return rule.checkId === checkId && normalizeSkillName(rule.skill) === normalizedSkillName;
    });

    if (isSuppressed) {
      // Find the matching rule to attach suppression metadata
      const matchingRule = suppressions.find(
        (rule) => rule.checkId === checkId && normalizeSkillName(rule.skill) === normalizedSkillName
      );
      suppressed.push({
        ...finding,
        suppressionReason: matchingRule?.reason,
        suppressedAt: matchingRule?.suppressedAt,
      });
    } else {
      active.push(finding);
    }
  }

  return { active, suppressed };
}

function lineForFinding(f) {
  const id = f?.checkId ?? "(no-checkId)";
  const skillName = extractSkillName(f);
  const skillLabel = skillName ? `[${skillName}] ` : "";
  const title = f?.title ?? "(no-title)";
  const fix = (f?.remediation ?? "").trim();
  const fixLine = fix ? `Fix: ${fix}` : "";
  return `- ${id} ${skillLabel}${title}${fixLine ? `\n  ${fixLine}` : ""}`;
}

function lineForSuppressedFinding(f) {
  const id = f?.checkId ?? "(no-checkId)";
  const skillName = extractSkillName(f) ?? "(unknown-skill)";
  const title = f?.title ?? "(no-title)";
  const reason = f?.suppressionReason ?? "(no reason)";
  const date = f?.suppressedAt ?? "(no date)";
  return `- ${id} [${skillName}] ${title}\n  Suppressed: ${reason} (${date})`;
}

function render({ audit, deep, label, suppressedFindings = [] }) {
  const now = new Date().toISOString();
  const a = pickFindings(audit);
  const d = pickFindings(deep);

  const summary = a.summary || d.summary || { critical: 0, warn: 0, info: 0 };

  const lines = [];
  lines.push(`openclaw security audit report${label ? ` -- ${label}` : ""}`);
  lines.push(`Time: ${now}`);
  lines.push(`Summary: ${summary.critical ?? 0} critical · ${summary.warn ?? 0} warn · ${summary.info ?? 0} info`);

  const top = [];
  top.push(...a.critical, ...a.warn);
  const seen = new Set();
  const deduped = [];
  for (const f of top) {
    const key = `${f?.severity}:${f?.checkId}`;
    if (seen.has(key)) continue;
    seen.add(key);
    deduped.push(f);
  }

  if (deduped.length) {
    lines.push("");
    lines.push("Findings (critical/warn):");
    for (const f of deduped.slice(0, 25)) lines.push(lineForFinding(f));
    if (deduped.length > 25) lines.push(`…${deduped.length - 25} more`);
  }

  // Surface deep probe failure if present
  const deepProbe = Array.isArray(deep?.findings)
    ? deep.findings.find((f) => f?.checkId === "gateway.probe_failed")
    : null;
  if (deepProbe) {
    lines.push("");
    lines.push("Deep probe:");
    lines.push(lineForFinding(deepProbe));
  }

  const errors = [audit?.error, deep?.error].filter(Boolean);
  if (errors.length) {
    lines.push("");
    lines.push("Errors:");
    for (const e of errors) lines.push(`- ${e}`);
  }

  // Show suppressed findings
  if (suppressedFindings.length) {
    lines.push("");
    lines.push("INFO-SUPPRESSED:");
    for (const f of suppressedFindings) {
      lines.push(lineForSuppressedFinding(f));
    }
  }

  return lines.join("\n");
}

function parseArgs(argv) {
  const out = {};
  for (let i = 0; i < argv.length; i++) {
    const a = argv[i];
    if (a === "--audit") out.audit = argv[++i];
    else if (a === "--deep") out.deep = argv[++i];
    else if (a === "--label") out.label = argv[++i];
    else if (a === "--config") out.config = argv[++i];
    else if (a === "--enable-suppressions") out.enableSuppressions = true;
  }
  return out;
}

// Main execution
const args = parseArgs(process.argv.slice(2));

// Load suppression config (requires explicit opt-in)
const suppressionConfig = await loadSuppressionConfig(args.config || null, {
  enabled: !!args.enableSuppressions,
});
const suppressions = suppressionConfig.suppressions || [];

// Read audit results
const audit = readJsonSafe(args.audit, "audit");
const deep = readJsonSafe(args.deep, "deep");

// Apply suppression filtering to findings
const allFindings = [...(audit.findings || []), ...(deep.findings || [])];
const { active: activeFindings, suppressed: suppressedFindings } = filterFindings(
  allFindings,
  suppressions
);

// Replace findings in audit/deep with filtered active findings
if (audit.findings) {
  audit.findings = activeFindings.filter((f) =>
    (audit.findings || []).some((orig) => orig === f)
  );
  // Recalculate summary counts after filtering
  audit.summary = {
    critical: audit.findings.filter((f) => f?.severity === "critical").length,
    warn: audit.findings.filter((f) => f?.severity === "warn").length,
    info: audit.findings.filter((f) => f?.severity === "info").length,
  };
}
if (deep.findings) {
  deep.findings = activeFindings.filter((f) =>
    (deep.findings || []).some((orig) => orig === f)
  );
  // Recalculate summary counts after filtering
  deep.summary = {
    critical: deep.findings.filter((f) => f?.severity === "critical").length,
    warn: deep.findings.filter((f) => f?.severity === "warn").length,
    info: deep.findings.filter((f) => f?.severity === "info").length,
  };
}

// Render report with suppressed findings
const report = render({ audit, deep, label: args.label, suppressedFindings });
process.stdout.write(report + "\n");

#!/usr/bin/env bash
set -euo pipefail

# Runs openclaw security audits and prints a formatted report to stdout.
#
# Usage:
#   ./run_audit_and_format.sh [--label "custom label"] [--config <path>]

show_help() {
  cat <<EOF
Usage: run_audit_and_format.sh [OPTIONS]

Options:
  --label <text>              Custom label for the report
  --config <path>             Path to config file (e.g., allowlist.json)
  --enable-suppressions       Explicitly enable the suppression mechanism
  --help                      Show this help message

EOF
  exit 0
}

LABEL=""
CONFIG=""
ENABLE_SUPPRESSIONS=0
while [[ $# -gt 0 ]]; do
  case "$1" in
    --label)
      LABEL="${2:-}"; shift 2 ;;
    --config)
      CONFIG="${2:-}"; shift 2 ;;
    --enable-suppressions)
      ENABLE_SUPPRESSIONS=1; shift ;;
    --help)
      show_help ;;
    *)
      echo "Unknown arg: $1" >&2
      exit 2
      ;;
  esac
done

TMPDIR="${TMPDIR:-/tmp}"
AUDIT_JSON="$(mktemp "${TMPDIR%/}/openclaw_audit.XXXXXX.audit.json")"
DEEP_JSON="$(mktemp "${TMPDIR%/}/openclaw_audit.XXXXXX.deep.json")"

cleanup() {
  rm -f "$AUDIT_JSON" "$DEEP_JSON" 2>/dev/null || true
}
trap cleanup EXIT

command -v openclaw >/dev/null 2>&1 || { echo "openclaw not found in PATH" >&2; exit 127; }
command -v node >/dev/null 2>&1 || { echo "node not found in PATH" >&2; exit 127; }

run_audit() {
  local kind="$1" outfile="$2"
  local errfile
  errfile="$(mktemp "${TMPDIR%/}/openclaw_audit.XXXXXX.err")"

  local config_args=()
  if [[ -n "$CONFIG" ]]; then
    config_args=(--config "$CONFIG")
  fi

  # kind is either: "audit" or "deep"
  if [[ "$kind" == "audit" ]]; then
    if ! openclaw security audit --json "${config_args[@]}" >"$outfile" 2>"$errfile"; then
      printf '{"findings":[],"summary":{"critical":0,"warn":0,"info":0},"error":"audit failed: %s"}\n' \
        "$(head -n 20 "$errfile" | tr '\n' ' ')" >"$outfile"
    fi
  else
    if ! openclaw security audit --deep --json "${config_args[@]}" >"$outfile" 2>"$errfile"; then
      printf '{"findings":[],"summary":{"critical":0,"warn":0,"info":0},"error":"deep failed: %s"}\n' \
        "$(head -n 20 "$errfile" | tr '\n' ' ')" >"$outfile"
    fi
  fi

  rm -f "$errfile" 2>/dev/null || true
}

run_audit "audit" "$AUDIT_JSON"
run_audit "deep" "$DEEP_JSON"

# Host id: prefer short hostname; fall back to full hostname
HOST_ID="$(hostname -s 2>/dev/null || hostname 2>/dev/null || echo unknown-host)"

if [[ -z "$LABEL" ]]; then
  LABEL="$HOST_ID"
else
  LABEL="$LABEL ($HOST_ID)"
fi

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Build args for render_report
RENDER_ARGS=(--audit "$AUDIT_JSON" --deep "$DEEP_JSON" --label "$LABEL")
if [[ "$ENABLE_SUPPRESSIONS" -eq 1 ]]; then
  RENDER_ARGS+=(--enable-suppressions)
fi
if [[ -n "$CONFIG" ]]; then
  RENDER_ARGS+=(--config "$CONFIG")
fi

node "$SCRIPT_DIR/render_report.mjs" "${RENDER_ARGS[@]}"

#!/usr/bin/env bash
set -euo pipefail

# Runner for Prompt Security daily audit job.
# - Optionally git-pulls repo (if PROMPTSEC_GIT_PULL=1)
# - Runs openclaw security audit + deep audit
# - Optionally emails the report if PROMPTSEC_EMAIL_TO is configured
# - Prints the report to stdout (so cron delivery can DM it)

COMPANY_EMAIL="${PROMPTSEC_EMAIL_TO:-}"
HOST_LABEL="${PROMPTSEC_HOST_LABEL:-}"
DO_PULL="${PROMPTSEC_GIT_PULL:-0}"
ENABLE_SUPPRESSIONS=0
AUDIT_CONFIG=""

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

# Parse CLI arguments
while [[ $# -gt 0 ]]; do
  case "$1" in
    --enable-suppressions)
      ENABLE_SUPPRESSIONS=1; shift ;;
    --config)
      AUDIT_CONFIG="${2:-}"; shift 2 ;;
    *)
      shift ;;
  esac
done

if [[ "$DO_PULL" == "1" ]]; then
  if command -v git >/dev/null 2>&1 && [[ -d "$ROOT_DIR/.git" ]]; then
    git -C "$ROOT_DIR" pull --ff-only >/dev/null 2>&1 || true
  fi
fi

args=( )
if [[ -n "$HOST_LABEL" ]]; then
  args+=(--label "$HOST_LABEL")
fi
if [[ "$ENABLE_SUPPRESSIONS" -eq 1 ]]; then
  args+=(--enable-suppressions)
fi
if [[ -n "$AUDIT_CONFIG" ]]; then
  args+=(--config "$AUDIT_CONFIG")
fi
REPORT="$($SCRIPT_DIR/run_audit_and_format.sh "${args[@]}")"

SUBJECT_HOST="${HOST_LABEL:-$(hostname -s 2>/dev/null || hostname 2>/dev/null || echo unknown-host)}"
EMAIL_OK=1

if [[ -n "$COMPANY_EMAIL" ]]; then
  EMAIL_OK=0
  # Prefer sendmail-compatible delivery if available; otherwise fallback to local SMTP (localhost:25 by default).
  if printf '%s\n' "$REPORT" | "$SCRIPT_DIR/sendmail_report.sh" --to "$COMPANY_EMAIL" --subject "[$SUBJECT_HOST] openclaw daily security audit"; then
    EMAIL_OK=1
  else
    if command -v node >/dev/null 2>&1; then
      if printf '%s\n' "$REPORT" | node "$SCRIPT_DIR/send_smtp.mjs" --to "$COMPANY_EMAIL" --subject "[$SUBJECT_HOST] openclaw daily security audit"; then
        EMAIL_OK=1
      else
        EMAIL_OK=0
      fi
    else
      EMAIL_OK=0
    fi
  fi
fi

if [[ -n "$COMPANY_EMAIL" && "$EMAIL_OK" -eq 0 ]]; then
  printf '%s\n\n' "$REPORT"
  echo "NOTE: could not deliver email to ${COMPANY_EMAIL} via configured sendmail/SMTP path"
else
  printf '%s\n' "$REPORT"
fi

#!/usr/bin/env node
/**
 * Minimal SMTP sender (no auth) intended for localhost-relay MTAs.
 *
 * Env:
 * - PROMPTSEC_SMTP_HOST (default 127.0.0.1)
 * - PROMPTSEC_SMTP_PORT (default 25)
 * - PROMPTSEC_SMTP_HELO (default hostname)
 * - PROMPTSEC_SMTP_FROM (default security-checkup@<hostname>)
 *
 * Args:
 *   --to <email>
 *   --subject <text>
 *
 * Body is read from stdin.
 */

import net from "node:net";
import os from "node:os";

function argVal(name) {
  const i = process.argv.indexOf(name);
  if (i === -1) return null;
  return process.argv[i + 1] ?? null;
}

const to = argVal("--to");
const subjectRaw = argVal("--subject") ?? "openclaw daily security audit";
if (!to) {
  process.stderr.write("--to is required\n");
  process.exit(2);
}

const host = (process.env.PROMPTSEC_SMTP_HOST || "127.0.0.1").trim();
const port = Number(process.env.PROMPTSEC_SMTP_PORT || "25");
const hostname = (os.hostname?.() || "unknown-host").trim();
const helo = (process.env.PROMPTSEC_SMTP_HELO || hostname).trim();
const from = (process.env.PROMPTSEC_SMTP_FROM || `security-checkup@${hostname}`).trim();

function stripCrlf(s) {
  return String(s ?? "").replace(/[\r\n]+/g, " ").trim();
}

const subject = stripCrlf(subjectRaw);
const toClean = stripCrlf(to);
const fromClean = stripCrlf(from);

async function readStdin() {
  return await new Promise((resolve, reject) => {
    let data = "";
    process.stdin.setEncoding("utf8");
    process.stdin.on("data", (c) => (data += c));
    process.stdin.on("end", () => resolve(data));
    process.stdin.on("error", reject);
  });
}

function expectCode(line, okPrefixes) {
  const code = line.slice(0, 3);
  if (!okPrefixes.includes(code)) {
    throw new Error(`SMTP unexpected response: ${line}`);
  }
}

function dotStuff(body) {
  // SMTP DATA terminates on <CRLF>.<CRLF>
  // Dot-stuff any line that begins with '.'
  return body.replace(/(^|\r?\n)\./g, "$1..");
}

async function send() {
  const body = await readStdin();
  const msg = [
    `From: ${fromClean}`,
    `To: ${toClean}`,
    `Subject: ${subject}`,
    `Content-Type: text/plain; charset=UTF-8`,
    "",
    dotStuff(body).replace(/\r?\n/g, "\r\n"),
  ].join("\r\n");

  const socket = net.createConnection({ host, port });
  socket.setTimeout(10000);

  let buffer = "";
  const readLine = () =>
    new Promise((resolve, reject) => {
      const onData = (chunk) => {
        buffer += chunk.toString("utf8");
        const idx = buffer.indexOf("\r\n");
        if (idx !== -1) {
          const line = buffer.slice(0, idx);
          buffer = buffer.slice(idx + 2);
          cleanup();
          resolve(line);
        }
      };
      const onError = (e) => {
        cleanup();
        reject(e);
      };
      const onTimeout = () => {
        cleanup();
        reject(new Error("SMTP timeout"));
      };
      const cleanup = () => {
        socket.off("data", onData);
        socket.off("error", onError);
        socket.off("timeout", onTimeout);
      };
      socket.on("data", onData);
      socket.on("error", onError);
      socket.on("timeout", onTimeout);
    });

  const write = (line) => socket.write(line + "\r\n");

  try {
    const greet = await readLine();
    expectCode(greet, ["220"]);

    write(`EHLO ${helo}`);
    // Consume EHLO multi-line: 250-..., then 250 ...
    while (true) {
      const l = await readLine();
      if (l.startsWith("250-")) continue;
      expectCode(l, ["250"]);
      break;
    }

    write(`MAIL FROM:<${fromClean}>`);
    expectCode(await readLine(), ["250"]);

    write(`RCPT TO:<${toClean}>`);
    expectCode(await readLine(), ["250", "251"]);

    write("DATA");
    expectCode(await readLine(), ["354"]);

    socket.write(msg + "\r\n.\r\n");
    expectCode(await readLine(), ["250"]);

    write("QUIT");
    // best-effort
    try { await readLine(); } catch {}

    socket.end();
  } catch (e) {
    try { socket.destroy(); } catch {}
    throw e;
  }
}

send().catch((e) => {
  process.stderr.write(String(e?.stack || e) + "\n");
  process.exit(1);
});

#!/usr/bin/env bash
set -euo pipefail

# Sends report text (stdin) via local sendmail.
#
# Usage:
#   ./sendmail_report.sh --to security@example.com [--subject "..."]

TO=""
SUBJECT="openclaw daily security audit"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --to)
      TO="${2:-}"; shift 2 ;;
    --subject)
      SUBJECT="${2:-}"; shift 2 ;;
    *)
      echo "Unknown arg: $1" >&2
      exit 2
      ;;
  esac
done

if [[ -z "$TO" ]]; then
  echo "--to is required" >&2
  exit 2
fi

# Resolve sendmail:
# - explicit override via PROMPTSEC_SENDMAIL_BIN
# - macOS default /usr/sbin/sendmail (often not in PATH for non-login shells)
# - fallback to PATH lookup
SENDMAIL_BIN="${PROMPTSEC_SENDMAIL_BIN:-}"
if [[ -z "$SENDMAIL_BIN" ]] && [[ -x "/usr/sbin/sendmail" ]]; then
  SENDMAIL_BIN="/usr/sbin/sendmail"
fi
if [[ -z "$SENDMAIL_BIN" ]]; then
  SENDMAIL_BIN="$(command -v sendmail || true)"
fi
if [[ -z "$SENDMAIL_BIN" ]] || [[ ! -x "$SENDMAIL_BIN" ]]; then
  echo "sendmail not found (tried PROMPTSEC_SENDMAIL_BIN, /usr/sbin/sendmail, and sendmail in PATH)" >&2
  exit 1
fi

# Prevent header injection: strip CR/LF from header fields
TO_CLEAN="$(printf '%s' "$TO" | tr -d '\r\n')"
SUBJECT_CLEAN="$(printf '%s' "$SUBJECT" | tr -d '\r\n')"

# Basic RFC2822
{
  echo "To: ${TO_CLEAN}"
  echo "Subject: ${SUBJECT_CLEAN}"
  echo "Content-Type: text/plain; charset=UTF-8"
  echo
  cat
} | "$SENDMAIL_BIN" -oi -oem -t

#!/usr/bin/env node
/**
 * Setup: create/update a daily 23:00 cron job that
 * - runs openclaw security audits
 * - DMs a chosen recipient (channel+id)
 * - optionally emails a configured recipient via sendmail/SMTP
 *
 * Uses the `openclaw cron` CLI so it can run on a host without direct Gateway RPC access.
 */

import { spawnSync as runProcessSync } from "node:child_process";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import readline from "node:readline";
import { fileURLToPath } from "node:url";

const JOB_NAME = "Daily security audit (Prompt Security)";
const DEFAULT_TZ = "UTC";
const DEFAULT_EXPR = "0 23 * * *"; // 23:00 daily
const PERSISTED_ENV_KEYS = [
  "PROMPTSEC_EMAIL_TO",
  "PROMPTSEC_GIT_PULL",
  "OPENCLAW_AUDIT_CONFIG",
  "PROMPTSEC_SENDMAIL_BIN",
  "PROMPTSEC_SMTP_HOST",
  "PROMPTSEC_SMTP_PORT",
  "PROMPTSEC_SMTP_HELO",
  "PROMPTSEC_SMTP_FROM",
];

const SCRIPT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
const UNEXPANDED_HOME_TOKEN_PATTERN =
  /(?:^|[\\/])(?:\\?\$HOME|\\?\$\{HOME\}|\\?\$USERPROFILE|\\?\$\{USERPROFILE\}|%HOME%|%USERPROFILE%|\$env:HOME|\$env:USERPROFILE)(?:$|[\\/])/i;

function sh(cmd, args, { input } = {}) {
  const res = runProcessSync(cmd, args, {
    encoding: "utf8",
    input: input ?? undefined,
    stdio: [input ? "pipe" : "ignore", "pipe", "pipe"],
  });
  if (res.error) throw res.error;
  if (res.status !== 0) {
    const msg = (res.stderr || res.stdout || "").trim();
    throw new Error(`${cmd} ${args.join(" ")} failed (code ${res.status})${msg ? `: ${msg}` : ""}`);
  }
  return res.stdout;
}

async function prompt(question, { defaultValue = "" } = {}) {
  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
  const q = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
  const answer = await new Promise((resolve) => rl.question(q, resolve));
  rl.close();
  const trimmed = String(answer ?? "").trim();
  return trimmed || defaultValue;
}

function envOrEmpty(name) {
  const v = process.env[name];
  return typeof v === "string" ? v.trim() : "";
}

function detectHomeDirectory() {
  const home = envOrEmpty("HOME");
  if (home) return home;
  const userProfile = envOrEmpty("USERPROFILE");
  if (userProfile) return userProfile;
  const homeDrive = envOrEmpty("HOMEDRIVE");
  const homePath = envOrEmpty("HOMEPATH");
  if (homeDrive && homePath) return `${homeDrive}${homePath}`;
  return os.homedir();
}

function resolveUserPath(inputPath, label) {
  const raw = String(inputPath ?? "").trim();
  if (!raw) return raw;

  const homeDir = detectHomeDirectory();
  let expanded = raw;

  if (expanded === "~") {
    expanded = homeDir;
  } else if (expanded.startsWith("~/") || expanded.startsWith("~\\")) {
    expanded = path.join(homeDir, expanded.slice(2));
  }

  expanded = expanded
    .replace(/(?<!\\)\$\{HOME\}/g, homeDir)
    .replace(/(?<!\\)\$HOME(?=$|[\\/])/g, homeDir)
    .replace(/(?<!\\)\$\{USERPROFILE\}/gi, homeDir)
    .replace(/(?<!\\)\$USERPROFILE(?=$|[\\/])/gi, homeDir)
    .replace(/%HOME%/gi, homeDir)
    .replace(/%USERPROFILE%/gi, homeDir)
    .replace(/(?<!\\)\$env:HOME/gi, homeDir)
    .replace(/(?<!\\)\$env:USERPROFILE/gi, homeDir);

  const normalized = path.normalize(expanded);
  if (UNEXPANDED_HOME_TOKEN_PATTERN.test(normalized)) {
    throw new Error(
      `Unexpanded home token detected in ${label}: ${raw}. ` +
        "Use an absolute path or an unquoted home-path expression.",
    );
  }

  return normalized;
}

function oneline(v) {
  return String(v ?? "")
    .replace(/[\r\n]+/g, " ")
    .replace(/\\/g, "\\\\")
    .replace(/"/g, "\\\"")
    .trim();
}

function escapeForShellEnvVar(v) {
  return String(v ?? "")
    .replace(/[\r\n]+/g, " ")
    .replace(/\\/g, "\\\\")
    .replace(/\$/g, "\\$")
    .replace(/`/g, "\\`")
    .replace(/"/g, "\\\"")
    .trim();
}

function buildRunnerEnv({ hostLabel, emailTo }) {
  const envVars = {
    PROMPTSEC_HOST_LABEL: hostLabel,
  };

  if (emailTo) {
    envVars.PROMPTSEC_EMAIL_TO = emailTo;
  }

  for (const key of PERSISTED_ENV_KEYS) {
    const value = envOrEmpty(key);
    if (value) {
      envVars[key] = value;
    }
  }

  return envVars;
}

function buildRunnerCommand({ installDir, hostLabel, emailTo }) {
  const envVars = buildRunnerEnv({ hostLabel, emailTo });
  const exports = Object.entries(envVars)
    .filter(([, value]) => String(value ?? "").trim() !== "")
    .map(([key, value]) => `${key}="${escapeForShellEnvVar(value)}"`);

  const exportPrefix = exports.length ? `${exports.join(" ")} ` : "";
  return `cd "${escapeForShellEnvVar(installDir || "")}" && ${exportPrefix}./scripts/runner.sh`;
}

function printPreflightSummary({ dmChannel, dmTo, emailTo, installDir, tz, hostLabel }) {
  const emailSummary = emailTo || "disabled (set PROMPTSEC_EMAIL_TO to enable)";
  const persistedKeys = Array.from(new Set([
    "PROMPTSEC_HOST_LABEL",
    emailTo ? "PROMPTSEC_EMAIL_TO" : null,
    ...PERSISTED_ENV_KEYS.filter((key) => envOrEmpty(key)),
  ].filter(Boolean)));

  const lines = [
    "Preflight review:",
    "- This setup creates or updates an unattended openclaw cron job.",
    "- Required runtime: openclaw CLI, node, bash.",
    "- Optional email runtime: local sendmail or PROMPTSEC_SMTP_HOST/PROMPTSEC_SMTP_PORT relay.",
    `- DM target: ${oneline(dmChannel)}:${oneline(dmTo)}`,
    `- Email target: ${oneline(emailSummary)}`,
    `- Schedule: ${DEFAULT_EXPR} (${oneline(tz)})`,
    `- Install dir: ${oneline(installDir)}`,
  ];

  if (hostLabel) {
    lines.push(`- Host label: ${oneline(hostLabel)}`);
  }

  if (persistedKeys.length) {
    lines.push(`- Cron payload persists env: ${persistedKeys.join(", ")}`);
  }

  process.stdout.write(lines.join("\n") + "\n\n");
}

function defaultInstallDir() {
  const env = envOrEmpty("PROMPTSEC_INSTALL_DIR");
  if (env) return resolveUserPath(env, "PROMPTSEC_INSTALL_DIR");
  const home = detectHomeDirectory();
  if (home) return path.join(home, ".config", "security-checkup");
  return resolveUserPath(SCRIPT_ROOT, "script root");
}

function buildAgentMessage({ dmChannel, dmTo, hostLabel, installDir, emailTo }) {
  const runnerCommand = buildRunnerCommand({ installDir, hostLabel, emailTo });
  const emailLine = emailTo
    ? `Email: ${oneline(emailTo)} (sendmail first, SMTP fallback if configured)`
    : "Email: disabled unless PROMPTSEC_EMAIL_TO is set";

  return [
    "Run daily openclaw security audits and deliver report to the configured recipients.",
    "",
    "Dependencies:",
    "- Required runtime: openclaw CLI, node, bash.",
    "- Optional email runtime: local sendmail or PROMPTSEC_SMTP_HOST/PROMPTSEC_SMTP_PORT relay.",
    "",
    "Configured delivery:",
    `Delivery DM: ${oneline(dmChannel)}:${oneline(dmTo)}`,
    emailLine,
    "",
    "Execute:",
    `- Run via exec: ${runnerCommand}`,
    "",
    "Output requirements:",
    "- Print the report to stdout (cron deliver will DM it).",
    "- If PROMPTSEC_EMAIL_TO is set, email the same report to that address; if email fails, append a NOTE line to stdout.",
    "- Do not apply fixes automatically.",
  ].join("\n");
}

function buildDescription({ dmChannel, dmTo, emailTo }) {
  const emailPart = emailTo ? `; email ${emailTo}` : "; email disabled unless configured";
  return `Runs openclaw security audit daily and delivers to ${dmChannel}:${dmTo}${emailPart}.`;
}

function findExistingJobId(listJson) {
  const jobs = Array.isArray(listJson?.jobs) ? listJson.jobs : [];
  const match = jobs.find((j) => j?.name === JOB_NAME);
  return match?.id ?? null;
}

async function run() {
  // Non-interactive first (MDM-friendly)
  const tzEnv = envOrEmpty("PROMPTSEC_TZ");
  const dmChannelEnv = envOrEmpty("PROMPTSEC_DM_CHANNEL");
  const dmToEnv = envOrEmpty("PROMPTSEC_DM_TO");
  const hostLabelEnv = envOrEmpty("PROMPTSEC_HOST_LABEL");
  const emailToEnv = envOrEmpty("PROMPTSEC_EMAIL_TO");

  const interactive = !(tzEnv && dmChannelEnv && dmToEnv);

  const tz = interactive
    ? await prompt("Timezone for daily 11pm run (IANA)", { defaultValue: tzEnv || DEFAULT_TZ })
    : tzEnv || DEFAULT_TZ;

  const dmChannel = interactive
    ? await prompt("DM channel (e.g. telegram, slack, discord)", { defaultValue: dmChannelEnv })
    : dmChannelEnv;

  const dmTo = interactive
    ? await prompt("DM recipient id (Telegram numeric chatId/userId preferred)", { defaultValue: dmToEnv })
    : dmToEnv;

  const hostLabel = interactive
    ? await prompt("Optional host label to include in report", { defaultValue: hostLabelEnv })
    : hostLabelEnv;
  const emailTo = interactive
    ? await prompt("Optional email recipient (leave empty to disable email)", { defaultValue: emailToEnv })
    : emailToEnv;

  const installDirDefault = defaultInstallDir();
  const installDirInput = interactive
    ? await prompt("Install dir containing scripts/runner.sh", { defaultValue: installDirDefault })
    : installDirDefault;
  const installDir = resolveUserPath(installDirInput, "install dir containing scripts/runner.sh");

  if (!dmChannel || !dmTo) {
    throw new Error("Missing DM target. Set PROMPTSEC_DM_CHANNEL and PROMPTSEC_DM_TO (or run interactively). ");
  }

  const runnerPath = path.join(installDir, "scripts", "runner.sh");
  if (!fs.existsSync(runnerPath)) {
    throw new Error(`runner.sh not found at ${runnerPath}; set PROMPTSEC_INSTALL_DIR to the deployed path`);
  }

  printPreflightSummary({ dmChannel, dmTo, emailTo, installDir, tz, hostLabel });

  const listOut = sh("openclaw", ["cron", "list", "--json"]);
  const listJson = JSON.parse(listOut);
  const existingId = findExistingJobId(listJson);

  const agentMessage = buildAgentMessage({ dmChannel, dmTo, hostLabel, installDir, emailTo });
  const description = buildDescription({ dmChannel, dmTo, emailTo });

  if (!existingId) {
    const args = [
      "cron",
      "add",
      "--name",
      JOB_NAME,
      "--description",
      description,
      "--session",
      "isolated",
      "--wake",
      "now",
      "--cron",
      DEFAULT_EXPR,
      "--tz",
      tz,
      "--message",
      agentMessage,
      "--deliver",
      "--channel",
      dmChannel,
      "--to",
      dmTo,
      "--best-effort-deliver",
      "--post-prefix",
      "[daily security audit]",
      "--post-mode",
      "summary",
      "--json",
    ];
    const out = sh("openclaw", args);
    const job = JSON.parse(out);
    process.stdout.write(`Created cron job ${job.id}: ${JOB_NAME}\n`);
  } else {
    const args = [
      "cron",
      "edit",
      existingId,
      "--name",
      JOB_NAME,
      "--description",
      description,
      "--enable",
      "--session",
      "isolated",
      "--wake",
      "now",
      "--cron",
      DEFAULT_EXPR,
      "--tz",
      tz,
      "--message",
      agentMessage,
      "--deliver",
      "--channel",
      dmChannel,
      "--to",
      dmTo,
      "--best-effort-deliver",
      "--post-prefix",
      "[daily security audit]",
    ];
    sh("openclaw", args);
    process.stdout.write(`Updated cron job ${existingId}: ${JOB_NAME}\n`);
  }
}

run().catch((err) => {
  process.stderr.write(String(err?.stack || err) + "\n");
  process.exit(1);
});

{
  "name": "openclaw-audit-watchdog",
  "version": "0.1.7",
  "description": "Automated daily security audits for OpenClaw agents with DM delivery and optional email reporting. Creates or updates an unattended cron job and sends formatted reports to configured recipients.",
  "author": "prompt-security",
  "license": "AGPL-3.0-or-later",
  "homepage": "https://clawsec.prompt.security",
  "keywords": [
    "security",
    "audit",
    "watchdog",
    "agents",
    "ai",
    "reporting",
    "cron",
    "monitoring"
  ],
  "sbom": {
    "files": [
      {
        "path": "SKILL.md",
        "required": true,
        "description": "Audit watchdog skill documentation"
      },
      {
        "path": "scripts/runner.sh",
        "required": true,
        "description": "Main runner script"
      },
      {
        "path": "scripts/run_audit_and_format.sh",
        "required": true,
        "description": "Audit execution and formatting"
      },
      {
        "path": "scripts/codex_review.sh",
        "required": false,
        "description": "Codex-based code review"
      },
      {
        "path": "scripts/render_report.mjs",
        "required": false,
        "description": "Report rendering (Node.js)"
      },
      {
        "path": "scripts/sendmail_report.sh",
        "required": false,
        "description": "Sendmail delivery"
      },
      {
        "path": "scripts/send_smtp.mjs",
        "required": false,
        "description": "SMTP delivery (Node.js)"
      },
      {
        "path": "scripts/load_suppression_config.mjs",
        "required": false,
        "description": "Suppression configuration loading and path normalization used by report rendering"
      },
      {
        "path": "scripts/setup_cron.mjs",
        "required": false,
        "description": "Cron job setup"
      }
    ]
  },
  "openclaw": {
    "emoji": "🔭",
    "category": "security",
    "requires": {
      "bins": [
        "bash",
        "openclaw",
        "node"
      ]
    },
    "runtime": {
      "required_env": [
        "PROMPTSEC_DM_CHANNEL",
        "PROMPTSEC_DM_TO"
      ],
      "optional_env": [
        "PROMPTSEC_EMAIL_TO",
        "PROMPTSEC_TZ",
        "PROMPTSEC_HOST_LABEL",
        "PROMPTSEC_INSTALL_DIR",
        "PROMPTSEC_GIT_PULL",
        "OPENCLAW_AUDIT_CONFIG",
        "PROMPTSEC_SENDMAIL_BIN",
        "PROMPTSEC_SMTP_HOST",
        "PROMPTSEC_SMTP_PORT",
        "PROMPTSEC_SMTP_HELO",
        "PROMPTSEC_SMTP_FROM"
      ],
      "optional_bins": [
        "git",
        "sendmail"
      ]
    },
    "delivery": {
      "dm": "required",
      "email": "optional via PROMPTSEC_EMAIL_TO",
      "email_transport": [
        "local sendmail",
        "SMTP relay configured with PROMPTSEC_SMTP_*"
      ]
    },
    "execution": {
      "always": false,
      "persistence": "Creates or updates a recurring openclaw cron job when setup is run.",
      "network_egress": "Reports are delivered to the configured DM target and optionally to the configured email recipient."
    },
    "operator_review": [
      "Verify the openclaw CLI and node runtime on the host before enabling the cron job.",
      "Review DM and email recipients before installing because reports are delivered externally.",
      "If email is enabled, verify the local sendmail binary or PROMPTSEC_SMTP_* relay settings.",
      "Suppressions require both --enable-suppressions and enabledFor: [\"audit\"] in config."
    ],
    "triggers": [
      "audit watchdog",
      "security audit",
      "daily audit",
      "run audit",
      "audit report",
      "security report",
      "watchdog check",
      "deep audit"
    ]
  }
}