Arc Sentinel

Security monitoring toolkit for OpenClaw agents. Runs automated checks against your infrastructure and reports issues.

Features

• SSL Certificate Monitoring — Check expiry dates and alert on certificates nearing expiration
• GitHub Security Audits — Monitor repos for vulnerabilities, check Dependabot status, detect unexpected repos
• Breach Monitoring — HaveIBeenPwned API integration to check for compromised accounts
• Credential Rotation Tracking — Track and alert on overdue credential rotations
• Secret Scanning — Scan repositories and files for leaked secrets and API keys
• Git Hygiene Audits — Check git history for security issues
• Token Watchdog — Monitor token validity and expiration
• Permission Auditing — Audit file and access permissions

Installation

1. Clone this repository:

git clone https://github.com/arc-claw-bot/arc-sentinel.git
cd arc-sentinel

2. Create configuration file:

cp sentinel.conf.example sentinel.conf

3. Edit sentinel.conf with your values:

• DOMAINS — Space-separated list of domains to check SSL certificates
• GITHUB_USER — GitHub username for repo audits
• KNOWN_REPOS — Space-separated list of expected repo names
• MONITOR_EMAIL — Email address for HaveIBeenPwned breach checks
• HIBP_API_KEY — Optional; HIBP v3 API key for automated breach lookups

4. Customize credential-tracker.json with your credentials and rotation policies

Usage

Quick Start

Run a full security scan:

bash sentinel.sh

Output

• Formatted report to stdout with color-coded severity
• JSON report saved to reports/YYYY-MM-DD.json
• Exit codes: 0 = all clear, 1 = warnings, 2 = critical

Individual Scripts

Script	Purpose
scripts/secret-scanner.sh	Scan repos/files for leaked secrets and API keys
scripts/git-hygiene.sh	Audit git history for security issues
scripts/token-watchdog.sh	Monitor token validity and expiry
scripts/permission-auditor.sh	Audit file and access permissions
scripts/skill-auditor.sh	Audit installed skills for security
scripts/full-audit.sh	Run all scripts in sequence

Agent Integration

For OpenClaw agents, use during heartbeats or on-demand:

1. Run bash sentinel.sh from the skill directory
2. Review output for WARN or CRITICAL items
3. Report findings if attention is needed
4. Update credential-tracker.json when credentials are rotated

Automation

Set up weekly scans with cron:

# Weekly Monday 9am
0 9 * * 1 cd /path/to/arc-sentinel && bash sentinel.sh >> reports/cron.log 2>&1

Requirements

• openssl (SSL checks)
• gh CLI authenticated (GitHub checks)
• curl (HIBP API calls)
• python3 (JSON processing)

License

MIT License

Contributing

Issues and pull requests welcome!