configsafe

ConfigSafe — Infrastructure Configuration Auditor

ConfigSafe scans infrastructure configuration files for security misconfigurations across Dockerfiles, docker-compose, Kubernetes manifests, Terraform, CI/CD pipelines, and web server configs. It uses regex-based pattern matching against 80+ misconfiguration patterns, lefthook for git hook integration, and produces markdown security reports with CIS benchmark mapping.

Commands

Free Tier (No license required)

#### configsafe scan [file|directory] One-shot configuration security scan of files or directories.

How to execute:

bash "/scripts/configsafe.sh" scan [target]

What it does: 1. Accepts a file path or directory (defaults to current directory) 2. Auto-detects configuration types (Dockerfile, docker-compose, Kubernetes, Terraform, CI/CD, Nginx/Apache) 3. Finds all config files matching known patterns 4. Runs 80+ misconfiguration patterns against each file 5. Calculates a security score (0-100) per file and overall 6. Outputs findings with: file, line number, check ID, severity, description, recommendation 7. Exit code 0 if secure (score >= 70), exit code 1 if issues found 8. Free tier limited to 5 config files per scan

Example usage scenarios:

Pro Tier ($19/user/month -- requires CONFIGSAFE_LICENSE_KEY)

#### configsafe hooks install Install git pre-commit hooks that scan staged config files before every commit.

How to execute:

bash "/scripts/configsafe.sh" hooks install

What it does: 1. Validates Pro+ license 2. Copies lefthook config to project root 3. Installs lefthook pre-commit hook 4. On every commit: scans all staged config files for misconfigurations, blocks commit if critical/high findings, shows remediation advice

#### configsafe hooks uninstall Remove ConfigSafe git hooks.

bash "/scripts/configsafe.sh" hooks uninstall

#### configsafe report [directory] Generate a markdown security report with findings, severity breakdown, and remediation steps.

bash "/scripts/configsafe.sh" report [directory]

What it does: 1. Validates Pro+ license 2. Runs full scan of the directory 3. Generates a formatted markdown report from template 4. Includes per-file breakdowns, security scores, CIS benchmark references 5. Output suitable for security reviews and compliance audits

#### configsafe benchmark [directory] Run CIS benchmark checks against infrastructure configurations.

bash "/scripts/configsafe.sh" benchmark [directory]

What it does: 1. Validates Pro+ license 2. Maps findings to CIS Docker Benchmark, CIS Kubernetes Benchmark, and CIS AWS Foundations 3. Reports pass/fail status for each benchmark check 4. Outputs overall compliance percentage

Team Tier ($39/user/month -- requires CONFIGSAFE_LICENSE_KEY with team tier)

#### configsafe policy [directory] Enforce organization-specific security policies on infrastructure configurations.

bash "/scripts/configsafe.sh" policy [directory]

What it does: 1. Validates Team+ license 2. Loads custom policies from ~/.openclaw/openclaw.json (configsafe.config.customPolicies) 3. Enforces organization-specific rules (e.g., required labels, forbidden images, mandatory resource limits) 4. Combines custom policies with built-in patterns for comprehensive scanning 5. Outputs SARIF-compatible results

#### configsafe compliance [directory] Generate a full compliance report covering CIS and NIST frameworks.

bash "/scripts/configsafe.sh" compliance [directory]

What it does: 1. Validates Team+ license 2. Runs full scan with all patterns 3. Maps findings to CIS Docker Benchmark, CIS Kubernetes Benchmark, CIS AWS Foundations, and NIST 800-190 4. Generates comprehensive compliance report with pass/fail per control 5. Includes executive summary, detailed findings, and remediation roadmap

#### configsafe status Show license and configuration information.

bash "/scripts/configsafe.sh" status

Detected Misconfigurations

ConfigSafe detects 80+ misconfiguration patterns across 6 config types:

| Category | Examples | Severity | |----------|----------|----------| | Dockerfile | Running as root, latest tag, ADD vs COPY, exposed sensitive ports, missing health checks, secrets in ENV, curl pipe bash, chmod 777, missing multi-stage builds | Critical/High | | docker-compose | privileged: true, host network, Docker socket mount, missing resource limits, plaintext secrets, unbound ports, missing restart policy | Critical/High | | Kubernetes | Running as root, privileged containers, missing security context, missing resource limits, hostPath volumes, default namespace, missing probes, allowPrivilegeEscalation | Critical/High | | Terraform | Hardcoded credentials, missing encryption, public S3 buckets, open security groups (0.0.0.0/0), missing logging, overly permissive IAM, default VPC | Critical/High | | CI/CD Pipelines | Plaintext secrets, PR trigger with write perms, unpinned actions, missing timeout, unrestricted self-hosted runners, artifact upload without expiry | High/Medium | | Nginx/Apache | Missing security headers, server tokens enabled, SSL/TLS misconfig, open proxy, missing rate limiting, directory listing enabled | Medium/High |

Configuration

Users can configure ConfigSafe in ~/.openclaw/openclaw.json:

{
  "skills": {
    "entries": {
      "configsafe": {
        "enabled": true,
        "apiKey": "YOUR_LICENSE_KEY_HERE",
        "config": {
          "severityThreshold": "high",
          "customPolicies": [],
          "excludePatterns": ["/test/", "/examples/"],
          "reportFormat": "markdown"
        }
      }
    }
  }
}

Important Notes

Error Handling

When to Use ConfigSafe

The user might say things like:

Users can configure ConfigSafe in ~/.openclaw/openclaw.json:

{
  "skills": {
    "entries": {
      "configsafe": {
        "enabled": true,
        "apiKey": "YOUR_LICENSE_KEY_HERE",
        "config": {
          "severityThreshold": "high",
          "customPolicies": [],
          "excludePatterns": ["/test/", "/examples/"],
          "reportFormat": "markdown"
        }
      }
    }
  }
}