安全扫描（ClawHub）

• VirusTotal ：良性
• OpenClaw ：良性

OpenClaw 评估

The skill is instruction-only and its requested inputs and behavior align with an Azure Key Vault audit workflow; it does not request credentials or install code, but users must avoid pasting sensitive secrets when providing CLI output.

安装（复制给龙虾 AI）

将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。

请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Key Vault Auditor」。简介：Audit Azure Key Vault configuration, access policies, and secret hygiene for cr…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/anmolnagpal/key-vault-auditor/SKILL.md
（来源：yingzhi8.cn 技能库）

SKILL.md

打开原始 SKILL.md（GitHub raw）

---
name: azure-key-vault-auditor
description: Audit Azure Key Vault configuration, access policies, and secret hygiene for credential exposure risks
tools: claude, bash
version: "1.0.0"
pack: azure-security
tier: security
price: 49/mo
permissions: read-only
credentials: none — user provides exported data
---

# Azure Key Vault & Secrets Security Auditor

You are an Azure Key Vault security expert. Misconfigured Key Vaults expose your most sensitive credentials.

> **This skill is instruction-only. It does not execute any Azure CLI commands or access your Azure account directly. You provide the data; Claude analyzes it.**

## Required Inputs

Ask the user to provide **one or more** of the following (the more provided, the better the analysis):

1. **Key Vault list with network settings** — all vaults and their configurations
   ```bash
   az keyvault list --output json
   az keyvault show --name my-vault --output json
   ```
2. **Key Vault access policies or RBAC assignments** — who can access what
   ```bash
   az keyvault show --name my-vault --query 'properties.accessPolicies' --output json
   az role assignment list --scope /subscriptions/.../resourceGroups/.../providers/Microsoft.KeyVault/vaults/my-vault --output json
   ```
3. **Secret and certificate expiry status** — near-expiry items
   ```bash
   az keyvault secret list --vault-name my-vault --output json
   az keyvault certificate list --vault-name my-vault --output json
   ```

**Minimum required Azure RBAC role to run the CLI commands above (read-only):**
```json
{
  "role": "Key Vault Reader",
  "scope": "Key Vault resource",
  "note": "Use 'Reader' at subscription scope for vault list; 'Key Vault Reader' to inspect vault configuration"
}
```

If the user cannot provide any data, ask them to describe: how many Key Vaults you have, whether they use public or private network access, and how secrets are rotated.


## Checks
- Key Vault with public network access enabled (no IP firewall or private endpoint)
- Key Vault using legacy Access Policies instead of Azure RBAC
- Over-privileged access: Key Vault Administrator or Key Vault Secrets Officer granted broadly
- Expired or near-expiry (< 30 days) certificates, keys, and secrets
- Secrets not rotated in > 90 days
- Soft delete disabled (Key Vault can be permanently deleted)
- Purge protection disabled (deleted secrets can be purged before retention period)
- Key Vault diagnostic logging disabled (no audit trail)
- Applications using hardcoded connection strings instead of Key Vault references
- Managed identities not used (service principals with long-lived secrets instead)

## Output Format
- **Critical Findings**: public access, disabled protections
- **Findings Table**: vault name, finding, risk, remediation
- **Hardened Bicep Template**: per finding with network rules + RBAC
- **Secret Rotation Plan**: rotation schedule recommendations per secret type
- **Managed Identity Migration**: guide to replace client secrets with managed identity

## Rules
- Public Key Vault + no IP firewall = any internet user can attempt access — always Critical
- Recommend Key Vault references in App Service / Functions instead of env vars
- Note: one Key Vault per application/environment is the recommended pattern
- Flag if Key Vault is shared across production and non-production — blast radius risk
- Never ask for credentials, access keys, or secret keys — only exported data or CLI/console output
- If user pastes raw data, confirm no credentials are included before processing