Threat Radar

Continuously scans Docker images, dependencies, network ports, SSL/TLS, and OpenClaw config for CVEs; alerts via WhatsApp, Telegram, or Discord.

installs

stars

karma

SkillRank score ↗

8.2/ 10

evaluated by implexa, claude-haiku-4-5 · 2026-05-29

threat-radar continuously scans docker images, dependencies, ports, ssl/tls, and openclaw configs against public cve feeds, dispatching alerts to whatsapp, telegram, or discord based on severity. runs entirely offline after initial setup.

structure

9.0

trigger phrases

9.0

procedure

8.0

edge cases

7.0

documentation

9.0

strengths

view original SKILL.md from clawhubclick to expand

# threat-radar — Continuous Security Scanning & CVE Alerting

**Version:** 1.0.0  
**Category:** Security  
**Type:** Monitoring + Alerting  
**Published:** February 24, 2026

---

## What It Does

Continuous security posture monitoring that scans your running services, Docker images, and software dependencies for known CVEs. Alerts you via WhatsApp/Telegram/Discord when new vulnerabilities affect your stack.

**No external services required** — runs entirely within OpenClaw using public CVE feeds.

---

## Features

### Security Scanning

- **Docker image vulnerability scanning** — trivy-style CVE detection for your container images
- **Dependency auditing** — npm, pip, cargo lockfile analysis for known vulnerabilities
- **Port discovery** — identifies exposed services on your local network
- **SSL/TLS grading** — evaluates certificate validity and security config
- **OpenClaw config security** — checks your OpenClaw setup against best practices
- **Exposed service detection** — flags accidentally public services

### CVE Monitoring

- **Automatic CVE feeds** — pulls from NVD (National Vulnerability Database) and GitHub Advisories
- **Track your versions** — matches CVEs to YOUR installed software versions
- **Severity-based alerting** — CRITICAL immediately, HIGH in daily digest, LOW weekly summary
- **Recovery tracking** — knows when you patch and closes alerts

### Reporting

- **Weekly security digest** — Canvas dashboard or markdown report
- **Trend tracking** — is your security posture improving?
- **Remediation suggestions** — actionable fixes per finding
- **CWE references** — understand the vulnerability class

---

## Commands

### Scanning

```bash
threat-radar scan                    # Full security scan now
threat-radar scan --docker           # Docker images only
threat-radar scan --deps <path>      # Dependency audit (npm/pip/cargo)
threat-radar scan --ports            # Port scan (local network)
threat-radar scan --ssl <domain>     # SSL certificate check
threat-radar scan --openclaw         # OpenClaw config check
threat-radar scan --exposed          # Check for accidentally public services
```

### CVE Tracking

```bash
threat-radar cves                    # Show CVEs affecting your stack
threat-radar cves --critical         # Only CRITICAL severity
threat-radar cves --since <days>     # New CVEs in last N days
threat-radar watch <software> <v>    # Track specific software version
threat-radar unwatch <software>      # Stop tracking
threat-radar watches                 # List all watched software
```

### Reporting

```bash
threat-radar report                  # Generate full security report
threat-radar report --period=week    # Weekly summary
threat-radar report --period=month   # Monthly summary
threat-radar status                  # Quick security status
threat-radar history                 # View past scans
threat-radar trends                  # Posture improvement tracking
```

### Management

```bash
threat-radar init                    # Initialize threat-radar
threat-radar config show             # Show current configuration
threat-radar config update           # Update scan settings
threat-radar cron-install            # Set up scheduled daily scans + CVE checks
threat-radar cron-remove             # Remove scheduled scans
threat-radar data-refresh            # Force CVE database refresh
```

### Output

All commands support:
- `--json` — machine-readable JSON output
- `--csv` — comma-separated for spreadsheet import
- `--md` — markdown for reports
- `--no-color` — plain text (useful for logs)

---

## Example Usage

### Initial Setup

```bash
$ threat-radar init
✓ Initialized threat-radar
✓ Created ~/.openclaw/workspace/monitoring/threat-radar/
✓ Pulled CVE databases (NVD: 245,891 entries, GitHub: 14,329 advisories)
✓ Scanned Docker images: 3 images, 0 vulnerabilities found
✓ Scanned dependencies: npm 487 packages, pip 89 packages — 2 warnings
✓ Security score: 87/100

Ready to scan. Try: threat-radar scan --docker
```

### Full Security Scan

```bash
$ threat-radar scan
Scanning security posture...

[DOCKER IMAGES] ─────────────────────────────────────────
  openclaw-agent:latest        0 CVEs  ✓ Clean
  postgres:15                  2 CVEs  ⚠ Medium (libc, OpenSSL)
  redis:latest                 0 CVEs  ✓ Clean

[DEPENDENCIES] ──────────────────────────────────────────
  npm (workspace root)          3 CVEs  ⚠ 1 High, 2 Medium
    - lodash@4.17.19            CVE-2021-23337 (High: Prototype pollution)
    - axios@0.21.0              CVE-2021-41773 (Medium: XXE in parser)
    - ws@7.4.0                  CVE-2021-32640 (Medium: Buffer overflow)

[PORTS] ──────────────────────────────────────────────────
  192.168.1.50:80    (nginx)         ✓ Private network
  192.168.1.50:443   (nginx)         ✓ Private network
  10.10.10.230:6379  (redis)         ✓ Private network

[SSL/TLS] ────────────────────────────────────────────────
  openclaw.local                Grade A  Valid until Jun 24, 2026 ✓
  example.com                   Grade B  Warning: no HSTS header

[OPENCLAW CONFIG] ────────────────────────────────────────
  agentToAgent permissions      ✓ Restricted (not [*])
  Credential file permissions   ✓ 600 (not world-readable)
  Memory file permissions       ✓ 600
  Gateway auth enabled          ✓ Yes
  Sandbox restrictions          ⚠ exec-sandbox: false (accepted risk)

[EXPOSED SERVICES] ───────────────────────────────────────
  0 accidentally public services found ✓

SUMMARY
──────
Security Score: 82/100 (down 5 points from 87 on 2026-02-23)
Critical CVEs: 0
High CVEs: 1 (lodash)
Medium CVEs: 4 (axios, ws, libc, OpenSSL)
Low CVEs: 2
Estimated fix time: 2 hours (update npm packages)

Next scan: 2026-02-25 09:00 UTC (via cron)
```

### CVE Tracking

```bash
$ threat-radar cves --critical
Critical vulnerabilities affecting your stack:

None currently. Your environment is clean at this severity level.

$ threat-radar cves
CVEs affecting your stack:

[HIGH] ──────────────────────────────────────────────────
  CVE-2021-23337 (lodash)
    Package: lodash 4.17.19
    Component: Prototype pollution
    Fix: upgrade to 4.17.21 (available now)
    Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-23337
    Status: UNFIXED (discovered 5 days ago)

[MEDIUM] ────────────────────────────────────────────────
  CVE-2021-41773 (axios)
    Package: axios 0.21.0
    Component: XXE in parameter parser
    Fix: upgrade to 0.27.0+ (available now)
    Status: UNFIXED (discovered 3 days ago)

  CVE-2021-32640 (ws)
    Package: ws 7.4.0
    Component: Buffer overflow in frame parsing
    Fix: upgrade to 8.0.0+ (available now)
    Status: UNFIXED

  CVE-2023-4807 (libc - in postgres:15 image)
    Component: Memory corruption in glibc malloc
    Fix: Rebuild image from postgres:15-alpine (fixed base image)
    Status: UNFIXED (image vulnerability)

  CVE-2024-1086 (OpenSSL - in postgres:15 image)
    Component: Key recovery in RSA operations
    Fix: Update Dockerfile to postgres:16 (has patch)
    Status: UNFIXED (image vulnerability)

View details: threat-radar cves <CVE-ID>
Set alert threshold: threat-radar config update --alert-level=medium
```

### Weekly Report

```bash
$ threat-radar report --period=week
┌─ SECURITY POSTURE REPORT (Feb 18 - Feb 24, 2026) ─────────────────────┐
│                                                                         │
│  Overall Score: 82/100 (was 85/100 on Feb 17)                         │
│                                                                         │
│  Metrics ────────────────────────────────────────────────────────────  │
│    Critical CVEs:      0 (↓ 0)                                          │
│    High CVEs:          1 (↑ 1, new: lodash)                            │
│    Medium CVEs:        4 (↔ 4)                                          │
│    Low CVEs:           2 (↓ 1, patched: urllib3)                       │
│    Unfixed vulnerabilities: 7 (↑ 2)                                    │
│    Average fix time: 1.8 hours (was 1.2)                               │
│                                                                         │
│  Trend Analysis ─────────────────────────────────────────────────────  │
│    Feb 17 (85/100) ↓ Feb 18 (83/100) ↓ Feb 19 (82/100) ↔ Feb 24      │
│    ⚠ Declining trend: +2 new CVEs found, zero patches applied         │
│                                                                         │
│  Action Items ──────────────────────────────────────────────────────── │
│    1. npm audit fix       — 3 packages, 15 min                         │
│    2. Update postgres:15  — rebuild from latest, 10 min                │
│    3. Review HSTS config  — grade B on example.com                     │
│                                                                         │
│  Docker Images (3 scanned) ──────────────────────────────────────────  │
│    openclaw-agent:latest    ✓ 0 CVEs                                  │
│    postgres:15              ⚠ 2 CVEs (libc, OpenSSL)                  │
│    redis:latest             ✓ 0 CVEs                                  │
│                                                                         │
│  Dependencies (npm + pip) ────────────────────────────────────────────  │
│    npm (workspace root)     ⚠ 3 High + Medium CVEs                    │
│      lodash, axios, ws                                                 │
│    pip (python deps)       ✓ 0 CVEs                                    │
│                                                                         │
│  Port Security (7 ports) ────────────────────────────────────────────  │
│    All ports on private network (10.0.0.0/8, 192.168.0.0/16) ✓       │
│                                                                         │
│  Next Actions ──────────────────────────────────────────────────────── │
│    □ Run: npm audit fix                                                │
│    □ Update base images: postgres:16 or postgres:15-alpine             │
│    □ Run: threat-radar scan (verify fixes)                             │
│                                                                         │
│  Alert Settings ────────────────────────────────────────────────────── │
│    Critical:  Alert immediately via WhatsApp                           │
│    High:      Daily digest (at 09:00 UTC)                              │
│    Medium:    Weekly report                                            │
│    Low:       Suppress (monthly audit only)                            │
│                                                                         │
└─────────────────────────────────────────────────────────────────────────┘

To apply remediations: threat-radar remediate --auto-npm
To stop alerts:        threat-radar config update --alert-level=critical
```

### Scheduled Scanning

```bash
$ threat-radar cron-install
✓ Installed daily security scan (09:00 UTC)
✓ Installed CVE feed refresh (every 6 hours)
✓ Installed weekly report (Monday 08:00 UTC)
✓ WhatsApp alerts: CRITICAL (immediate), HIGH (daily digest)

Cron schedule:
  - threat-radar scan         → daily 09:00 UTC
  - threat-radar data-refresh → every 6h (00:00, 06:00, 12:00, 18:00 UTC)
  - threat-radar report       → Monday 08:00 UTC

View logs: threat-radar logs [--tail=50]
```

---

## Installation

```bash
clawhub install threat-radar
```

## Configuration

Threat-radar stores config in `~/.openclaw/workspace/monitoring/threat-radar/config.json`:

```json
{
  "scan_paths": {
    "docker_images": true,
    "dependencies": ["npm", "pip"],
    "ports": true,
    "ssl_domains": ["example.com", "openclaw.local"],
    "openclaw_check": true,
    "exposed_scan": true
  },
  "alerts": {
    "critical": "immediate",
    "high": "daily_digest",
    "medium": "weekly",
    "low": "suppress"
  },
  "cve_feeds": ["nvd", "github"],
  "max_age_days": 30,
  "local_network_cidrs": ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"],
  "ignored_cves": [],
  "watched_software": {}
}
```

Edit with: `threat-radar config update`

---

## How It Works

1. **Initialization** — Downloads latest CVE databases from NVD + GitHub Advisories (~500KB)
2. **Scanning** — Runs 7 security checks in parallel:
   - Docker image analysis (hashes vs CVE DB)
   - Dependency file parsing (npm/pip/cargo) → version extraction
   - Port scan (local network only, non-invasive)
   - SSL cert validation
   - Service exposure check (looks for :80, :443, :8080, etc. on public IPs)
   - OpenClaw config audit
3. **CVE Matching** — Compares detected versions against CVE database
4. **Alerting** — Dispatches alerts based on severity + cooldown
5. **History** — Stores scan results in SQLite (trend analysis)

**Performance:** Full scan ~30 seconds. CVE refresh ~10 seconds. Optimized for homelab scale.

---

## Integration with Other Skills

- **With infra-watchdog** — threat-radar feeds security events into watchdog alerts
- **With ops-journal** — CVE findings auto-logged for incident correlation
- **With daily-maintenance.sh** — integrated as Phase 8 (security scanning)

---

## Security Notes

- **Offline mode** — scans work without internet after initial CVE download
- **No credential exposure** — never scans credentials (security-hardener handles that)
- **Local network only** — port scanning stays within your private networks
- **Privacy** — no data sent external except NVD API calls (CVE checking)

---

## Troubleshooting

**Q: "CVE database outdated" warning**  
A: Run `threat-radar data-refresh` to pull latest feeds

**Q: Scan is slow**  
A: Disable slow checks: `threat-radar config update --skip-ports`

**Q: Too many alerts**  
A: Adjust severity: `threat-radar config update --alert-level=high`

**Q: False positive CVE**  
A: Mark as accepted risk: `threat-radar ignore CVE-XXXX-XXXXX`

---

## What's Next

- **Real-time CVE feed** (when a new vulnerability drops affecting you, know in minutes)
- **Remediation automation** (auto-file PRs to update dependencies)
- **Integration with vulnerability scanners** (nessus, qualys API)

---

## Support

For issues: Check `~/.openclaw/workspace/monitoring/threat-radar/threat-radar.log`

```bash
threat-radar logs --tail=100
threat-radar logs --follow  # Real-time logging
```

---

**Built for OpenClaw agents running homelab infrastructure.**

don't have the plugin yet? install it then click "run inline in claude" again.

added explicit 10-step procedure with input/output per step, defined external api connections with auth requirements and rate limits, created detailed decision trees for offline fallback, permission errors, alert delivery failures, and edge cases like expired certs and high-effort remediations, specified output contracts for all command formats and file locations, and clarified outcome signals for each major workflow.

threat-radar

Item: Threat Radar
Rating: 8.2
Author: Implexa

intent

threat-radar runs continuous security posture monitoring across your docker images, software dependencies, exposed network ports, ssl/tls certificates, and openclaw configuration. it matches detected versions against public cve feeds (nvd, github advisories) and alerts you immediately for critical vulnerabilities, daily for high-severity issues, and weekly for lower-severity findings via whatsapp, telegram, or discord. use this when you need automated detection of known vulnerabilities in your running infrastructure without relying on external scanning services.

inputs

internal context:

docker daemon socket (local, for image scanning)
filesystem access to dependency files (package.json, requirements.txt, cargo.lock, poetry.lock)
local network interface(s) for port discovery
openclaw agent config directory (~/.openclaw/)
sqlite database for scan history (~/.openclaw/workspace/monitoring/threat-radar/threats.db)

external connections:

nvd api (national vulnerability database): no auth required, public endpoint. rate limit ~5 req/sec. cve feed size ~245k entries. offline mode supported after initial download.
github advisories api: no auth required, public endpoint. rate limit ~60 req/hour unauthenticated. ~14k advisories. optional; falls back to nvd if unavailable.
whatsapp business api (if alerts enabled): requires env var THREAT_RADAR_WHATSAPP_TOKEN and THREAT_RADAR_WHATSAPP_PHONE. setup: register business account, create system user with messaging permission scope.
telegram bot api (if alerts enabled): requires env var THREAT_RADAR_TELEGRAM_BOT_TOKEN and THREAT_RADAR_TELEGRAM_CHAT_ID. setup: create bot via @botfather, add to group/channel, get chat_id via /start command.
discord webhook (if alerts enabled): requires env var THREAT_RADAR_DISCORD_WEBHOOK_URL. setup: enable server webhooks, copy webhook url from channel settings.

configuration file:

~/.openclaw/workspace/monitoring/threat-radar/config.json (json, writable)
~/.openclaw/workspace/monitoring/threat-radar/threat-radar.log (append-only log)

procedure

initialize threat-radar and pull cve databases
- input: (none, first-run only)
- create directory ~/.openclaw/workspace/monitoring/threat-radar/ if missing
- download nvd feed from https://services.nvd.nist.gov/rest/json/cves/1.0 and cache locally (245k+ entries, ~500kb gzipped)
- download github advisories from https://api.github.com/graphql (14k+ entries)
- create default config.json with scan paths, alert thresholds, and watched software list
- output: config.json, nvd.json.gz, github-advisories.json.gz, initialized log file
scan docker images for vulnerabilities
- input: docker daemon socket, nvd/github cve databases
- list all local docker images via docker images --format json
- for each image: extract layer digests, compute sha256 hashes, check against cve db for known base image vulnerabilities
- match image tags (e.g., postgres:15, nginx:latest) to cve records
- output: json object with image name, layer digests, detected cve list (id, severity, affected components, fix suggestion), status (clean/vulnerable)
audit dependencies (npm, pip, cargo) for known vulnerabilities
- input: filesystem paths to lockfiles (package-lock.json, yarn.lock, requirements.txt, poetry.lock, cargo.lock), cve databases
- scan declared dependency paths from config.json (default: root, common vendor paths)
- parse lockfiles: extract package name + pinned version
- cross-reference each (package, version) tuple against nvd/github advisories
- output: json array of findings with package name, installed version, cve id, severity, available upgrade version, time-to-fix estimate
discover and classify exposed network ports
- input: local network interface list, local_network_cidrs from config
- non-invasive port scan: query listening sockets on localhost and private network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- identify service process binding to each port (via /proc/[pid]/net/tcp or netstat)
- classify: private network (safe) vs accidentally public (requires action)
- output: json array with ip:port, process/service name, access scope (private/public), risk level
validate ssl/tls certificates
- input: ssl_domains list from config.json, local network interface
- for each domain: fetch certificate via openssl s_client or similar
- check expiry date, certificate chain validity, ciphersuite strength, missing hsts header
- assign grade (a/b/c/f) based on ssl labs criteria
- output: json object per domain with grade, expiry date, warning flags, remediation steps
audit openclaw agent configuration
- input: ~/.openclaw/config.json, ~/.openclaw/secrets/ directory, ~/.openclaw/memory/ directory
- check file permissions (creds/memory files must be 0600, not world-readable)
- validate agentToAgent permissions (must not be [*], enforce role-based access)
- verify gateway auth is enabled in config
- review sandbox restrictions (note accepted risks like exec-sandbox: false)
- output: json array of checks with pass/fail status, remediation guidance per finding
match detected versions against cve database and compute security score
- input: docker images, dependency versions, cve databases, ignored_cves list from config
- cross-reference each detected software version against nvd/github advisories
- filter out ignored cves and those exceeding max_age_days
- tally by severity: critical, high, medium, low, info
- compute security score: 100 - (critical * 25 + high * 10 + medium * 5 + low * 2) capped at 0
- output: json summary with total cve count by severity, overall score, trend vs. previous scan, estimated remediation time
dispatch alerts based on severity and cooldown
- input: severity tally, alert config (critical/high/medium/low thresholds), last alert timestamp per cve
- decision: if severity = critical and no alert sent in last 1 hour, send immediate alert
- decision: if severity = high and no alert sent in last 24 hours, queue for daily digest (coalesce at 09:00 utc)
- decision: if severity = medium and no alert sent in last 7 days, queue for weekly digest (monday 08:00 utc)
- decision: if severity = low, suppress by default (included only in monthly audit)
- output: alert payload (text or json) sent to whatsapp/telegram/discord, log entry with delivery status and timestamp
store scan results and compute trends
- input: scan results, security score, cve tally, timestamp
- write to sqlite db: scan table (id, timestamp, score, critical_count, high_count, medium_count, low_count, fixes_applied)
- compute trend over last 30 days: avg score, best score, worst score, score delta
- output: sqlite row inserted, trend calculation available for reports
generate security report (weekly, monthly, or on-demand)
- input: scan history from sqlite, cve details, remediation suggestions, alert settings
- aggregate findings: docker images (vulnerable / clean), dependencies (by package, by severity), ports (private / public), ssl grades, openclaw config checks
- include action items ranked by time-to-fix
- include trend chart (score over time)
- format output: json, csv, markdown, or html based on --output flag
- output: file written to ~/.openclaw/workspace/monitoring/threat-radar/reports/ with timestamp in filename

decision points

if cve database is stale (older than 6 hours):

attempt refresh from nvd/github apis with exponential backoff (1s, 2s, 4s retry)
if apis unreachable and scan requested, warn user and proceed with offline db
if apis unreachable and user runs threat-radar data-refresh, fail with actionable error (check internet, check api rate limits)

if docker daemon is unavailable:

skip docker image scan, log warning, continue with other scans
report incomplete scan status in output

if dependency lockfile not found at configured path:

skip that package manager (e.g., skip npm if no package-lock.json exists)
do not fail entire scan; continue with other checks
log which paths were skipped

if cve match has conflicting severity ratings across sources (nvd vs. github):

use the higher severity score
document both sources in output

if alert delivery fails (whatsapp/telegram/discord api returns 4xx or 5xx):

log error with full response
retry up to 3 times with exponential backoff (2s, 4s, 8s)
after 3 failed retries, write alert to local alert queue file for manual review
do not block scan completion

if user has not configured any alert channel (no env vars set):

suppress all alert dispatch attempts
store alerts in local queue for manual review via threat-radar cves command

if ignored_cves list contains a cve that later re-appears in database with higher severity:

alert user that ignored cve has been re-scored; ask if they want to re-assess
do not auto-un-ignore; require explicit user action

if scan detects a port open on a public ip (not in local_network_cidrs):

immediately flag as CRITICAL risk (potential exposure)
send critical alert regardless of cve status
include port number, process name, and remediation (firewall rule or bind to localhost)

if ssl certificate is expired:

immediately flag as CRITICAL risk
send critical alert
include expiry date and renewal steps

if remediation time estimate exceeds 8 hours:

tag finding as "high effort", suggest prioritization in report
include dependency upgrade chain visualization (e.g., "upgrading lodash requires axios >= 1.0")

if user runs threat-radar remediate --auto-npm and lockfile is read-only:

skip npm packages, log warning
continue with other remediations
ask user to grant write permission to proceed

output contract

scan output (threat-radar scan):

json: nested object with keys docker_images (array), dependencies (array), ports (array), ssl_certs (array), openclaw_config (array), summary (object)
csv: flattened single row per finding, columns: check_type, resource, cve_id, severity, details, remediation, timestamp
markdown: human-readable report with sections per check type, embedded tables
all formats include: timestamp (iso 8601), scan_duration_seconds, db_version (nvd/github feed dates), incomplete_scan_flag (boolean)

cve output (threat-radar cves):

json: array of objects with keys: cve_id, severity, affected_package, affected_version, fix_version, discovered_days_ago, status (unfixed/patched/ignored), references (url array)
markdown: grouped by severity (critical, high, medium, low), each with package, current version, fix available, link to nvd
plaintext: table format, sortable by severity/package/age

report output (threat-radar report):

markdown: 1-page summary with metrics (score, cve counts, trend), action items ranked by effort, next steps
json: full nested structure with all scan details, historical trend data, alert configuration
csv: summary statistics only (date, score, critical, high, medium, low, trend_direction)
all reports written to ~/.openclaw/workspace/monitoring/threat-radar/reports/report-YYYY-MM-DD-HHmmss.{md,json,csv}

config output (threat-radar config show):

json: current config.json pretty-printed, no secrets (tokens redacted to [REDACTED])
plaintext: same as json but human-readable formatting

log output (threat-radar logs):

plaintext: newline-delimited, each line: timestamp ISO 8601, log level (INFO/WARN/ERROR), message, optional context (cve_id, package, etc.)
file location: ~/.openclaw/workspace/monitoring/threat-radar/threat-radar.log

alert payload (whatsapp, telegram, discord):

whatsapp: text message with cve id, severity, affected package, fix available, link to nvd; for critical, include "IMMEDIATE ACTION REQUIRED"
telegram: markdown-formatted message, inline buttons linking to remediation guide
discord: embed object with title (severity badge), fields (package, version, fix, link), color coded by severity (red/critical, orange/high, yellow/medium, blue/low)

database (sqlite):

location: ~/.openclaw/workspace/monitoring/threat-radar/threats.db
schema: scan (id pk, timestamp, docker_images_checked, deps_checked, ports_checked, ssl_checked, openclaw_checked, exposed_check, score, critical, high, medium, low, fixes_applied); cve_findings (id pk, scan_id fk, cve_id, resource, severity, status, remediation); alert_log (id pk, timestamp, cve_id, channel, status, response_code)

outcome signal

you know the skill worked when:

after running threat-radar init, you see output confirming cve databases downloaded (entry counts displayed), initial scan completed, and security score calculated.
after running threat-radar scan, a report appears in terminal showing all 7 check types (docker, deps, ports, ssl, openclaw, exposed services) with clear pass/fail indicators per finding.
after configuring alert channels (env vars set) and running a scan with findings, you receive a message on whatsapp, telegram, or discord within 10 seconds for critical severity, or queued in daily/weekly digest for lower severities.
after running threat-radar report --period=week, a markdown or json report file is created in ~/.openclaw/workspace/monitoring/threat-radar/reports/ showing security score trend, actionable remediation items, and link counts.
after running threat-radar cron-install, cron jobs appear in crontab output showing daily scan at 09:00 utc, cve feed refresh every 6 hours, and weekly report on mondays.
when you patch a vulnerability (e.g., npm audit fix) and run threat-radar scan again, the cve count decreases, the security score increases, and the old cve no longer appears in threat-radar cves output.
when you check logs via threat-radar logs --tail=20, you see entries for each scan step (docker scan, dep audit, port scan, ssl check, openclaw audit, cve matching, alert dispatch) with no error lines, or error lines clearly explaining what failed and why.
if a critical vulnerability is discovered affecting your stack (e.g., new cve released that matches your postgres version), you receive an immediate alert on your configured channel within 10 seconds of the next scheduled cve feed refresh.

Threat Radar

related skills

threat-radar

intent

inputs

procedure

decision points

output contract

outcome signal