auditclaw-grcAI-native GRC (Governance, Risk, and Compliance) for OpenClaw. 97 actions across 13 frameworks including SOC 2, ISO 27001, HIPAA, GDPR, NIST CSF, PCI DSS, CI...
Install via ClawdBot CLI:
clawdbot install mailnike/auditclaw-grcAI-native GRC assistant for OpenClaw. Manages compliance frameworks, controls, evidence, risks, policies, vendors, incidents, assets, training, vulnerabilities, access reviews, and questionnaires.
97 actions | 30 tables | 13 frameworks | 990+ controls
~/.openclaw/grc/compliance.sqlite with WAL mode, owner-only permissions (0o600)~/.openclaw/grc/credentials/ with per-provider directories, owner-only permissions (0o700 dirs, 0o600 files), atomic writes, and secure deletion (overwrite with random bytes before removal). Secrets are never logged or exposed in output. See scripts/credential_store.py for implementation.requests==2.31.0 (pinned) for HTTP header scanning. Cloud integrations optionally use boto3 (AWS) and PyJWT (Azure) via try/except -- these are not required and only activate if installed and credentials are configured.These are not required for core GRC functionality. They are only used when the user explicitly sets up cloud provider integrations via companion skills:
| Variable | Used by |
|----------|---------|
| AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY | AWS integration (via auditclaw-aws) |
| GITHUB_TOKEN | GitHub integration (via auditclaw-github) |
| AZURE_SUBSCRIPTION_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET / AZURE_TENANT_ID | Azure integration (via auditclaw-azure) |
| GCP_PROJECT_ID / GOOGLE_APPLICATION_CREDENTIALS | GCP integration (via auditclaw-gcp) |
| GOOGLE_WORKSPACE_SA_KEY / GOOGLE_WORKSPACE_ADMIN_EMAIL | Google Workspace (via auditclaw-idp) |
| OKTA_ORG_URL / OKTA_API_TOKEN | Okta (via auditclaw-idp) |
python3 {baseDir}/scripts/init_db.py
pip install -r {baseDir}/scripts/requirements.txtDatabase: ~/.openclaw/grc/compliance.sqlite
Activate on: compliance, GRC, SOC 2, ISO 27001, HIPAA, GDPR, NIST, PCI DSS, CIS, CMMC, HITRUST, CCPA, FedRAMP, ISO 42001, SOX, ITGC, controls, evidence, risks, audit, gap analysis, security posture, compliance score, framework, security scan.
All queries go through: python3 {baseDir}/scripts/db_query.py --action
Output is JSON. Parse and present as human-readable summaries. For full action reference with all arguments: {baseDir}/references/db-actions.md
| Action | Purpose |
|--------|---------|
| status | Overall compliance overview |
| activate-framework --slug soc2 | Load framework controls |
| gap-analysis --framework soc2 | Gaps with priority and effort |
| score-history --framework soc2 | Score trend over time |
| list-controls --framework soc2 --status in_progress | Filtered controls |
| update-control --id 5 --status complete | Update control (also batch: --id 1,2,3) |
| add-evidence --title "..." --control-ids 1,2,3 | Record evidence |
| add-risk --title "..." --likelihood 3 --impact 4 | Log a risk |
| add-vendor --name "..." --criticality high | Register vendor |
| add-incident --title "..." --severity critical | Log incident |
| generate-report --framework soc2 | HTML compliance report |
| generate-dashboard | Dashboard summary + Canvas HTML |
| export-evidence --framework soc2 | ZIP package for auditors |
| list-companions | Show installed companion skills |
Run: python3 {baseDir}/scripts/db_query.py --action activate-framework --slug
| Framework | Slug | Controls |
|-----------|------|----------|
| SOC 2 Type II | soc2 | 43 |
| ISO 27001:2022 | iso27001 | 114 |
| HIPAA Security Rule | hipaa | 29 |
| GDPR | gdpr | 25 |
| NIST CSF | nist-csf | 31 |
| PCI DSS v4.0 | pci-dss | 30 |
| CIS Controls v8 | cis-controls | 153 |
| CMMC 2.0 | cmmc | 113 |
| HITRUST CSF v11 | hitrust | 152 |
| CCPA/CPRA | ccpa | 28 |
| FedRAMP Moderate | fedramp | 282 |
| ISO 42001:2023 | iso42001 | 40 |
| SOX ITGC | sox-itgc | 50 |
Framework reference docs: {baseDir}/references/frameworks/
Run: python3 {baseDir}/scripts/compliance_score.py [--framework
Returns score (0-100), health distribution, trend, and drift detection. Use --store to save for tracking. Methodology: {baseDir}/references/scoring-methodology.md
python3 {baseDir}/scripts/check_headers.py --url (CSP, HSTS, X-Frame-Options, etc.)python3 {baseDir}/scripts/check_ssl.py --domain (cert validity, chain, cipher)After scans, offer to save results as evidence.
python3 {baseDir}/scripts/generate_report.py --framework --format html python3 {baseDir}/scripts/generate_trust_center.py [--org-name "Acme Corp"] (local HTML only)python3 {baseDir}/scripts/export_evidence.py --framework When user asks to set up compliance: initialize DB silently, present framework options with control counts and use cases, offer gap analysis after activation.
After framework activation -> offer gap analysis and cloud integration setup.
After marking controls complete -> offer score recalculation.
After scanning -> offer to save as evidence.
After scoring (< 30%) -> prioritize critical controls. (>= 90%) -> offer audit report.
| Command | Action |
|---------|--------|
| /grc-score | Quick compliance score |
| /grc-gaps | Priority gaps |
| /grc-scan | Security scan menu |
| /grc-report | Generate report |
| /grc-risks | Risk register |
| /grc-incidents | Active incidents |
| /grc-trust | Generate trust center |
Register via OpenClaw cron tool:
Always include "Using auditclaw-grc skill" in cron messages for routing.
Optional add-ons for automated cloud evidence collection. Evidence flows into the shared GRC database.
| Skill | Checks | Setup |
|-------|--------|-------|
| auditclaw-aws | 15 AWS checks (S3, IAM, CloudTrail, VPC, etc.) | aws configure with read-only IAM policy |
| auditclaw-github | 9 GitHub checks (branch protection, secrets, 2FA, etc.) | GITHUB_TOKEN env var |
| auditclaw-azure | 12 Azure checks (storage, NSG, Key Vault, etc.) | Service principal with Reader + Security Reader |
| auditclaw-gcp | 12 GCP checks (storage, firewall, IAM, etc.) | GOOGLE_APPLICATION_CREDENTIALS with Viewer + Security Reviewer |
| auditclaw-idp | 8 identity checks (Google Workspace + Okta) | SA key + admin email / Okta API token |
Install: clawhub install auditclaw-
If a user asks to connect a cloud provider, check list-companions first. If not installed, guide them to install it.
Say "setup aws", "setup github", etc. to get step-by-step guides with exact permissions. Use "test aws connection" to verify before running scans.
{baseDir}/references/db-actions.md - Full action reference with all arguments{baseDir}/references/schema.md - Database schema{baseDir}/references/scoring-methodology.md - Scoring algorithm{baseDir}/references/commands/ - Detailed command guides{baseDir}/references/frameworks/ - Framework reference docs{baseDir}/references/integrations/ - Cloud integration guidesGenerated Mar 1, 2026
A cloud-based SaaS startup preparing for its first SOC 2 Type II audit uses AuditClaw GRC to map controls, collect evidence, and track risks. It generates compliance reports and dashboards to demonstrate security posture to enterprise clients.
A healthcare organization conducts a HIPAA compliance gap analysis to identify deficiencies in patient data protection. It uses the tool to manage policies, track training completion, and log incidents for regulatory reporting.
A financial services firm maintains PCI DSS for payment card security and SOX ITGC for financial controls. The tool helps automate evidence collection, run security scans, and manage access reviews to meet audit requirements.
A manufacturing company adopts ISO 27001 and NIST CSF frameworks to secure its industrial systems and supply chain. It uses AuditClaw GRC to register assets, assess vendor risks, and monitor vulnerabilities across operations.
A contractor working with U.S. federal agencies achieves FedRAMP and CMMC compliance by managing controls, generating trust center pages, and integrating with cloud providers like AWS and Azure for continuous monitoring.
Companies offering software-as-a-service use AuditClaw GRC to maintain compliance certifications like SOC 2 and ISO 27001, building trust with enterprise customers and enabling sales in regulated industries.
MSPs leverage the tool to manage GRC for multiple client organizations, handling frameworks such as HIPAA and PCI DSS, generating reports, and providing compliance-as-a-service offerings.
Large enterprises adopt AuditClaw GRC internally to centralize governance across departments, streamline audit processes, and reduce manual effort in managing risks, policies, and training programs.
š¬ Integration Tip
Use companion skills for cloud integrations; set optional environment variables like AWS_ACCESS_KEY_ID only when needed to keep core functionality lightweight.
Think through any legal situation like a lawyer. Issue spotting, jurisdiction, risk assessment, actionable conclusions.
Legal demands two things: frontier-level reasoning and precision document generation. CellCog delivers both. #1 on DeepResearch Bench (Feb 2026) for the inte...
Reference the workspace policy playbook, answer "What are the rules for tone, data, and collaboration?" by searching the curated policy doc or listing its sections.
Draft contracts, review legal documents, and navigate compliance with practical legal patterns.
Helps creators clearly credit collaborators, tools, and partners in a way platforms understand. Reduces confusion, missed disclosures, and avoidable issues before content goes live.
Reference the workspace policy playbook, answer"What are the rules for tone, data, and collaboration?" by searching the curated policy doc or listing its sec...