Clawseccheck

🦞 A free, local, read-only security self-audit for your own OpenClaw agent. The claw that checks your claws — scores you A–F and reports the holes. Reports only, never touches anything.

🦞 Free · 🔒 Local · 👀 Read-only · 🚫 No API key · 🏠 Your data never leaves your machine

---

A one-command security self-audit for your own OpenClaw agent. It scores your setup A–F and surfaces the most urgent holes in plain language — reports only, it never fixes or changes anything — plus a shareable grade badge.

Because you run it on your own agent, there's no "scanning someone else" problem: no proof-of-ownership, no legal grey area.

---

🔒 Local, read-only, and honest about its limits

ClawSecCheck runs locally and read-only — no network calls, no telemetry, nothing leaves your machine. It's a heuristic audit, so it's upfront about what it does and doesn't check:

Honest limits (we never hide these behind a green score):

• Static analysis, not runtime-verified. Findings describe your configuration, not a

live exploit. Results are labelled accordingly.

• UNKNOWN ≠ PASS. If a file can't be read, the config can't be parsed, or a state

can't be determined, it's reported as UNKNOWN and excluded from the score — never silently marked safe.

• Some deep checks are planned, not shipped yet: a dirty-input action-gate and taint-tracking

layer (B27–B28) is on the roadmap, and the shipped B33 version gate is seeded with a small set of grounded advisories — its table grows as new ones are verified, not an exhaustive CVE database yet.

• Vetting the scanner itself (--vet pointed at ClawSecCheck's own source) reports

safe with a note — a security tool necessarily ships attack signatures as data.

Found a false positive/negative or something confusing? Open an issue at with the output of clawseccheck --json (it redacts secret values — only key names/paths appear) and your OpenClaw version. Do not paste raw secrets.

---

⚠️ Important — trust no one (including this skill)

OpenClaw skills are not sandboxed: an installed skill runs with your agent's full permissions. The ClawHavoc campaign poisoned ClawHub with hundreds of malicious skills that steal credentials and crypto wallets — a single line of markdown can hide a curl http:// | bash.

So, before you download, install, or use any skill (this one included):

1. Read the source — it's plain text. If you can't see what it does, don't run it.
2. Have your agent analyse it for you — ask OpenClaw to review the skill's SKILL.md

and scripts for shell-exec, credential access, paste-host uploads, and obfuscated (base64) payloads before enabling it. ClawSecCheck does this with --vet .

1. Pin a known release, prefer signed / VirusTotal-clean skills, and rotate any secret a

skill could have reached if you ever suspect it.

ClawSecCheck practises this: it is open source, zero-dependency, read-only, and its B13 check does exactly this vetting on the skills you've already installed. Trust is earned by being readable — so read it.

Verifying ClawSecCheck itself hasn't been tampered with. clawseccheck --verify-self prints a SHA-256 digest of the engine's own source — but a digest computed from inside a possibly-modified copy is only a tripwire, not proof (a tampered integrity.py could print anything). The trusted reference lives out-of-band: every GitHub Release publishes a SHA256SUMS.txt (same digest format --verify-self prints) signed with cosign in keyless mode via the release workflow's own GitHub Actions OIDC identity — no private key for anyone to leak or steal. Verify it before trusting the comparison:

# Get the release assets (adjust the version):
curl -LO https://github.com/gl0di/clawseccheck/releases/download/vX.Y.Z/SHA256SUMS.txt
curl -LO https://github.com/gl0di/clawseccheck/releases/download/vX.Y.Z/SHA256SUMS.txt.sig
curl -LO https://github.com/gl0di/clawseccheck/releases/download/vX.Y.Z/SHA256SUMS.txt.pem

cosign verify-blob \
  --certificate SHA256SUMS.txt.pem \
  --signature SHA256SUMS.txt.sig \
  --certificate-identity-regexp "^https://github.com/gl0di/clawseccheck/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS.txt

A passing cosign verify-blob proves SHA256SUMS.txt was produced by this repo's release workflow and hasn't been altered since — not that the CI pipeline itself is uncompromisable. This closes the loop against opportunistic tampering of a downloaded copy; it is not a guarantee against a targeted adversary who also compromises the CI pipeline.

The same principle applies to the host itself. If a machine is already compromised, anything running on it at your own privilege level — ClawSecCheck included — can in principle be tampered with so it hides the compromise; --verify-self catches lazy tampering, not a targeted adversary who patches the verifier too. The honest fix is to scan the suspect config from a separate, clean machine via --home, not to trust a self-check running on the box in question. See [What if the host is already compromised?](docs/FAQ.md#what-if-the-host-is-already-compromised) in the FAQ for the full protocol.

---

🤔 Why another audit tool?

The built-in openclaw security audit and tools like Trent/ClawSec are good — but:

• The native audit does not inspect the content of your bootstrap files

(SOUL.md, AGENTS.md, TOOLS.md): they're injected into the system prompt as trusted context with no validation. ClawSecCheck does check them for prompt-injection-prone directives (our check B6).

• ClawSecCheck is 100% local — no API key, nothing transmitted (Trent uploads your config;

the native one is CLI-only).

• It leads with a shareable Score + Grade + Lethal Trifecta ratio you can post to the

community — without ever exposing your actual findings.

---

🔬 What it checks

• Lethal Trifecta (untrusted input × sensitive data × outbound actions — keep ≤2 of 3)
• Gateway exposure & channel auth, plaintext secrets, least privilege, execution sandbox,

plugin/skill supply-chain integrity, bootstrap-file injection surface, memory poisoning, human approval, secret-leak/redaction, TLS, local-first/model hygiene.

• B13 — installed-skill / plugin vetting: scans the content of skills you downloaded

(not made yourself) for the ClawHavoc malware class, including base64-hidden payloads. As of v0.21 it also runs a static Python AST pass (stdlib ast, parse-only — never executed) that catches obfuscation regex misses — exec(base64.b64decode(...)), getattr(os,"sys"+"tem")(...), __import__("os").system(...) — plus prompt-injection / hide-from-user directives embedded in a third-party skill's prose, and (v0.23) a taint trace that flags a credential file's contents (~/.ssh/id_*, .aws/credentials, keychain, wallet, …) flowing into a network sink ("read a secret file → send it out"). Sources are credential files only, not env vars, so the legit "read OPENAI_API_KEY, send as auth header" pattern is never flagged. (AST is Python-only; JS/shell stay on the regex engine.)

• Per-check reference: [docs/CHECKS.md](docs/CHECKS.md) for the generated catalog of checks,

verdict semantics, remediation, and compound risk chains.

• B14 — egress surface: where the agent can reach out (channels, external skills, tools).
• B15 — MCP server trust boundaries.
• B16 — threat monitoring: whether you actually have monitoring/detection set up at all.
• B17 — autonomy / heartbeat: whether the agent acts on its own and could be steered by untrusted input.
• B18 — subagent delegation: whether spawned subagents can wield elevated/exec tools without approval.
• B45 — per-agent privilege separation (attestation): A1 flattens the whole setup into one

capability surface; B45 reads the attested agent roster (--attest, agents: [{name, tools}]) and checks whether any single agent holds all three trifecta legs by itself. OpenClaw config has no per-agent tool allowlist, so this needs the self-report — UNKNOWN without it, advisory (ATTESTED, unscored). PASS means "no single agent is the full trifecta" — a necessary condition, not a guarantee: runtime data-flow and the delegation graph are out of scope.

• B46 — multi-agent trifecta exposure: config-only nudge — spawnable subagents plus the global

trifecta plus no exec approval gate. Capped at WARN (never a new FAIL).

• B47 — cross-agent trifecta reassembly (attestation): even when no single agent is the trifecta,

it can reassemble across delegation (a confused deputy): an untrusted-input agent that can drive a sensitive-data agent and an outbound agent. Reads the attested delegation: [{from, to, returns}] graph; the returns tier decides exploitability — a schema (typed) return is a wall that blocks the channel (PASS, with a not-runtime-verified caveat), while raw/filtered/unknown carries it (WARN). UNKNOWN without --attest. RISK-11 narrates the chain. Runtime data-flow stays out of static scope.

• B19 — data at-rest: group/world-readable memory/log directories (conversation data / PII exposure).
• B20–B24 — agent behavior: write-protection of identity/memory files, tool-output trust boundary,

self-modification risk, approval-bypass directives, and deep MCP-server hardening.

• B30 — sender identity strength: flags channels..dangerouslyAllowNameMatching

(allowlist keyed on mutable display name — trivially bypassed by renaming) and channels.telegram.includeGroupHistoryContext="recent" (untrusted group history injected as context).

• B32 — control-plane mutation reachability: flags control-plane tools (cron, config.apply,

update.run, sessions_spawn, sessions_send, gateway) exposed via gateway.tools.allow over the HTTP gateway — full agent takeover without further escalation.

• B38 — browser / SSRF exposure: flags browser.ssrfPolicy.dangerouslyAllowPrivateNetwork

(cloud-metadata IP access / credential theft via 169.254.169.254) and browser.noSandbox (headless browser without OS isolation); warns when no hostnameAllowlist limits egress.

• B48 — dangerous break-glass overrides: a grounded registry of OpenClaw's dangerously* /

allowUnsafe* toggles that are documented "keep disabled." FAIL when a sandbox-escape (sandbox.docker.dangerouslyAllow{ContainerNamespaceJoin,ExternalBindSources,ReservedContainerTargets}) or control-plane auth-bypass (gateway.controlUi.dangerouslyDisableDeviceAuth) flag is active; WARN for the rest (webhook signature disable, host-header origin fallback, external embeds, real-IP fallback, allowUnsafeExternalContent, per-channel/plugin private-network access, extra node commands). Default/absent = clean PASS (zero false positives on a stock config).

• B39 — session visibility / cross-user transcript leak: flags session.dmScope="main"

(all DM peers share one session — cross-user contamination) and tools.sessions.visibility of "agent" or "all" (cross-session transcript reads).

• B26 — untrusted-context exposure: flags channels..contextVisibility="all" (the

OpenClaw default), where quoted/thread/history text from non-allowlisted senders is injected into the model as context — a prompt-injection surface; recommends allowlist/allowlist_quote.

• B33 — known-vulnerable version gate: compares meta.lastTouchedVersion against a maintained

OpenClaw advisory table (seeded with GHSA-g8p2-7wf7-98mq, fixed 2026.1.29); unknown versions are UNKNOWN, never PASS.

• B41 — credential blast-radius: inventories the credential surface (auth.profiles.*,

gateway token) reachable by the agent and warns when it co-exists with untrusted ingress + outbound tools. Reports only provider names + counts — never the account/email or token value.

• B31 — effective-tools bypass: detects the OpenClaw footgun where tools.deny: ["write"] does

not deny apply_patch/exec — a believed-safe restriction that still allows file mutation; checks global, toolsBySender, and per-agent deny lists. Recommends group:fs or a complete deny list.

• B42 — skill/plugin install-time policy: install-time supply-chain risk that isn't malware

per se — package.json pre/postinstall hooks that run code on install and every auto-update (unsandboxed, with the agent's permissions), and world-writable skill directories (any local user could drop a skill the agent loads). WARN-max, never FAIL; complements B25 (pinning) and B13 (content).

• B50–B54 — Host Watch Posture: widens the lens past the agent to the machine it runs on —

is anyone watching it? Read-only, filesystem-only detection (no subprocess, no network) of host defensive monitors: B50 network monitoring / IDS (Suricata, Zeek, Snort, Little Snitch, Sysmon), B51 host audit / syscall logging (auditd, OpenBSM, Sysmon), B52 file-integrity monitoring (AIDE, Tripwire, osquery), B53 endpoint protection / EDR (Wazuh, CrowdStrike, ClamAV, Defender, Santa), B54 host firewall (ufw, firewalld, nftables, macOS ALF, Windows Firewall). LOW severity, never FAIL: a missing monitor is a WARN only when the agent is high-privilege, otherwise PASS; anything not determinable read-only is UNKNOWN. Where it can be read without running a command, it distinguishes enabled from merely installed.

• B55 — filesystem-write tool exposure: advisory warning when broad write-capability (fs_write,

apply_patch) is granted without enough scoping controls.

• B56 — dangerous Control-UI cross-origin policy: flags allowedOrigins: ["*"] in control UI config.
• B57 — plugin auto-approve: flags permissionMode: "approve-all", which bypasses explicit

per-action confirmation in plugin execution.

• B58 — Unicode-obfuscated injection / hidden-text evasion: detects Unicode confusables, zero-width and

bidi controls used to hide injection directives.

• B59 — markdown-image / anchor data-exfil signals: flags remote markdown image/anchor URLs with data-bearing

query params that can leak context.

• B60 — prompt self-replication / propagation directives: catches prompt-level instructions that try

to make injected content propagate itself.

• B61 — cross-agent config snooping / credential theft: flags cross-agent access to foreign agent

identity/config paths combined with extraction capabilities.

• B62 — capability–intent mismatch: detects large drift between SKILL.md declared purpose and actual

observed behavior from static and effect profiling.

• B63–B66 — instruction hardening checks: hidden directive / hierarchy override / sleeper trigger /

persona-role jailbreak coverage.

• C6 — hook-composition policy drop (legacy): advisory UNKNOWN for pre-v2026.6.10 hook chains where

policy drop order can behave unexpectedly.

• B43 / B44 — capability blast-radius (attestation layer): the static scan reads config files

only; it cannot see the agent's real tool/verb inventory — config lists tool names as opaque strings. The attestation layer closes that: --ask emits a template the running agent fills with its own ground truth, and --attest feeds it back. B43 classifies the held verbs by blast radius — EXEC (bash/shell/exec — the broadest: subsumes egress+destruction), MAILBOX_CONFIG (auto-forward/filter/delegation — a persistent silent channel), DESTRUCTIVE (delete-forever/purge), EGRESS (send/forward/post), REVERSIBLE (search/get/draft/label). A reversible-only toolset passes (forward-exfil and delete-evidence are physically impossible); a high-blast verb th

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: gl0di
• Source: gl0di/clawseccheck
• License: MIT
• Homepage: https://clawhub.ai/gl0di/clawseccheck

Install and usage instructions live in the source repository linked above.