# Clawseccheck

> 🦞 Free, local, read-only security self-audit for your own OpenClaw AI-agent setup. Scores it A–F, surfaces the urgent holes, emits copy-paste fixes. Zero deps, no network, no API key — your data never leaves your machine.

- **Type:** MCP server
- **Install:** `agentstack add mcp-gl0di-clawseccheck`
- **Verified:** Pending review
- **Seller:** [gl0di](https://agentstack.voostack.com/s/gl0di)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [gl0di](https://github.com/gl0di)
- **Source:** https://github.com/gl0di/clawseccheck
- **Website:** https://clawhub.ai/gl0di/clawseccheck

## Install

```sh
agentstack add mcp-gl0di-clawseccheck
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

🦞 A free, local, read-only security self-audit for your own OpenClaw agent.
  The claw that checks your claws — scores you A–F and reports the holes. Reports only, never touches anything.

  
  
  
  
  
  
  

  🦞 Free · 🔒 Local · 👀 Read-only · 🚫 No API key · 🏠 Your data never leaves your machine

---

A one-command security self-audit for *your own* OpenClaw agent. It scores your setup
**A–F** and surfaces the most urgent holes in plain language — reports only, it never fixes or changes anything —
plus a **shareable grade badge**.

Because you run it on your own agent, there's no "scanning someone else" problem: no
proof-of-ownership, no legal grey area.

---

## 🔒 Local, read-only, and honest about its limits

ClawSecCheck runs **locally and read-only** — no network calls, no telemetry, nothing
leaves your machine. It's a heuristic audit, so it's upfront about what it does and
doesn't check:

**Honest limits (we never hide these behind a green score):**

- **Static analysis, not runtime-verified.** Findings describe your *configuration*, not a
  live exploit. Results are labelled accordingly.
- **`UNKNOWN` ≠ `PASS`.** If a file can't be read, the config can't be parsed, or a state
  can't be determined, it's reported as `UNKNOWN` and excluded from the score — never
  silently marked safe.
- **Some deep checks are planned, not shipped yet:** a dirty-input action-gate and taint-tracking
  layer (B27–B28) is on the roadmap, and the shipped B33 version gate is seeded with a small set of
  grounded advisories — its table grows as new ones are verified, not an exhaustive CVE database yet.
- **Vetting the scanner itself** (`--vet` pointed at ClawSecCheck's own source) reports
  *safe with a note* — a security tool necessarily ships attack signatures as data.

**Found a false positive/negative or something confusing?** Open an issue at
 with the output of `clawseccheck --json`
(it redacts secret *values* — only key names/paths appear) and your OpenClaw version. Do
not paste raw secrets.

---

## ⚠️ Important — trust no one (including this skill)

OpenClaw skills are **not sandboxed**: an installed skill runs with your agent's full
permissions. The ClawHavoc campaign poisoned ClawHub with **hundreds of malicious skills**
that steal credentials and crypto wallets — a single line of markdown can hide a
`curl http:// | bash`.

So, before you download, install, or use **any** skill (this one included):

1. **Read the source** — it's plain text. If you can't see what it does, don't run it.
2. **Have your agent analyse it for you** — ask OpenClaw to review the skill's `SKILL.md`
   and scripts for shell-exec, credential access, paste-host uploads, and obfuscated
   (base64) payloads *before* enabling it. ClawSecCheck does this with `--vet `.
3. **Pin a known release**, prefer signed / VirusTotal-clean skills, and rotate any secret a
   skill could have reached if you ever suspect it.

ClawSecCheck practises this: it is open source, zero-dependency, read-only, and its **B13** check
does exactly this vetting on the skills you've *already* installed. Trust is earned by being
readable — so read it.

**Verifying ClawSecCheck itself hasn't been tampered with.** `clawseccheck --verify-self`
prints a SHA-256 digest of the engine's own source — but a digest computed *from inside* a
possibly-modified copy is only a tripwire, not proof (a tampered `integrity.py` could print
anything). The trusted reference lives out-of-band: every GitHub Release publishes a
`SHA256SUMS.txt` (same digest format `--verify-self` prints) signed with
[cosign](https://github.com/sigstore/cosign) in keyless mode via the release workflow's own
GitHub Actions OIDC identity — no private key for anyone to leak or steal. Verify it before
trusting the comparison:

```bash
# Get the release assets (adjust the version):
curl -LO https://github.com/gl0di/clawseccheck/releases/download/vX.Y.Z/SHA256SUMS.txt
curl -LO https://github.com/gl0di/clawseccheck/releases/download/vX.Y.Z/SHA256SUMS.txt.sig
curl -LO https://github.com/gl0di/clawseccheck/releases/download/vX.Y.Z/SHA256SUMS.txt.pem

cosign verify-blob \
  --certificate SHA256SUMS.txt.pem \
  --signature SHA256SUMS.txt.sig \
  --certificate-identity-regexp "^https://github.com/gl0di/clawseccheck/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS.txt
```

A passing `cosign verify-blob` proves `SHA256SUMS.txt` was produced by *this repo's* release
workflow and hasn't been altered since — not that the CI pipeline itself is uncompromisable.
This closes the loop against opportunistic tampering of a downloaded copy; it is not a
guarantee against a targeted adversary who also compromises the CI pipeline.

**The same principle applies to the host itself.** If a machine is already compromised,
anything running on it at your own privilege level — ClawSecCheck included — can in
principle be tampered with so it hides the compromise; `--verify-self` catches lazy
tampering, not a targeted adversary who patches the verifier too. The honest fix is to
scan the suspect config from a separate, clean machine via `--home`, not to trust a
self-check running on the box in question. See
[What if the host is already compromised?](docs/FAQ.md#what-if-the-host-is-already-compromised)
in the FAQ for the full protocol.

---

## 🤔 Why another audit tool?

The built-in `openclaw security audit` and tools like Trent/ClawSec are good — but:

- The native audit **does not inspect the content of your bootstrap files**
  (`SOUL.md`, `AGENTS.md`, `TOOLS.md`): they're injected into the system prompt as *trusted
  context* with no validation. ClawSecCheck **does** check them for prompt-injection-prone
  directives (our check **B6**).
- ClawSecCheck is **100% local** — no API key, nothing transmitted (Trent uploads your config;
  the native one is CLI-only).
- It leads with a **shareable Score + Grade + Lethal Trifecta ratio** you can post to the
  community — without ever exposing your actual findings.

---

## 🔬 What it checks

- **Lethal Trifecta** (untrusted input × sensitive data × outbound actions — keep ≤2 of 3)
- Gateway exposure & channel auth, plaintext secrets, least privilege, execution sandbox,
  plugin/skill supply-chain integrity, bootstrap-file injection surface, memory poisoning,
  human approval, secret-leak/redaction, TLS, local-first/model hygiene.
- **B13 — installed-skill / plugin vetting:** scans the *content* of skills you downloaded
  (not made yourself) for the ClawHavoc malware class, including base64-hidden payloads. As of
  v0.21 it also runs a static **Python AST** pass (stdlib `ast`, parse-only — never executed) that
  catches obfuscation regex misses — `exec(base64.b64decode(...))`, `getattr(os,"sys"+"tem")(...)`,
  `__import__("os").system(...)` — plus prompt-injection / hide-from-user directives embedded in a
  third-party skill's prose, and (v0.23) a **taint trace** that flags a credential **file's** contents
  (`~/.ssh/id_*`, `.aws/credentials`, keychain, wallet, …) flowing into a network sink ("read a secret
  file → send it out"). Sources are credential files only, not env vars, so the legit "read
  `OPENAI_API_KEY`, send as auth header" pattern is never flagged. (AST is Python-only; JS/shell stay
  on the regex engine.)
- Per-check reference: [`docs/CHECKS.md`](docs/CHECKS.md) for the generated catalog of checks,
  verdict semantics, remediation, and compound risk chains.
- **B14 — egress surface:** where the agent can reach out (channels, external skills, tools).
- **B15 — MCP server trust** boundaries.
- **B16 — threat monitoring:** whether you actually have monitoring/detection set up at all.
- **B17 — autonomy / heartbeat:** whether the agent acts on its own and could be steered by untrusted input.
- **B18 — subagent delegation:** whether spawned subagents can wield elevated/exec tools without approval.
- **B45 — per-agent privilege separation (attestation):** A1 flattens the whole setup into one
  capability surface; B45 reads the attested agent roster (`--attest`, `agents: [{name, tools}]`) and
  checks whether any *single* agent holds all three trifecta legs by itself. OpenClaw config has no
  per-agent tool allowlist, so this needs the self-report — `UNKNOWN` without it, advisory (`ATTESTED`,
  unscored). PASS means "no single agent is the full trifecta" — a necessary condition, **not** a
  guarantee: runtime data-flow and the delegation graph are out of scope.
- **B46 — multi-agent trifecta exposure:** config-only nudge — spawnable subagents **plus** the global
  trifecta **plus** no exec approval gate. Capped at WARN (never a new FAIL).
- **B47 — cross-agent trifecta reassembly (attestation):** even when no single agent is the trifecta,
  it can reassemble across delegation (a *confused deputy*): an untrusted-input agent that can drive a
  sensitive-data agent and an outbound agent. Reads the attested `delegation: [{from, to, returns}]`
  graph; the `returns` tier decides exploitability — a `schema` (typed) return is a **wall** that
  blocks the channel (PASS, with a not-runtime-verified caveat), while `raw`/`filtered`/`unknown`
  carries it (WARN). UNKNOWN without `--attest`. `RISK-11` narrates the chain. Runtime data-flow stays
  out of static scope.
- **B19 — data at-rest:** group/world-readable memory/log directories (conversation data / PII exposure).
- **B20–B24 — agent behavior:** write-protection of identity/memory files, tool-output trust boundary,
  self-modification risk, approval-bypass directives, and deep MCP-server hardening.
- **B30 — sender identity strength:** flags `channels..dangerouslyAllowNameMatching`
  (allowlist keyed on mutable display name — trivially bypassed by renaming) and
  `channels.telegram.includeGroupHistoryContext="recent"` (untrusted group history injected as context).
- **B32 — control-plane mutation reachability:** flags control-plane tools (`cron`, `config.apply`,
  `update.run`, `sessions_spawn`, `sessions_send`, `gateway`) exposed via `gateway.tools.allow`
  over the HTTP gateway — full agent takeover without further escalation.
- **B38 — browser / SSRF exposure:** flags `browser.ssrfPolicy.dangerouslyAllowPrivateNetwork`
  (cloud-metadata IP access / credential theft via 169.254.169.254) and `browser.noSandbox`
  (headless browser without OS isolation); warns when no `hostnameAllowlist` limits egress.
- **B48 — dangerous break-glass overrides:** a grounded registry of OpenClaw's `dangerously*` /
  `allowUnsafe*` toggles that are documented "keep disabled." **FAIL** when a sandbox-escape
  (`sandbox.docker.dangerouslyAllow{ContainerNamespaceJoin,ExternalBindSources,ReservedContainerTargets}`)
  or control-plane auth-bypass (`gateway.controlUi.dangerouslyDisableDeviceAuth`) flag is active;
  **WARN** for the rest (webhook signature disable, host-header origin fallback, external embeds,
  real-IP fallback, `allowUnsafeExternalContent`, per-channel/plugin private-network access, extra
  node commands). Default/absent = clean PASS (zero false positives on a stock config).
- **B39 — session visibility / cross-user transcript leak:** flags `session.dmScope="main"`
  (all DM peers share one session — cross-user contamination) and `tools.sessions.visibility`
  of `"agent"` or `"all"` (cross-session transcript reads).
- **B26 — untrusted-context exposure:** flags `channels..contextVisibility="all"` (the
  OpenClaw default), where quoted/thread/history text from non-allowlisted senders is injected into
  the model as context — a prompt-injection surface; recommends `allowlist`/`allowlist_quote`.
- **B33 — known-vulnerable version gate:** compares `meta.lastTouchedVersion` against a maintained
  OpenClaw advisory table (seeded with GHSA-g8p2-7wf7-98mq, fixed `2026.1.29`); unknown versions are
  `UNKNOWN`, never `PASS`.
- **B41 — credential blast-radius:** inventories the credential surface (`auth.profiles.*`,
  gateway token) reachable by the agent and warns when it co-exists with untrusted ingress + outbound
  tools. Reports only provider names + counts — never the account/email or token value.
- **B31 — effective-tools bypass:** detects the OpenClaw footgun where `tools.deny: ["write"]` does
  not deny `apply_patch`/`exec` — a believed-safe restriction that still allows file mutation; checks
  global, `toolsBySender`, and per-agent deny lists. Recommends `group:fs` or a complete deny list.
- **B42 — skill/plugin install-time policy:** install-time supply-chain risk that isn't malware
  per se — `package.json` `pre/postinstall` hooks that run code on install **and every auto-update**
  (unsandboxed, with the agent's permissions), and **world-writable skill directories** (any local
  user could drop a skill the agent loads). WARN-max, never FAIL; complements B25 (pinning) and B13
  (content).
- **B50–B54 — Host Watch Posture:** widens the lens past the agent to the *machine it runs on* —
  is anyone watching it? Read-only, filesystem-only detection (no subprocess, no network) of host
  defensive monitors: **B50** network monitoring / IDS (Suricata, Zeek, Snort, Little Snitch,
  Sysmon), **B51** host audit / syscall logging (auditd, OpenBSM, Sysmon), **B52** file-integrity
  monitoring (AIDE, Tripwire, osquery), **B53** endpoint protection / EDR (Wazuh, CrowdStrike,
  ClamAV, Defender, Santa), **B54** host firewall (ufw, firewalld, nftables, macOS ALF, Windows
  Firewall). LOW severity, **never FAIL**: a missing monitor is a WARN only when the agent is
  high-privilege, otherwise PASS; anything not determinable read-only is `UNKNOWN`. Where it can be
  read without running a command, it distinguishes *enabled* from merely *installed*.
- **B55 — filesystem-write tool exposure:** advisory warning when broad write-capability (`fs_write`,
  `apply_patch`) is granted without enough scoping controls.
- **B56 — dangerous Control-UI cross-origin policy:** flags `allowedOrigins: ["*"]` in control UI config.
- **B57 — plugin auto-approve:** flags `permissionMode: "approve-all"`, which bypasses explicit
  per-action confirmation in plugin execution.
- **B58 — Unicode-obfuscated injection / hidden-text evasion:** detects Unicode confusables, zero-width and
  bidi controls used to hide injection directives.
- **B59 — markdown-image / anchor data-exfil signals:** flags remote markdown image/anchor URLs with data-bearing
  query params that can leak context.
- **B60 — prompt self-replication / propagation directives:** catches prompt-level instructions that try
  to make injected content propagate itself.
- **B61 — cross-agent config snooping / credential theft:** flags cross-agent access to foreign agent
  identity/config paths combined with extraction capabilities.
- **B62 — capability–intent mismatch:** detects large drift between SKILL.md declared purpose and actual
  observed behavior from static and effect profiling.
- **B63–B66 — instruction hardening checks:** hidden directive / hierarchy override / sleeper trigger /
  persona-role jailbreak coverage.
- **C6 — hook-composition policy drop (legacy):** advisory `UNKNOWN` for pre-v2026.6.10 hook chains where
  policy drop order can behave unexpectedly.
- **B43 / B44 — capability blast-radius (attestation layer):** the static scan reads config files
  only; it cannot see the agent's *real tool/verb inventory* — config lists tool *names* as opaque
  strings. The attestation layer closes that: `--ask` emits a template the running agent fills with
  its own ground truth, and `--attest ` feeds it back. **B43** classifies the held verbs by
  blast radius — `EXEC` (bash/shell/exec — the broadest: subsumes egress+destruction),
  `MAILBOX_CONFIG` (auto-forward/filter/delegation — a persistent silent channel),
  `DESTRUCTIVE` (delete-forever/purge), `EGRESS` (send/forward/post), `REVERSIBLE`
  (search/get/draft/label). A reversible-only toolset *passes* (forward-exfil and delete-evidence
  are physically impossible); a high-blast verb th

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [gl0di](https://github.com/gl0di)
- **Source:** [gl0di/clawseccheck](https://github.com/gl0di/clawseccheck)
- **License:** MIT
- **Homepage:** https://clawhub.ai/gl0di/clawseccheck

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** yes
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-gl0di-clawseccheck
- Seller: https://agentstack.voostack.com/s/gl0di
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.