SecretClaw

• Analyzed: May 14, 2026, 6:39 AM
• Findings: 1
• Version: 1.0.0
• Hash: b1607140deabf4b7e4d0d1feabad2e3026d5f11568ead14795e4c7e49e127354
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'secretclaw' skill provides a secure mechanism for users to input sensitive API keys into OpenClaw without exposing them in chat logs. It implements a temporary local HTTP server (scripts/secret_server.py) exposed via a Cloudflare Quick Tunnel, utilizing one-time tokens and immediate self-destruction after the secret is saved via the 'openclaw' CLI. The implementation is transparent, follows its documented purpose, and lacks any indicators of malicious intent or data exfiltration.