Skillv1.0.1

ClawScan security

OpenClaw Guardian · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignFeb 25, 2026, 11:54 AM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The plugin does what it says — a regex-based gate that consults the user's configured LLM(s) for flagged operations — but it reads local conversation sessions and uses your configured model credentials (so review the implementation and provider trust before enabling).
Guidance: This plugin is internally consistent with its purpose, but before installing: (1) verify the plugin source (the README suggests a GitHub repo) and review the included code yourself or from a trusted reviewer; (2) understand that Guardian will read recent conversation session files and send them to whichever model provider is configured in OpenClaw (so ensure you trust that provider and that it’s configured to not leak sensitive data); (3) check and possibly restrict which provider/config entries it can use, and review the audit log location (~/.openclaw/guardian-audit.jsonl); (4) consider lowering automatic trust (trustBudget) or testing in a safe environment before enabling broadly. If you want, I can point out specific lines to review or summarize exactly which files/fields are sent to the LLM calls.

Review Dimensions

Purpose & Capability: okName/description match the code and runtime instructions: it intercepts exec/write/edit calls, applies two-tier regex blacklists, and uses LLM-based voting for flagged operations. No unrelated services or credentials are requested.
Instruction Scope: noteThe SKILL.md and code explicitly read recent conversation session files for context and send that context to model providers for intent checks. Reading user messages is necessary for its stated 'did the user ask for this?' function, but it's a sensitive action (conversation contents may include secrets). Audit logging to ~/.openclaw/guardian-audit.jsonl is also performed for blacklist hits.
Install Mechanism: noteNo packaged installer is included (the README suggests cloning a GitHub repo or using openclaw plugins install). The skill bundle contains the source files, so there is no hidden download step in the provided package, but manual installation instructions point to an external GitHub repo (verify source/trust before cloning).
Credentials: noteThe plugin does not declare extra env vars, but it auto-discovers the user's OpenClaw model providers and reads provider.baseUrl and provider.apiKey from OpenClaw config to call LLM endpoints. This is proportionate to the claimed LLM voting feature but means your existing model credentials and conversation context will be used/sent to those providers — review provider trust and config privacy settings.
Persistence & Privilege: okIt registers a before_tool_call hook (expected for a safety gate), does not set always: true, and does not modify other plugins. It writes an audit log to the user's home directory (normal for an audit trail).