Clawwork

ReviewAudited by ClawScan on May 10, 2026.

Overview

ClawWork appears purpose-aligned, but it relies on unreviewed local ClawWork code and virtualenv dependencies while using provider API keys and running agent tasks.

Install only if you trust and have reviewed the separate ClawWork checkout at ~/.openclaw/workspace/ClawWork. Use dedicated API keys with spending limits, avoid sensitive task content until retention and provider flows are clear, and verify the external ClawWork code and virtualenv before running tasks.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the skill may execute unreviewed local ClawWork code with access to task prompts and configured API keys.

Why it was flagged

The reviewed skill delegates execution to Python code in an external local ClawWork directory that is not included in the artifact set.

Skill content

CLAWWORK_PATH = Path("/home/freedom/.openclaw/workspace/ClawWork")
sys.path.insert(0, str(CLAWWORK_PATH))
...
from agent.live_agent import LiveAgent

Recommendation

Only use this after installing ClawWork from a trusted, pinned source and reviewing its dependencies; the skill should include or pin the external dependency and document its provenance.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill can spend API credits and send task data to configured providers.

Why it was flagged

The skill expects provider credentials in a local .env file, although registry metadata lists no required env vars or primary credential.

Skill content

Edite `~/.openclaw/workspace/ClawWork/.env`:
...
OPENAI_API_KEY=sk-or-v1-xxx
OPENAI_API_BASE=https://openrouter.ai/api/v1
...
E2B_API_KEY=e2b_xxx

Recommendation

Use dedicated, least-privilege API keys with spending limits, and ensure the registry metadata declares the required credentials.

Note

ASI02: Tool Misuse and Exploitation

What this means

A task may trigger multiple model/tool actions and associated provider costs before returning results.

Why it was flagged

The skill launches an agentic workflow with multiple steps and retries for user-supplied professional tasks.

Skill content

"agent_params": {
  "max_steps": 15,
  "max_retries": 3,
  ...
}
...
await agent.run_date_range(init_date, end_date)

Recommendation

Give narrow task prompts, monitor costs, and avoid submitting sensitive or high-impact tasks unless you have reviewed the underlying ClawWork tool permissions.

Note

ASI06: Memory and Context Poisoning

What this means

Professional task prompts and outputs may remain in local ClawWork logs or data directories.

Why it was flagged

The skill discloses a persistent local data/log location for ClawWork task history.

Skill content

| Dados | `~/.openclaw/workspace/ClawWork/livebench/data/` |
...
**GLM-4.7**: 157 dias de logs

Recommendation

Avoid submitting confidential data unless you understand ClawWork's log retention, and periodically review or clean stored task data.