Security audit
Security checks for vulnerabilities and agentic risk
The secret scanner fits its purpose, but uninstalling its Git protection can also delete your existing safety checks.
Read-only scanning is consistent with the advertised purpose. Before enabling the OpenClaw Git guard, save existing pre-commit hooks. If you manually combine hooks, remove only the guard command yourself: automatic uninstall can erase the whole hook. Prefer a corrected uninstaller. Review migration's dry run and protect the resulting secrets file and backups.
scripts/safeclaw.pyPersistent hook installation relies solely on documentary confirmation
Hooks survive the current invocation and can deny subsequent file writes or commits. The documented approval requirement is not enforced by the executable entry point.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
`SC install-guard --platform claude|openclaw|all` — the platform must be named explicitly; confirm it with the
user first, because this installs a persistent hook.
- **Claude Code**: adds a `PreToolUse` hook (`Write|Edit|MultiEdit|NotebookEdit`) to `~/.claude/settings.json`
that denies writing a detected secret into memory / instruction files (CLAUDE.md, auto memory,
`.claude/rules`, MEMORY.md, …). `--scope all` guards every file write. Existing settings and hooks are kept,
a settings backup is written, and the hook script is copied to `~/.claude/hooks/token-safety-guard.py`.
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'file_read' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'file_write' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return result
try:
r = subprocess.run(
["git", "rev-parse", "--show-toplevel"],
capture_output=True, text=True, cwd=config_path.parent
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
result["supported"] = False
return result
log = subprocess.run(
["git", "log", "--all", "--format=%H|%ai|%an", "--", rel_path],
capture_output=True, text=True, cwd=git_root
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if len(parts) < 3:
continue
commit_hash, date, author = parts
show = subprocess.run(
["git", "show", f"{commit_hash}:{rel_path}"],
capture_output=True, text=True, cwd=git_root
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def cmd_guard_git(args):
"""git pre-commit hook: block commits that add secrets."""
r = subprocess.run(["git", "diff", "--cached", "--name-only", "--diff-filter=ACMR", "-z"],
capture_output=True)
if r.returncode != 0:
return 0
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return 0
blocked = []
for name in [n for n in r.stdout.decode("utf-8", "replace").split("\0") if n]:
show = subprocess.run(["git", "show", f":{name}"], capture_output=True)
if show.returncode != 0 or b"\0" in show.stdout[:8000]:
continue
text = show.stdout.decode("utf-8", "replace")
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
# 3. Profile gets only the loader line (no secret values)
if needs_hook:
with open(profile_path, "a", encoding="utf-8") as pf:
pf.write(f"\n{hook_line}\n")
print(f"[OK] {profile_path}: added a line that loads {secrets_path}")
No suspicious patterns detected.