ClawHub
Back to skill

Security audit

ClawCheck

Security checks for vulnerabilities and agentic risk

Overview

ClawCheck is a local OpenClaw audit tool that inspects configuration and workspace files for health and security issues without evidence of network exfiltration, persistence, or destructive behavior.

Install this only when you want an agent to inspect local OpenClaw configuration, cron prompts, skills, and workspace files for audit findings. Keep the generated JSON/report local or review it before sharing, because it may reveal file paths and locations of suspected credentials.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The script recursively reads files in the workspace and emits relative file paths when suspected secrets are detected, but provides no up-front notice or consent boundary to the operator. In shared, logged, or automated environments, this can expose sensitive project structure and indicate where secrets reside, increasing disclosure risk even though the tool is intended for defensive auditing.

Static analysis

No suspicious patterns detected.