Clawseccheck

Your OpenClaw agent reads your messages, remembers your conversations, holds your keys, and acts on your behalf. That power is exactly what attackers want to borrow: one poisoned message or one malicious skill can quietly turn your agent against you.

ClawSecCheck is a security check-up for your agent. It examines your setup, grades it A–F, and explains — in plain language, right in your chat — what is risky and why. It only reports: it never changes anything, needs no API key, and the scanner itself makes no network calls — no telemetry, no uploads, ever.

🚀 Start in one minute — no terminal needed

1. Tell your agent:

Install the clawseccheck skill from ClawHub.

…or with a command: openclaw skills install @gl0di/clawseccheck · skill page on ClawHub

2. Then ask:

Audit my OpenClaw setup with clawseccheck.

3. Your grade and the most urgent problems appear right in the chat. Done.

What you'll see — a real report against a deliberately vulnerable test setup:

💬 You talk — it audits

No flags, no commands. Everything works as a conversation:

🔍 What it checks

On top of the 143 individual checks, a risk engine hunts for deadly combinations — chains like "untrusted input → reachable secrets → outbound tool" that make an attack trivial. Full list: check catalog.

🏆 Why ClawSecCheck

• Private by architecture. Unlike scanners that upload your configuration for analysis, ClawSecCheck's engine runs entirely on your machine. No account, no API key — and the scanner contains no telemetry client and makes no network requests.
• Sees what the built-in audit misses. OpenClaw's own audit doesn't inspect your bootstrap files (SOUL.md, AGENTS.md, …) — the ones injected straight into the model as trusted context. ClawSecCheck checks them for injection. It also runs the native audit for you and folds the results into one report.
• Protects you before it's too late. After the ClawHavoc wave of credential-stealing skills, "check before install" matters: ask it to vet any skill, plugin, or MCP server before you enable it.
• Honest by design. What it can't determine is reported as UNKNOWN — never quietly counted as safe. An open CRITICAL finding hard-caps your score: you can never get a pretty "A" with a real hole in it.
• Built like it matters. 6,237 automated tests run on every change, a false alarm is treated as a release-blocking bug, and every release is cryptographically signed.
• Free and readable. MIT-licensed, pure Python standard library, zero dependencies — the entire engine is source you can read.

🔒 Safe to run

The tool that audits your agent survives an audit itself: it is read-only with respect to your OpenClaw setup (it never touches your config, skills, or bootstrap files), its engine is offline by design, and it writes only its own local history under ~/.clawseccheck/ — removable any time by asking your agent to "purge the clawseccheck data".

One honest nuance: when you use it through OpenClaw chat, the report text becomes part of your conversation and is handled by whatever model provider your agent already uses — the scanner itself adds no channel of its own. Details: security model · FAQ.

Every release ships a SHA256SUMS.txt signed with keyless cosign; clawseccheck --verify-self prints your copy's digest to compare.

# Get the release assets (adjust the version):
curl -LO https://github.com/gl0di/clawseccheck/releases/download/vX.Y.Z/SHA256SUMS.txt
curl -LO https://github.com/gl0di/clawseccheck/releases/download/vX.Y.Z/SHA256SUMS.txt.bundle

cosign verify-blob \
  --bundle SHA256SUMS.txt.bundle \
  --certificate-identity-regexp "^https://github.com/gl0di/clawseccheck/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS.txt

A passing verification proves the reference digest was produced by this repo's release workflow and hasn't been altered since.

ClawSecCheck is also a full standalone CLI (zero dependencies, Python 3.9+):

pipx install "git+https://github.com/gl0di/[email protected]"   # pin a release tag (recommended)
pipx install git+https://github.com/gl0di/clawseccheck             # or track the latest source
clawseccheck                         # audits ~/.openclaw by default
clawseccheck --json                  # machine-readable result
clawseccheck --sarif results.sarif   # SARIF 2.1.0 for GitHub Code Scanning
clawseccheck --html report.html      # standalone HTML report (private)
clawseccheck --fail-under 70         # CI gate: exit 1 if score < 70

The User guide covers the modes and recipes — vetting engines, drift monitoring, attestation, red-team self-tests. clawseccheck --help is the complete flag list.

[!IMPORTANT] An honest limit: a clean report means "no known attack pattern matched" — not "provably safe." Most checks are static: they bound what your agent can do, not how it behaves under a live attack. The optional self-tests exercise selected live paths but are graded by your own agent, so they can't prove safety against arbitrary attacks either. UNKNOWN is always shown as UNKNOWN, never hidden. The full, unvarnished list of limitations is in the User guide.

📚 Documentation

🙌 Feedback, security, license

• Something looks wrong? Open an issue — false alarms are treated as bugs.
• Found a vulnerability? Report privately via SECURITY.md.
• License: MIT. Maintained by gl0di.