Have I Been Clawned?GitHubHave I Been
Clawned?
72 security checks. 60 seconds. One grade.
Find out if your agent is leaking secrets, running unverified skills, or exposing your identity.
What's actually at risk
Most OpenClaw agents run with zero security. Here's what that means.
Account takeover / Identity theft / Full system compromise
Your agent has your email. Your email has your MFA codes, password resets, and account recovery. One compromised agent = every account that uses email verification.
Unverified skills run with full agent permissions. They can read your documents, credentials, and personal data — then exfiltrate it silently. Everything an attacker needs to become you.
No sandbox means the agent sees your filesystem, network, and every credential on disk. SSH keys, cloud tokens, browser sessions — all reachable. One breach, total access.
Beyond the config file
OpenClaw's built-in security audit is solid for checking your gateway config. This tool goes further — the host, the container, the network, the secrets on disk, and the MCP supply chain around your agent.
72 checks across 9 categories
Works whether or not you have CLI access to run the built-in audit.
If you do — run both. They're complementary.
Audit your agent in 60 seconds
Two ways to run. Pick whichever fits.
“Review haveibeenclawned.com — what does this tool do and is it safe to run?”
Click to copy
Agent reviews the site, then you decide whether to run it.
curl -sSL https://haveibeenclawned.com/audit.sh -o /tmp/hibc-audit.sh
cat /tmp/hibc-audit.sh
bash /tmp/hibc-audit.sh
Click to copy
Download, review, and run all 72 checks. No dependencies beyond bash.
All checks run locally. Nothing leaves your machine.
Read the source code
What the audit checks
72 checks across identity, secrets, network, sandbox, supply chain, and infrastructure. Weighted scoring with OWASP and CVE references.
Everything runs locally — no data is sent anywhere.
Trust & verification
- Open source (MIT) — full source at github.com/wadim/haveibeenclawned
- Read-only analysis — no writes, no destructive operations
- No data exfiltration — everything runs locally, only
--submitsends anonymous stats (opt-in) - Cross-source verify: download from GitHub (
raw.githubusercontent.com/wadim/haveibeenclawned/main/public/audit.sh) and compare against the website copy - Not affiliated with haveibeenpwned.com — this is a security audit for OpenClaw agents
To run all 72 checks:
curl -sSL https://raw.githubusercontent.com/wadim/haveibeenclawned/main/public/audit.sh -o /tmp/hibc-audit.sh
head -20 /tmp/hibc-audit.sh # read what it does and does NOT do
bash /tmp/hibc-audit.sh --dry-run # preview checks without running
bash /tmp/hibc-audit.sh # run all 72 checks
Use --json for machine-readable output. The individual checks below are reference only — run the script instead of executing them one by one. Full skill instructions
Critical — 15 points each
CLAW-01: Gateway Network Exposure
Gateway bound to public interface — accessible from the internet
How this check works
Read ~/.openclaw/openclaw.json → gateway.bind
If 0.0.0.0, lan, or non-loopback: VERIFIED FAIL
If loopback/127.0.0.1: probe external interface. Blocked → VERIFIED PASS
Fix: openclaw config set gateway.bind loopback
CLAW-02: Gateway Authentication
No authentication on gateway — anyone who can reach it controls your agent
How this check works
Read ~/.openclaw/openclaw.json → gateway.auth
Auth disabled/no token: FAIL
Auth enabled: attempt unauthenticated WebSocket (5s). Connects → VERIFIED FAIL. Rejected → VERIFIED PASS
Fix: openclaw config set gateway.auth.mode token && openclaw config set gateway.auth.token "$(openssl rand -hex 32)"
CLAW-03: Cloud Metadata Service
Cloud metadata endpoint accessible — agent can steal IAM credentials
How this check works
curl -s -m 2 http://169.254.169.254/latest/meta-data/
HTTP 200: VERIFIED FAIL. Timeout: PASS. Not on cloud: SKIP
Fix: sudo iptables -A OUTPUT -d 169.254.169.254 -j DROP
CLAW-04: Personal Email as Agent Identity
Personal email used as agent identity — compromise means impersonation
How this check works
Read ~/.openclaw/openclaw.json → email config
Match against gmail.com, yahoo.com, hotmail.com, outlook.com, icloud.com, protonmail.com, etc.
Match: FAIL. Custom domain or no email: PASS
Fix: Use a dedicated agent email on a domain you control
CLAW-05: Plaintext API Keys in Config
API keys in plaintext config files — any skill or process can read them
How this check works
Scan: ~/.openclaw/openclaw.json, ~/.openclaw/.env, .env, openclaw.json
Patterns: sk- (20+), sk-ant-, AKIA (16), ghp_ (36), xoxb-/xoxp-, AIza (35)
Any match: FAIL (report file + type, never echo the key)
Fix: chmod 600 ~/.openclaw/.env && openclaw config set auth.keychain true
CLAW-06: Sensitive Files Accessible
SSH keys, cloud credentials, or other sensitive files readable by agent
How this check works
Test readable: ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials, ~/.config/gcloud/application_default_credentials.json, ~/.kube/config, ~/.npmrc, ~/.docker/config.json, ~/.netrc
3+: VERIFIED FAIL. 1-2: WARN. None: VERIFIED PASS
Fix: openclaw config set sandbox.mode all
CLAW-07: Secrets in Session Transcripts
API keys, credit cards, or SSNs found in conversation history files
How this check works
OPT-IN: Ask user consent. Declined → SKIP
Scan 10 most recent files in ~/.openclaw/agents/*/sessions/*.jsonl
Credit cards, SSNs, API keys found → VERIFIED FAIL (report count, never values)
Fix: openclaw config set logging.redactSensitive tools
CLAW-08: Docker Privileged Mode
Container running with --privileged, host network, or full filesystem mount
How this check works
Check if running in Docker: test -f /.dockerenv
docker inspect: check Privileged, NetworkMode=host, Binds mounting / or /home
Privileged or host net or full mount: VERIFIED FAIL. Not in Docker: SKIP
Fix: Remove --privileged, use bridge networking, mount only needed dirs
CLAW-09: Agent Running as Root
Agent process running as UID 0 — any compromise is full system compromise
How this check works
Check: id -u (or stat /proc/self if in container)
UID 0: VERIFIED FAIL. Non-root: PASS
Fix: Run agent as unprivileged user: useradd -r openclaw && su openclaw
CLAW-31: MCP Tool Description Poisoning
Invisible Unicode in MCP tool descriptions can hijack agent behavior
How this check works
Scan MCP config files for invisible Unicode (zero-width spaces, bidirectional overrides, tag characters)
Also scan for suspicious keywords: ignore previous, exfiltrate, override
Invisible Unicode found: VERIFIED FAIL. Suspicious keywords: WARN. Clean: PASS
Fix: perl -CSD -pe 's/[\\x{200B}-\\x{200F}\\x{202A}-\\x{202E}\\x{2060}-\\x{2064}\\x{FEFF}]//g' -i ~/.openclaw/mcp/*.json
CLAW-32: MCP Tool Shadowing
Duplicate tool names across MCP servers — malicious server intercepts calls
How this check works
Parse all MCP server configs, extract tool names
Build map of tool_name → [servers]. Any name in 2+ servers: VERIFIED FAIL
All unique: PASS. No MCP: SKIP
Fix: openclaw mcp list-tools --check-duplicates && openclaw config set mcp.allowedServers ["filesystem","git"]
CLAW-33: Unrestricted Outbound Network
No egress filtering — compromised agent can exfiltrate data to any server
How this check works
Check network.allowedHosts in config. Not set or *: test outbound (curl httpbin.org)
Unrestricted outbound confirmed: VERIFIED FAIL. Allowlist configured: PASS
Fix: openclaw config set network.allowedHosts ["api.anthropic.com","api.openai.com"]
CLAW-34: Messaging Platform Token Exposure
Telegram/Slack/Discord tokens in plaintext config — full bot impersonation
How this check works
Scan config and .env for: Telegram bot tokens (digits:base64), Slack (xoxb-/xoxp-), Discord tokens
Tokens found + lax file perms: FAIL. Tokens via env vars: PASS. None: PASS
Fix: Move tokens to env vars, chmod 600 .env, rotate exposed tokens
CLAW-36: Dangerous CLI Flags in Startup
Agent started with --yolo or --dangerously-skip-permissions — zero protection
How this check works
Check /proc/self/cmdline and startup scripts for: --dangerously-skip-permissions, --yolo, --trust-all-tools, --disable-sandbox
Check env vars: OPENCLAW_SKIP_PERMISSIONS, OPENCLAW_YOLO
Any found: VERIFIED FAIL. None: PASS
Fix: Remove all dangerous flags. Use explicit, minimal permission grants instead.
CLAW-51: WebSocket Origin Validation (CSWSH)
Gateway accepts WebSocket connections from any origin — cross-site hijacking possible
How this check works
Send WebSocket upgrade with Origin: https://evil.example.com
HTTP 101 accepted: VERIFIED FAIL. Rejected: PASS. Gateway not running: check gateway.cors.allowedOrigins in config
Fix: openclaw config set gateway.cors.allowedOrigins ["https://your-domain.com"]
CLAW-52: LLM Endpoint Integrity
API base URLs in config do not match expected providers — possible man-in-the-middle
How this check works
Read API base URLs from config and env (ANTHROPIC_BASE_URL, OPENAI_BASE_URL, etc.)
Check against known providers: api.anthropic.com, api.openai.com, etc.
Flag HTTP_PROXY/HTTPS_PROXY overrides and NODE_TLS_REJECT_UNAUTHORIZED=0
Custom/unknown base URL or proxy override: FAIL. Known providers only: PASS
Fix: Remove custom base URLs, unset HTTP_PROXY/HTTPS_PROXY, unset NODE_TLS_REJECT_UNAUTHORIZED
CLAW-53: Credential Routing Through LLM Context
Skill instructions route secrets through the LLM prompt — credentials exposed in context window
How this check works
Scan SKILL.md and README.md in ~/.openclaw/skills/*/
Search for patterns: 'include your API key', 'paste your token', 'pass your credentials in the message'
Pattern found: FAIL. No skills or clean: PASS
Fix: Refactor skills to read credentials from env vars or config, never from the context window
CLAW-64: Active C2 Connection Detection
Check active network connections against known C2 infrastructure IPs from the ClawHavoc campaign.
How this check works
Check active network connections against known C2 IP list
Match found: VERIFIED FAIL. No matches: PASS
Fix: Kill suspicious connections: ss -tlnp | grep <C2_IP> && kill <PID>
CLAW-65: Malware Signature Scan
Scan installed skills for AMOS stealer patterns, reverse shell markers, and known malicious file hashes.
How this check works
Scan installed skills for AMOS stealer signatures and known malicious hashes
Malware signature found: VERIFIED FAIL. Clean: PASS
Fix: rm -rf ~/.openclaw/skills/<infected-skill> && rotate all credentials
CLAW-67: VS Code Extension Trojans
Detect fake OpenClaw VS Code extensions — OpenClaw has no official extension, so any match is malicious.
How this check works
Check installed VS Code extensions for OpenClaw-related names
Any OpenClaw extension found: VERIFIED FAIL (OpenClaw has no official extension). None: PASS. VS Code not installed: SKIP
Fix: code --uninstall-extension <fake-extension-id> && rotate credentials
CLAW-68: Gateway Device Auth Bypass
Check if dangerouslyDisableDeviceAuth is enabled or if LAN-bound gateway lacks trustedProxies config.
How this check works
Read ~/.openclaw/openclaw.json → gateway.dangerouslyDisableDeviceAuth and gateway.trustedProxies
dangerouslyDisableDeviceAuth=true or trustedProxies contains *: VERIFIED FAIL. Both secure: PASS
Fix: openclaw config set gateway.dangerouslyDisableDeviceAuth false && openclaw config set gateway.trustedProxies '[]'
High — 10 points each
CLAW-10: Sandbox Configuration
No sandbox — agent code runs directly on host with full access
How this check works
Read ~/.openclaw/openclaw.json → sandbox.mode
off/not set: FAIL. non-main: WARN. all + session scope: PASS. all + shared scope: WARN
Fix: openclaw config set sandbox.mode all && openclaw config set sandbox.scope session
CLAW-11: Elevated Mode Restrictions
Elevated mode unrestricted — any session can escape the sandbox
How this check works
Read ~/.openclaw/openclaw.json → tools.elevated
allowFrom * or all: FAIL. Restricted: PASS. Not configured: PASS
Fix: openclaw config set tools.elevated.allowFrom ["your-telegram-id"]
CLAW-12: Config File Permissions
Config files readable by group or others — secrets exposed to other users
How this check works
Check: ~/.openclaw/openclaw.json, ~/.openclaw/.env, ~/.openclaw/credentials/*, auth-profiles.json
Any > 600 (files) or > 700 (dirs): FAIL. All owner-only: PASS
Fix: chmod 600 ~/.openclaw/openclaw.json ~/.openclaw/.env
CLAW-13: Installed Skills Threat Intel
Known-malicious or unverified skills installed — supply chain risk
How this check works
List ~/.openclaw/skills/
Check against: data-exfil, keylogger, reverse-shell, crypto-miner, credential-stealer, prompt-injector, shadow-agent, backdoor-tool, solana-wallet-tracker, polymarket-trader, token-sniper, atomic-stealer, openclaw-boost, free-credits, claw-premium, admin-tools
Also flag: no SKILL.md, modified last 24h, npm post-install scripts
Malicious: VERIFIED FAIL. 3+ unverified: WARN. Clean: PASS
Fix: rm -rf ~/.openclaw/skills/<malicious-skill>
CLAW-14: MCP Server Vulnerabilities
MCP packages with known CVEs — remote code execution risk
How this check works
Find MCP packages in agent config, node_modules, MCP config
mcp-remote < 1.1.0, @anthropic/mcp-inspector < 0.7.0, @anthropic/mcp-server-filesystem < 2.1.0, @anthropic/mcp-server-git < 2.1.0
Vulnerable: FAIL. No MCP: SKIP. All patched: PASS
Fix: npm update mcp-remote @anthropic/mcp-inspector @anthropic/mcp-server-filesystem
CLAW-15: OpenClaw Version Security
Running a version with known security vulnerabilities
How this check works
openclaw --version or package.json
< 2.6.1: CVE-2026-25253 (RCE). < 2.5.0: path traversal
Vulnerable: FAIL. Current: PASS
Fix: openclaw update
CLAW-16: Session File Permissions
Session files readable by others — conversation history exposed
How this check works
Check ~/.openclaw/agents/*/sessions/ permissions
Readable by group/others: FAIL. Owner-only: PASS
Fix: chmod -R 700 ~/.openclaw/agents/*/sessions/
CLAW-17: Default Credentials in Config
Default or placeholder values in config — unchanged from template
How this check works
Scan openclaw.json and .env for: change_me, default, placeholder, example, YOUR_, xxx, CHANGEME, TODO
Any match in a value field: FAIL. None found: PASS
Fix: Replace all placeholder values with real credentials
CLAW-18: .env Not in .gitignore
Secret files not excluded from git — may be committed accidentally
How this check works
Check if .env is listed in .gitignore (in cwd and in ~/.openclaw/)
Not present in .gitignore: FAIL. Present: PASS. Not a git repo: SKIP
Fix: echo '.env' >> .gitignore && echo '.env.local' >> .gitignore
CLAW-19: Secrets in Git History
API keys or passwords found in git commit history — persist forever
How this check works
Run: git log --all -p (last 50 commits) and search for API key patterns
Same patterns as CLAW-05: sk-, AKIA, ghp_, xoxb-, etc.
Found: FAIL (report commit hash, never the key). No git: SKIP. Clean: PASS
Fix: git filter-branch or BFG Repo-Cleaner to remove secrets, then rotate keys
CLAW-20: Browser Profiles Accessible
Chrome/Firefox/Brave profiles readable — saved passwords and cookies exposed
How this check works
Test readable: ~/.config/google-chrome/, ~/.config/BraveSoftware/, ~/.mozilla/firefox/, ~/Library/Application Support/Google/Chrome/
Any readable: FAIL. None: PASS
Fix: openclaw config set sandbox.mode all
CLAW-21: Git Credentials Accessible
Git credential files readable — repository tokens and passwords exposed
How this check works
Test readable: ~/.git-credentials, ~/.gitconfig (check for credential helpers storing tokens)
Plaintext credentials found: FAIL. No credential files: PASS
Fix: Use SSH keys instead, or credential-cache with short timeout
CLAW-22: Database Credentials Accessible
Database credential files readable — direct database access possible
How this check works
Test readable: ~/.pgpass, ~/.my.cnf, ~/.mongosh/, ~/.redis-cli-history
Any found and readable: FAIL. None: PASS
Fix: chmod 600 ~/.pgpass ~/.my.cnf && openclaw config set sandbox.mode all
CLAW-23: Additional Services on 0.0.0.0
Other agent services bound to all interfaces — publicly reachable
How this check works
Run: ss -tlnp or netstat -tlnp
Check for services on 0.0.0.0 or ::: at common agent ports (3000, 5000, 8000, 8080, 8888)
Any found: FAIL (list ports). None: PASS
Fix: Bind services to 127.0.0.1 in their respective configs
CLAW-24: No Firewall Rules
No firewall configured — every listening port is exposed
How this check works
Check: iptables -L -n, ufw status, nftables list
No rules or firewall inactive: FAIL. Active with rules: PASS. macOS with pf disabled: WARN
Fix: ufw enable && ufw default deny incoming && ufw allow ssh
CLAW-25: Container Security Profile
No seccomp/AppArmor profile — container escape risk via runC CVEs
How this check works
If in Docker: docker inspect → SecurityOpt
No seccomp or AppArmor profile (unconfined): FAIL. Profile applied: PASS. Not in container: SKIP
Fix: Run with --security-opt seccomp=default --security-opt apparmor=docker-default
CLAW-26: Agent Code Integrity
Uncommitted modifications to agent source — potential backdoor
How this check works
cd to agent install dir, run git status/diff
Uncommitted changes to source files: FAIL. Clean: PASS. Not a git repo: SKIP
Fix: git diff to review changes, git checkout -- . to revert if unauthorized
CLAW-27: npm Lifecycle Scripts in Skills
Skills with lifecycle scripts — arbitrary code runs on install
How this check works
For each skill in ~/.openclaw/skills/, check package.json for preinstall/postinstall/prepare scripts
Scripts found: WARN (list them). Known malicious patterns (curl|wget|eval|exec): VERIFIED FAIL. None: PASS
Fix: Remove suspect skills and reinstall from verified sources
CLAW-35: No User Namespace Isolation
Container root maps to host root — container escape is full host compromise
How this check works
Check /proc/self/uid_map
0 0 4294967295 → no remapping: FAIL. Non-zero mapping: PASS. Not in Docker: SKIP
Fix: Add "userns-remap": "default" to /etc/docker/daemon.json, restart Docker
CLAW-37: Writable Agent Installation Directory
Agent can modify its own code — prompt injection can install persistent backdoor
How this check works
Find OpenClaw install dir (dirname $(which openclaw))
test -w: writable → FAIL. Read-only: PASS. Not found: SKIP
Fix: chown -R root:root /path/to/openclaw && chmod -R a-w /path/to/openclaw
CLAW-38: No Rate Limiting on Agent API
No rate limiting on gateway — Denial of Wallet attacks can run up LLM costs
How this check works
Read gateway.rateLimit.enabled from config
Not set or false: FAIL. Enabled: PASS
Fix: openclaw config set gateway.rateLimit.enabled true && openclaw config set gateway.rateLimit.maxPerMinute 60
CLAW-39: Cryptocurrency Wallet Files Accessible
Crypto wallet files readable by agent — funds can be drained irreversibly
How this check works
Test readable: Exodus, Electrum, Bitcoin, Ethereum dirs (macOS + Linux)
Also search for seed/mnemonic/recovery files in home dir
2+: VERIFIED FAIL. 1: WARN. None: PASS
Fix: chmod 700 ~/.bitcoin ~/.ethereum ~/.electrum; run agent as dedicated user
CLAW-40: Unsafe Deserialization in Dependencies
Vulnerable langchain-core or unsafe yaml.load in skills — RCE via prompt injection
How this check works
Check langchain-core version: < 0.3.81 or 1.0-1.2.4 → FAIL
Scan skills for yaml.load (not safe_load) → FAIL
All clean: PASS
Fix: pip install 'langchain-core>=0.3.81' && replace yaml.load with yaml.safe_load
CLAW-41: No Container Read-Only Filesystem
Writable container filesystem — compromised agent can install persistent malware
How this check works
Check /proc/mounts for root filesystem
ro flag: PASS. rw: FAIL. Not in Docker: SKIP
Fix: docker run --read-only --tmpfs /tmp:rw,noexec,nosuid ...
CLAW-42: Skill Network Access Unrestricted
No per-skill network permissions — any skill can exfiltrate data externally
How this check works
Read plugins.permissions and plugins.defaultDeny from config
No per-skill permissions: FAIL. defaultDeny includes network: PASS
Fix: openclaw config set plugins.defaultDeny network
CLAW-43: Unencrypted Session Storage
Session files stored unencrypted — disk compromise exposes full conversation history
How this check works
Read sessions.encryptAtRest from config
Not set or false: FAIL (if sessions exist). Enabled: PASS
Fix: openclaw config set sessions.encryptAtRest true
CLAW-44: Rules File Injection
CLAUDE.md or rules files contain invisible Unicode or suspicious injection patterns
How this check works
Scan CLAUDE.md, .openclaw/rules.md, agent system prompts
Check for invisible Unicode, injection keywords, suspiciously long lines
Invisible Unicode: VERIFIED FAIL. Suspicious keywords: WARN. Clean: PASS
Fix: perl -CSD -pe 's/[\\x{200B}-\\x{200F}\\x{202A}-\\x{202E}]//g' -i CLAUDE.md
CLAW-45: Stale or Unrotated API Keys
Credential files not modified in 90+ days — extended window for stolen key abuse
How this check works
Check last modification time of .env and openclaw.json
> 90 days: FAIL. 30-90: WARN. < 30: PASS
Fix: Rotate API keys now, set auth.rotationReminder 30
CLAW-46: npm Audit Vulnerabilities
Known vulnerabilities in agent npm dependencies — supply chain risk
How this check works
Run npm audit in agent directory and skill directories
Critical/high vulns: FAIL. Moderate/low: WARN. Clean: PASS
Fix: npm audit fix && npm audit fix --force
CLAW-47: Excessive Tool Permissions
Wildcard tool permissions — agent can write anywhere, execute anything
How this check works
Check tools.filesystem.write, tools.execute.allowed, tools.network.outbound
3+ wildcard categories: FAIL. 1-2: WARN. All scoped: PASS
Fix: openclaw config set tools.defaultPolicy deny
CLAW-48: Insecure MCP Transport
Remote MCP servers connected via HTTP — tool data transmitted in cleartext
How this check works
Parse MCP configs for http:// URLs (excluding localhost/127.0.0.1)
Remote HTTP found: FAIL. All HTTPS or local: PASS
Fix: Replace http:// with https:// in MCP config, or use stdio transport
CLAW-54: Persistent Memory Poisoning
Injection markers found in memory or context files — persistent prompt injection risk
How this check works
Scan ~/.openclaw/memory/, CLAUDE.md, .claude/memory/ for injection markers
Check for: 'ignore previous instructions', base64 payloads, zero-width Unicode
Injection markers found: VERIFIED FAIL. Suspicious patterns: WARN. Clean: PASS
Fix: Review and clean memory files, remove injected content, rotate compromised sessions
CLAW-55: Auto-Approval Beyond --yolo
Per-category auto-approve or allowedTools wildcards bypass tool confirmation
How this check works
Check OpenClaw config for autoApprove, allowedTools: '*'
Check Claude Code settings and MCP configs for per-category auto-approve
Wildcard or broad auto-approve found: FAIL. No auto-approve: PASS
Fix: Remove autoApprove flags and wildcard allowedTools, use explicit per-tool permissions
CLAW-56: Semantic Tool Description Poisoning
MCP tool descriptions contain exfiltration instructions or data harvesting patterns
How this check works
Scan MCP tool configs and skill definitions for social engineering patterns
Check for: 'read ~/.ssh', 'include API key', 'before using this tool first', 'exfiltrate', 'send to'
Pattern found: FAIL. Clean: PASS
Fix: Remove or rewrite suspicious tool descriptions, audit skill sources
CLAW-57: Tool Definition Pinning (Rug-Pull)
No integrity check on tool definitions — server can change tool behavior after approval
How this check works
Check MCP configs for tool definition hashes, pinning, or version locks
No integrity mechanism: WARN. Hashes or pinning configured: PASS
Fix: Pin MCP tool definitions with hashes or version locks where supported
CLAW-58: MCP Credential Hygiene
MCP servers use long-lived PATs instead of short-lived OAuth tokens
How this check works
Parse MCP server configs for token patterns: ghp_, glpat-, xoxb-, xoxp-
Check OAuth scopes for overly broad permissions: admin, org, write:all
Check for inline secrets in config
Long-lived tokens or broad scopes: FAIL. Narrow scopes, short-lived: PASS
Fix: Replace long-lived tokens with short-lived ones, narrow OAuth scopes to minimum required
CLAW-59: Dormant Payload Detection
Conditional or time-based triggers found in persistent context — delayed attack risk
How this check works
Scan persistent context files for conditional triggers
Check for: 'if date is after', 'when the user asks about', base64 near conditionals
Trigger patterns found: VERIFIED FAIL. Suspicious patterns: WARN. Clean: PASS
Fix: Review and remove conditional payloads from context files, reset memory
CLAW-60: Observability Endpoint Security
Telemetry endpoints use HTTP or have known CVEs — trace data exposed
How this check works
Check config and env for telemetry endpoints: LANGSMITH_ENDPOINT, LANGFUSE_HOST, HELICONE_BASE_URL
HTTP endpoint found: FAIL. HTTPS or no telemetry: PASS
Fix: Update telemetry endpoints to use HTTPS
CLAW-61: Skill Typosquatting Detection
Installed skill name is suspiciously similar to a popular skill — possible typosquatting
How this check works
List installed skills in ~/.openclaw/skills/
Compare names against known popular skills using edit distance 1-2
Near-match found (edit distance 1-2): WARN. Exact malicious match: FAIL. All clean: PASS
Fix: Remove typosquatted skills and install from verified sources
CLAW-66: Exfiltration Domain References
Check skill files for references to known exfiltration services (webhook.site, pipedream.net, ngrok.io, etc.).
How this check works
Scan skill source files for known exfiltration domains: webhook.site, ngrok.io, requestbin.com, pipedream.com, burpcollaborator.net
Domain reference found: FAIL. Clean: PASS
Fix: Remove or replace skills referencing exfiltration domains
CLAW-69: Exec-Approvals Hardening
Verify exec-approvals.json doesn't have allow-all security settings or disabled confirmation prompts.
How this check works
Read exec-approvals.json or equivalent approval config
Wildcard approvals or approve-all patterns: FAIL. Scoped approvals: PASS. No file: SKIP
Fix: Restrict exec-approvals.json to specific commands and paths
CLAW-71: DM Channel Restrictions
Check messaging channel DM policies for open access — channels with dmPolicy='open' or wildcard allowFrom let anyone message the agent.
How this check works
Read channel config for DM policies
Unrestricted DM access or no DM policy: FAIL. DM restricted to approved contacts: PASS
Fix: openclaw config set channels.dm.policy restricted
CLAW-72: Known Malicious Publishers
Check installed skill package.json files against a blacklist of known malicious ClawHub publishers.
How this check works
List installed skills and extract publisher/author metadata
Check against known malicious publisher blacklist
Blacklisted publisher found: VERIFIED FAIL. All clean: PASS
Fix: rm -rf ~/.openclaw/skills/<blacklisted-skill> && openclaw skills install <verified-alternative>
Medium — 5 points each
CLAW-28: Log Redaction
Log redaction disabled — secrets may appear in log files
How this check works
Read ~/.openclaw/openclaw.json → logging.redactSensitive
Not set or off: FAIL. tools (default): PASS
Fix: openclaw config set logging.redactSensitive tools
CLAW-29: Debug Logging Enabled
Debug/verbose logging active — extra data including payloads leaked to logs
How this check works
Read ~/.openclaw/openclaw.json → logging.level
debug or verbose: FAIL. info/warn/error: PASS. Not set (defaults to info): PASS
Fix: openclaw config set logging.level info
CLAW-30: Sessions Synced to Cloud
Session files inside cloud-synced folder — history uploaded to iCloud/Dropbox
How this check works
Check if ~/.openclaw/ path contains: Mobile Documents, iCloud, Dropbox, Google Drive, OneDrive
Inside sync folder: FAIL. Outside: PASS
Fix: Move ~/.openclaw/ outside synced folders, or add to .nosync
CLAW-49: No Process Resource Limits
No ulimits or cgroup limits — runaway agent can exhaust all host resources
How this check works
Check ulimit -u (processes), ulimit -n (files), cgroup memory limit
Multiple unlimited: FAIL. Partial: WARN. All limited: PASS
Fix: docker run --memory=2g --cpus=2 --pids-limit=256 ... OR ulimit -n 4096 -u 256
CLAW-50: Exposed Health/Debug Endpoints
Debug or config endpoints return 200 — internal state leaked to attackers
How this check works
Probe gateway at common endpoints: /debug, /env, /config, /admin, /metrics
Any debug/env/config returns 200: FAIL. Only /health: PASS. Gateway not running: SKIP
Fix: openclaw config set server.debug false && openclaw config set server.disableEndpoints ["debug","env","config"]
CLAW-62: Sandbox Runtime Detection
Container uses default runc runtime — weaker isolation than gVisor or Firecracker
How this check works
Detect container runtime: check for /proc/self/status gVisor markers, /sys/hypervisor for Firecracker
runc: WARN (note stronger alternatives). gVisor or Firecracker: PASS. Not in container: SKIP
Fix: Switch to gVisor (runsc) or Firecracker for stronger container isolation
CLAW-63: Writable Persistence Paths
Agent can write to crontab, shell configs, or launch agents — persistence vector for injected payloads
How this check works
Test writable: ~/.bashrc, ~/.zshrc, ~/.profile, ~/Library/LaunchAgents/, ~/.config/systemd/user/
Check cron write access: crontab -l
3+: VERIFIED FAIL. 1-2: WARN. None: PASS
Fix: Run agent as dedicated user without write access to shell configs and startup dirs
CLAW-70: mDNS/Bonjour Exposure
Check if mDNS broadcasting is in 'full' mode, which exposes file paths and SSH ports to the local network.
How this check works
Check for mDNS/Bonjour service advertisements related to OpenClaw
Broadcasting agent paths/ports: FAIL. No mDNS advertisements: PASS. mDNS not available: SKIP
Fix: Disable mDNS advertisement for agent services or restrict to loopback
Scoring
Weighted 0-100 hardening score. 21 critical checks (15 pts), 43 high checks (10 pts), 8 medium checks (5 pts). 785 max points. Skipped checks excluded. Warnings earn half.
A
90-100
Hardened
B
75-89
Good
C
60-74
Needs work
D
40-59
Exposed
F
0-39
Critical
References
CVEs, CWEs, and standards referenced across all 72 checks.
CVEs
OWASP Agentic Top 10
CWEs
Additional sources
Standards & Frameworks
Run it. Break it. Improve it.
Security is a moving target. We need the community to keep this tool sharp.
Test it
Run the audit on your agent. Report false positives. Tell us what we miss. Your environment is different from ours — that's the point.
Add checks
Found an attack vector we don't cover? New CVE? New misconfiguration? Add a check with a verified detection and a concrete fix command.
Share threat intel
New C2 IPs, malicious domains, IOC patterns, known-bad publishers. The threat intel arrays in the script are community-maintained.
Open source. Free forever.