OpenClawSec

OpenClaw Security Monitoring & Hardening Tool

OpenClawSec is a security monitoring tool for OpenClaw deployments. It scans for vulnerabilities, audits installed skills for malware patterns, checks CVE databases, and provides actionable hardening recommendations — all from a simple CLI.

Features

• Version Check — Compare your OpenClaw version against the latest release
• CVE Scanner — Check against 60+ known OpenClaw vulnerabilities
• Gateway Exposure Check — Detect if your gateway is exposed to the network
• Skill Audit — Scan installed skills for malware patterns (ClawHavoc, AMOS stealer, etc.)
• Secrets Scanner — Detect exposed API keys and credentials
• Config Hardening — Analyze your openclaw.json for security issues
• Continuous Monitoring — Run background monitoring with alerts

Installation

Prerequisites

• Node.js 18 or higher
• npm or pnpm

Quick Install

npm install -g openclawsec

Or run directly with npx

npx openclawsec scan

Usage

Full Security Scan

openclawsec scan

Runs a comprehensive security scan including:

• OpenClaw version check
• CVE vulnerability detection
• Gateway exposure analysis
• Skill malware scanning
• Secrets audit

Quick Health Check

openclawsec doctor

Fast diagnostic check for basic security issues.

Skill & Secrets Audit

openclawsec audit

Specifically audits installed skills for malicious patterns and checks for exposed secrets.

Continuous Monitoring

openclawsec monitor

Run continuous background monitoring (checks every 60 minutes by default).

Custom interval:

openclawsec monitor --30  # Every 30 minutes

Check Monitoring Status

openclawsec status

Show Help

openclawsec help

Output Example

╔══════════════════════════════════════════════════╗
║           OPENCLAWSEC SECURITY REPORT            ║
╠══════════════════════════════════════════════════╣
║  OpenClaw Version:  2026.4.22                   ║
║  Latest Version:    2026.5.4 ⚠️ OUTDATED        ║
║  Security Score:   68/100                       ║
╠══════════════════════════════════════════════════╣
║  🔴 CRITICAL (3)                                ║
║  🟡 WARNING (2)                                 ║
║  🟢 PASSED (5)                                  ║
╚══════════════════════════════════════════════════╝

Security Checks

CVE Coverage

Detects all major OpenClaw CVEs including:

• CVE-2026-25253 (CVSS 8.8) — WebSocket token exfiltration
• CVE-2026-24763 (CVSS 8.8) — Docker sandbox bypass
• CVE-2026-33579 (CVSS 8.1) — Privilege escalation
• CVE-2026-28446 (CVSS 9.8) — Voice RCE
• CVE-2026-44113 (CVSS 8.3) — TOCTOU race condition

Malicious Pattern Detection

ClawShield scans for:

• ClawHavoc malware indicators
• Base64 encoded payloads
• C2 server connections
• Credential harvesting patterns
• AMOS stealer references
• Suspicious tunnel services (bore.pub, localhost.run)

Free & Open Source

ClawShield is completely free to use. No paid tiers, no hidden fees.

Support

Contributing

Contributions are welcome! Please read the contributing guidelines and submit PRs.

License

MIT License — see LICENSE file for details.

Links

• GitHub
• ClawHub
• OpenClaw
• Report Issues

Made with ❤️ for the OpenClaw community Don't run insecure AI agents — ClawShield them.