openclaw-sec
Provides real-time security validation for AI agents against various injection attacks and content policy violations.
Install this skill
Security score
The openclaw-sec skill was audited on Feb 11, 2026 and we found 24 security issues across 5 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
Python subprocess execution
| 845 | result = subprocess.run( |
Webhook reference - potential data exfiltration
| 524 | webhook: |
Webhook reference - potential data exfiltration
| 529 | webhook_url: "https://hooks.slack.com/services/..." |
Webhook reference - potential data exfiltration
| 532 | webhook_url: "https://discord.com/api/webhooks/..." |
Webhook reference - potential data exfiltration
| 710 | - Slack tokens & webhooks |
Access to /etc/passwd
| 132 | openclaw-sec check-url "file:///etc/passwd" |
Access to /etc/passwd
| 154 | openclaw-sec validate-path "../../../etc/passwd" |
Access to /etc/passwd
| 164 | - Absolute path to sensitive files (`/etc/passwd`, `/proc/*`) |
Access to /etc/passwd
| 671 | ✗ "file:///etc/passwd" |
Access to /etc/passwd
| 683 | - Sensitive system paths (`/etc/passwd`, `/proc/*`) |
Access to /etc/passwd
| 691 | ✗ "../../../etc/passwd" |
Path traversal pattern
| 154 | openclaw-sec validate-path "../../../etc/passwd" |
Path traversal pattern
| 691 | ✗ "../../../etc/passwd" |
Access to hidden dotfiles in home directory
| 538 | file: ~/.openclaw/logs/security-events.log |
Access to hidden dotfiles in home directory
| 586 | This installs hooks to `~/.claude-code/hooks/`. |
Unicode escape sequences
| 743 | ✗ "\\u0065\\u0076\\u0061\\u006c" (unicode) |
External URL reference
| 130 | openclaw-sec check-url "https://example.com" |
External URL reference
| 131 | openclaw-sec check-url "http://169.254.169.254/metadata" |
External URL reference
| 526 | url: "https://hooks.example.com/security" |
External URL reference
| 529 | webhook_url: "https://hooks.slack.com/services/..." |
External URL reference
| 532 | webhook_url: "https://discord.com/api/webhooks/..." |
External URL reference
| 669 | ✗ "http://169.254.169.254/latest/meta-data/" |
External URL reference
| 670 | ✗ "http://localhost:6379/admin" |
External URL reference
| 672 | ✗ "http://user:pass@internal-db:5432" |