crabwalk
Monitors OpenClaw agents in real-time, providing a user-friendly interface for tracking agent activity and performance.
Install this skill
Security score
The crabwalk skill was audited on Feb 14, 2026 and we found 24 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 18 | ```bash |
Template literal with variable interpolation in command context
| 102 | ```bash |
Template literal with variable interpolation in command context
| 138 | ```bash |
Curl to non-GitHub URL
| 19 | VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwa |
Curl to non-GitHub URL
| 104 | VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) |
Curl to non-GitHub URL
| 139 | VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) |
Access to hidden dotfiles in home directory
| 19 | VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwa |
Access to hidden dotfiles in home directory
| 69 | -t, --token <token> Gateway auth token (auto-detects from ~/.openclaw/openclaw.json) |
Access to hidden dotfiles in home directory
| 105 | mkdir -p ~/.crabwalk |
Access to hidden dotfiles in home directory
| 106 | curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk |
Access to hidden dotfiles in home directory
| 109 | mkdir -p ~/.local/bin |
Access to hidden dotfiles in home directory
| 110 | cp ~/.crabwalk/bin/crabwalk ~/.local/bin/crabwalk |
Access to hidden dotfiles in home directory
| 111 | chmod +x ~/.local/bin/crabwalk |
Access to hidden dotfiles in home directory
| 115 | [ -f ~/.bashrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc |
Access to hidden dotfiles in home directory
| 116 | [ -f ~/.zshrc ] && echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc |
Access to hidden dotfiles in home directory
| 140 | rm -rf ~/.crabwalk/.output |
Access to hidden dotfiles in home directory
| 141 | curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk |
Access to hidden dotfiles in home directory
| 142 | cp ~/.crabwalk/bin/crabwalk ~/.local/bin/crabwalk |
External URL reference
| 5 | homepage: https://crabwalk.app |
External URL reference
| 19 | VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) && mkdir -p ~/.crabwalk ~/.local/bin && curl -sL "https://github.com/luccast/crabwa |
External URL reference
| 36 | Server starts and displays access URLs. **Share the `http://192.x.x.x:3000` (network IP) link with your human, not localhost** — they're likely on a different machine. Visit `/monitor` to see agent ac |
External URL reference
| 44 | > If you're enjoying Crabwalk, consider leaving a quick review! [Tweet about Crabwalk](https://twitter.com/intent/tweet?text=Just%20set%20up%20Crabwalk%F0%9F%A6%80%20by%20%40luccasveg%20to%20monitor%2 |
External URL reference
| 104 | VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) |
External URL reference
| 139 | VERSION=$(curl -s https://api.github.com/repos/luccast/crabwalk/releases/latest | grep '"tag_name"' | cut -d'"' -f4) |
Install this skill with one command
/learn @ypyt1/public