OpenClaw Audit Log Hook

Records and logs all tool calls before and after execution for auditing, debugging, usage stats, and error tracking with sensitive data redaction.

This skill is plausible but sloppy: do not install it as-is if you care about protecting secrets. Key issues to resolve before use: (1) actually write logs to a controlled file path (with secure file permissions) rather than console, and declare OPENCLAW_STATE_DIR; (2) integrate and improve redaction — apply redaction to parsed objects and nested fields, handle stringified JSON, and avoid relying on truncation as a protection; (3) add log rotation, retention limits, and access controls; (4) avoid logging raw command outputs or API responses that may include credentials or tokens; (5) consider hashing or minimizing session/user identifiers and document who can read the logs. If you can't review and modify the hooks yourself, treat this skill as risky because it could leak sensitive data into agent logs.

Type: OpenClaw Skill Name: openclaw-audit-log-hook Version: 1.0.0 The skill implements an audit logging mechanism in SKILL.md that records tool parameters and results. While it includes a 'redactSensitive' utility function, the provided hook implementations for 'before_tool_call' and 'after_tool_call' fail to actually invoke this function, leading to the logging of potentially sensitive data (API keys, tokens, passwords) in plain text to the console. This constitutes a sensitive information disclosure vulnerability.