OpenClaw Security Scanner

Run a comprehensive local security scan on your OpenClaw installation. Checks config, network exposure, credentials, OS hardening, and agent guardrails. Scor...

This appears to be a coherent, local-only OpenClaw security scanner, but take these precautions before running it: 1) Inspect the full oc-security-scan.sh yourself (especially the truncated tail) to confirm there are no network calls (curl/wget/nc) or unexpected uploads. 2) Run without --fix first to review findings; do not run --fix unattended. 3) Run as a non-root user unless you explicitly need deeper checks, and back up configs before applying fixes. 4) Be aware the script will read config and secrets files (e.g., secrets.env) to check for plaintext tokens — that is expected behavior for a scanner but means the script has access to sensitive data while running. 5) If you need highest assurance, run it in an isolated environment (VM/container) and review any fix commands the script proposes before accepting them.

Type: OpenClaw Skill Name: openclaw-security-scanner Version: 1.0.0 The `oc-security-scan.sh` script uses `eval` to execute remediation commands when the `--fix` flag is provided. Although the `fix_cmd` values are hardcoded within the script itself and not derived from untrusted input, the use of `eval` is an inherently risky practice and represents a shell injection vulnerability pattern. This is a flaw that could allow attacks if the `fix_cmd` were ever to be dynamically constructed or influenced by external factors, classifying it as suspicious. No evidence of malicious intent, such as data exfiltration, persistence, or unauthorized network calls, was found; the script adheres to its stated 'local-only' claims.