Openclaw Triage

Incident response and forensics for agent workspaces. Investigate compromises, build timelines, assess blast radius, and collect evidence. Cross-references data from warden, ledger, signet, and sentinel for unified analysis. Free alert layer — upgrade to openclaw-triage-pro for automated containment, remediation playbooks, and evidence export.

This appears to be a coherent local triage tool, but review and treat it carefully before use: 1) Inspect the full scripts/triage.py for any network or subprocess commands that could transmit data; although the SKILL.md says 'no network calls', the code imports subprocess — verify there are none. 2) Run it against a copy of the workspace (or point --workspace to a snapshot) first to avoid accidental changes. 3) Expect it to collect and store potentially sensitive files (hashes, configs, credentials it finds) under .triage/evidence — protect that output. 4) Always run the evidence/collection command before any remediation/quarantine actions, and keep backups. 5) If you need higher assurance, run the script in an isolated environment (air‑gapped or with network blocked) and consider a quick code audit focusing on any subprocess calls, file writes, and any uses of network/socket libraries.

Type: OpenClaw Skill Name: openclaw-triage Version: 1.0.2 The OpenClaw Triage skill is a security tool designed for incident response and forensics within an agent workspace. Its code (`scripts/triage.py`) and documentation (`SKILL.md`, `README.md`) consistently describe functions for investigating, timeline building, scope assessment, evidence collection, and automated containment/remediation. The script explicitly states and adheres to 'No External Dependencies' and 'No network calls'. While it scans for credential patterns and exfiltration URLs, this is for detection and reporting, not for actual exfiltration. Actions like quarantining skills, locking critical files, and disabling suspicious hooks are defensive measures. Subprocess calls are made safely to other local OpenClaw security tools for remediation. There is no evidence of malicious intent, prompt injection, or unauthorized harmful behavior.