# Openclaw Security Monitor

> Proactive security monitoring, threat scanning, and auto-remediation for OpenClaw deployments

- Skill: `adibirzu/openclaw-security-monitor` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add adibirzu/openclaw-security-monitor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/adibirzu/openclaw-security-monitor/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: adibirzu (https://skillmd.com/u/adibirzu)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/adibirzu/openclaw-security-monitor

---


# Security Monitor

Real-time security monitoring with threat intelligence from ClawHavoc research, the June 2026 OpenClaw advisory rollups, daily automated scans, web dashboard, and Telegram alerting for OpenClaw.

## Commands
Note: Replace `<skill-dir>` with the actual folder name where this skill is installed (commonly `openclaw-security-monitor` or `security-monitor`).

### /security-scan
Run a comprehensive 41-point security scan:
1. Known C2 IPs (ClawHavoc: 91.92.242.x, 95.92.242.x, 54.91.154.110)
2. Malware signatures & obfuscation (AMOS stealer, base64 payloads, binary downloads, file-padding evasion)
3. Reverse shells & backdoors (bash, python, perl, ruby, php, lua)
4. Credential exfiltration endpoints (webhook.site, pipedream, ngrok, etc.)
5. Crypto wallet targeting (seed phrases, private keys, exchange APIs)
6. Curl-pipe / download attacks
7. File & credential permission audit (config files, credentials dir, sessions)
8. Skill integrity hash verification
9. AI prompt injection & instruction manipulation (SKILL.md injection, memory poisoning, MCP tool poisoning, rules file backdoor, trusted prompt-channel downgrade fixes)
10. Gateway security configuration audit
11. WebSocket security (CVE-2026-25253, ClawJacked, device identity skip, CSWSH)
12. Known malicious publisher and installed skill-name pattern detection
13. Credential leakage & plaintext secrets (env access, hardcoded API keys, config.get redaction bypass GHSA-8372)
14. DM, tool & sandbox policies (open DM, elevated tools, disabled sandbox, Matrix room-control bypass GHSA-2gvc, wildcard owner command and bundled MCP/LSP tool-policy bypasses)
15. mDNS/Bonjour exposure detection
16. Persistence mechanism scan (LaunchAgents, crontabs, systemd)
17. Log security & poisoning (redaction, ANSI injection, header injection)
18. Plugin/extension security audit (including setup-api.js cwd/plugin hijack GHSA-r39h)
19. Docker container security (root, socket mount, privileged mode)
20. Authentication & route security (proxy bypass, CDP auth, browser bridge, /agent/act, webchat local-root bypass GHSA-mr34, SecretRef stale auth GHSA-xmxx, webhook SecretRef replay GHSA-q8ff, gateway config mutation guard GHSA-cwj3, June auth/scope CVEs)
21. Exec guardrails & approval security (safeBins bypass CVE-2026-28363, shell expansion CVE-2026-28463, approval injection CVE-2026-28466, heredoc/env-argv/applet/pipeline approval gaps, replay, June exec allowlist CVEs)
22. Node.js version / CVE-2026-21636 permission model bypass
23. VS Code extension trojan detection
24. Internet exposure detection
25. MCP server security audit (tool poisoning, stdio env filtering, loopback owner context, bundled MCP/LSP policy, Streamable HTTP redirect header leak CVE-2026-53840)
26. PATH hijacking & command resolution (GHSA-jqpq, CVE-2026-29610, workspace-derived service PATH CVE-2026-53865)
27. SSRF protection (CVE-2026-26322, CVE-2026-27488, QQBot/Zalo/browser media SSRF hardening, trailing-dot hostname checks CVE-2026-53859)
28. Path traversal & file handling (deep link CVE-2026-26320, browser control CVE-2026-28462, TAR CVE-2026-28453, OpenShell FS bridge read/write pinning)
29. DoS protection (webhook CVE-2026-28478, fetchWithGuard CVE-2026-29609)
30. ACP permission auto-approval (GHSA-7jx5)
31. Skill env override host injection (GHSA-82g8, workspace dotenv connector/runtime host overrides, June npm_execpath/STATE_DIRECTORY/CLOUDSDK_PYTHON/Node env CVEs)
32. Privilege escalation & scope abuse (pairing creds GHSA-7h7g, operator GHSA-vmhq, shared-auth GHSA-rqpp, paired-device, node-token, active-memory, and ACP child-session scope fixes)
33. SHA-1 sandbox cache key poisoning (CVE-2026-28479, CVSS 8.7)
34. Google Chat webhook cross-account bypass (CVE-2026-28469, CVSS 9.8)
35. SANDWORM_MODE MCP worm detection
36. Workspace plugin auto-discovery (GHSA-99qw)
37. Symlink traversal (CVE-2026-32013, CVE-2026-32055)
38. Sandbox escape & session inheritance (CVE-2026-32048, CVE-2026-32051)
39. Shell environment RCE (CVE-2026-32056, CVE-2026-27566)
40. VNC & observer authentication (CVE-2026-32064)
41. Device identity & metadata spoofing (CVE-2026-32014, CVE-2026-32042, CVE-2026-32025)

```bash
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/scan.sh
```

Exit codes: 0=SECURE, 1=WARNINGS, 2=COMPROMISED

### /security-dashboard
Display a security overview with process trees via witr.

```bash
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/dashboard.sh
```

### /security-network
Monitor network connections and check against IOC database.

```bash
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/network-check.sh
```

### /security-remediate
Scan-driven remediation: runs `scan.sh`, skips CLEAN checks, and executes per-check remediation scripts for each WARNING/CRITICAL finding. Includes 41 individual scripts covering file permissions, exfiltration domain blocking, tool deny lists, gateway hardening, sandbox configuration, credential auditing, ClawJacked protection, SSRF hardening, PATH hijacking cleanup, log poisoning remediation, /agent/act hardening, SHA-1 cache key migration, Google Chat webhook hardening, WebSocket identity enforcement, MCP tool poisoning quarantine, SANDWORM_MODE worm cleanup, rules file Unicode sanitization, workspace plugin auto-loading, shared-auth scope abuse, and exec approval replay.

```bash
# Full scan + remediate (interactive)
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh

# Auto-approve all fixes (explicit opt-in)
OPENCLAW_ALLOW_UNATTENDED_REMEDIATE=1 \
  bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --yes

# Dry run (preview)
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --dry-run

# Remediate a single check
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --check 7 --dry-run

# Run all 41 remediation scripts (skip scan)
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/remediate.sh --all
```

Flags:
- `--yes` / `-y` — Skip confirmation prompts only when `OPENCLAW_ALLOW_UNATTENDED_REMEDIATE=1`
- `--dry-run` — Show what would be fixed without making changes
- `--check N` — Run remediation for check N only (skip scan)
- `--all` — Run all 41 remediation scripts without scanning first

Exit codes: 0=fixes applied, 1=some fixes failed, 2=nothing to fix

### /clawhub-scan
Scan all locally installed ClawHub skills for security issues. Checks each skill against:
- Known malicious publishers (`ioc/malicious-publishers.txt`)
- Malicious skill name patterns (`ioc/malicious-skill-patterns.txt`)
- Suspicious script patterns: curl/wget pipe-to-shell, base64 decode/eval, reverse shells, credential file access, environment variable exfiltration
- Known C2 IP references (`ioc/c2-ips.txt`)
- Malicious domain references (`ioc/malicious-domains.txt`)
- SKILL.md integrity (shell injection in Prerequisites)
- Known malicious file hashes (`ioc/file-hashes.txt`)
- April 2026 plugin/dotenv/MCP artifacts (`setup-api.js`, OpenClaw runtime env overrides, high-risk startup env)

```bash
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/clawhub-scan.sh
```

Exit codes: 0=all clean, 1=warnings found, 2=critical findings

### /security-setup-telegram
Register a Telegram chat for daily security alerts.

```bash
bash ~/.openclaw/workspace/skills/<skill-dir>/scripts/telegram-setup.sh [chat_id]
```

## Web Dashboard

**URL**: `http://<vm-ip>:18800`

Read-only dark-themed browser dashboard that displays scan results from log files, IOC stats, installed skills list, and scan history. Does not execute any shell commands or child processes — all scans and remediation are triggered via CLI scripts.

### Service Management
```bash
launchctl list | grep security-dashboard
launchctl unload ~/Library/LaunchAgents/com.openclaw.security-dashboard.plist
launchctl load ~/Library/LaunchAgents/com.openclaw.security-dashboard.plist
```

## IOC Database

Threat intelligence files in `ioc/`:
- `c2-ips.txt` - Known command & control IP addresses
- `malicious-domains.txt` - Payload hosting and exfiltration domains
- `file-hashes.txt` - Known malicious file SHA-256 hashes
- `malicious-publishers.txt` - Known malicious ClawHub publishers
- `malicious-skill-patterns.txt` - Malicious skill naming patterns

## Daily Automated Scan (Optional)

Optional cron job at 06:00 UTC with Telegram alerts. **Not auto-installed** — requires explicit user action:
```bash
crontab -l | { cat; echo "0 6 * * * $HOME/.openclaw/workspace/skills/<skill-dir>/scripts/daily-scan-cron.sh"; } | crontab -
```

## Threat Coverage

Based on research from 40+ security sources including:
- [ClawHavoc: 341 Malicious Skills](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting) (Koi Security)
- [CVE-2026-25253: 1-Click RCE](https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html)
- [From SKILL.md to Shell Access](https://snyk.io/articles/skill-md-shell-access/) (Snyk)
- [VirusTotal: From Automation to Infection](https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html)
- [OpenClaw Official Security Docs](https://docs.openclaw.ai/gateway/security)
- [DefectDojo Hardening Checklist](https://defectdojo.com/blog/the-openclaw-hardening-checklist-in-depth-edition)
- [Vectra: Automation as Backdoor](https://www.vectra.ai/blog/clawdbot-to-moltbot-to-openclaw-when-automation-becomes-a-digital-backdoor)
- [Cisco: AI Agents Security Nightmare](https://blogs.cisco.com/ai/personal-ai-agents-like-openclaw-are-a-security-nightmare)
- [Bloom Security/JFrog: 37 Malicious Skills](https://jfrog.com/blog/giving-openclaw-the-keys-to-your-kingdom-read-this-first/)
- [OpenSourceMalware: Skills Ganked Your Crypto](https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto)
- [Snyk: clawdhub Campaign Deep-Dive](https://snyk.io/articles/clawdhub-malicious-campaign-ai-agent-skills/)
- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)
- [CrowdStrike: OpenClaw AI Super Agent](https://www.crowdstrike.com/en-us/blog/what-security-teams-need-to-know-about-openclaw-ai-super-agent/)
- [Argus Security Audit (512 findings)](https://github.com/openclaw/openclaw/issues/1796)
- [ToxSec: OpenClaw Security Checklist](https://www.toxsec.com/p/openclaw-security-checklist)
- [Aikido.dev: Fake ClawdBot VS Code Extension](https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware)
- [Prompt Security: Top 10 MCP Risks](https://prompt.security/blog/top-10-mcp-security-risks)
- [Oasis Security: ClawJacked](https://www.oasis.security/blog/openclaw-vulnerability) (Feb 26)
- [CVE-2026-28363: safeBins Bypass (CVSS 9.9)](https://advisories.gitlab.com/pkg/npm/openclaw/CVE-2026-28363/)
- [CVE-2026-28479: SHA-1 Cache Poisoning (CVSS 8.7)](https://advisories.gitlab.com/pkg/npm/openclaw/CVE-2026-28479/)
- [CVE-2026-28485: /agent/act No Auth](https://advisories.gitlab.com/pkg/npm/openclaw/CVE-2026-28485/)
- [CVE-2026-29610: Command Hijacking via PATH](https://advisories.gitlab.com/pkg/npm/openclaw/CVE-2026-29610/)
- [Flare: Widespread Exploitation](https://flare.io/learn/resources/blog/widespread-openclaw-exploitation) (Feb 25)
- [CVE-2026-28469: Google Chat Webhook Cross-Account Bypass (CVSS 9.8)](https://dailycve.com/openclaw-authorization-bypass-cve-2026-28469-critical/)
- [CVE-2026-28472: Gateway WebSocket Device Identity Skip](https://cvereports.com/reports/CVE-2026-28472)
- [CVE-2026-32302: Cross-Site WebSocket Hijacking](https://cvereports.com/reports/CVE-2026-32302)
- [GHSA-7h7g: Device Pairing Credential Exposure](https://cvereports.com/reports/GHSA-7h7g-x2px-94hj)
- [GHSA-vmhq: Operator Privilege Escalation](https://cvereports.com/reports/GHSA-VMHQ-CQM9-6P7Q)
- [Socket: SANDWORM_MODE npm Worm](https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning) (Feb 20)
- [Pillar Security: Rules File Backdoor](https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents)
- [OWASP MCP Top 10](https://owasp.org/www-project-mcp-top-10/)
- [CyberArk: MCP Output Poisoning](https://www.cyberark.com/resources/threat-research-blog/poison-everywhere-no-output-from-your-mcp-server-is-safe)
- [Semgrep: First Malicious MCP Server on npm](https://semgrep.dev/blog/2025/so-the-first-malicious-mcp-server-has-been-found-on-npm-what-does-this-mean-for-mcp-security/)
- [OpenClaw GitHub Security Advisories](https://github.com/openclaw/openclaw/security/advisories) — current upstream advisory source for patched-version baselines
- [GHSA-r39h-4c2p-3jxp: setup-api.js cwd execution](https://github.com/openclaw/openclaw/security/advisories/GHSA-r39h-4c2p-3jxp)
- [GHSA-q8ff-7ffm-m3r9: webhook SecretRef route secret replay](https://github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9)
- [GHSA-cwj3-vqpp-pmxr: gateway config mutation guard bypass](https://github.com/openclaw/openclaw/security/advisories/GHSA-cwj3-vqpp-pmxr)

## Security & Transparency

**Source repository**: [github.com/adibirzu/openclaw-security-monitor](https://github.com/adibirzu/openclaw-security-monitor) — all source code is publicly auditable.

**Detection signatures in repository**: This project contains threat-signature patterns (IP addresses, domain names, hash values) because it scans skills for risky content. These strings are used for grep/regex matching only and are not executable instructions.

**Required binaries**: `bash`, `curl`, `node` (for dashboard), `lsof` (for network checks). Optional: `witr` (process trees), `docker` (container audits), `openclaw` CLI (config checks).

**Environment variables**: `OPENCLAW_TELEGRAM_TOKEN` (optional, for daily scan alerts), `OPENCLAW_HOME` (optional, overrides default `~/.openclaw` directory). Both are declared in the frontmatter metadata above.

**What the scanner reads**: `scan.sh` reads files within `~/.openclaw/` (configs, skills, credentials, logs) to detect threats. It pattern-matches against `.env`, `.ssh`, and keychain paths for detection only — it never exfiltrates, transmits, or modifies data. The scanner is read-only.

**What remediation does**: `remediate.sh` can modify file permissions, block domains in `/etc/hosts`, adjust OpenClaw gateway config, quarantine MCP configs, and remove malicious skills. **Always run `--dry-run` first** to preview changes. Unattended mode (`--yes`) requires explicit `OPENCLAW_ALLOW_UNATTENDED_REMEDIATE=1` — without this env var, `--yes` is silently ignored.

**IOC updates**: `update-ioc.sh` fetches threat intelligence from this project's GitHub repository. In interactive mode it shows pending changes and asks for confirmation before writing. `--auto` mode (for cron) writes without prompting. Validates incoming IOC file format (field counts). Untrusted upstream repos require explicit `OPENCLAW_ALLOW_UNTRUSTED_IOC_SOURCE=1`.

**No auto-installed persistence**: The installer does NOT create cron jobs, LaunchAgents, symlinks, or background services. Cron and LaunchAgent setup are documented as optional manual steps that the user must explicitly run themselves.

**Dashboard binding**: The web dashboard is read-only (no shell commands, no child processes) and defaults to `127.0.0.1:18800` (localhost only). It reads log files and IOC stats only.

## Installation

```bash
# From GitHub
git clone https://github.com/adibirzu/openclaw-security-monitor.git \
  ~/.openclaw/workspace/skills/<skill-dir>
chmod +x ~/.openclaw/workspace/skills/<skill-dir>/scripts/*.sh
```

The OpenClaw agent auto-discovers skills from `~/.openclaw/workspace/skills/` via SKILL.md frontmatter. After cloning, the `/security-scan`, `/security-remediate`, `/security-dashboard`, `/security-network`, and `/security-setup-telegram` commands will be available in the agent.