Clawsecurity

ClawSecurity — AI Agent Security Skill

Security scanning, remediation, and monitoring for OpenClaw agents.

What This Skill Does

ClawSecurity protects AI coding agents by scanning code for vulnerabilities, generating minimal fix patches, detecting sensitive data in agent I/O, and producing compliance reports.

This skill provides lightweight security features from chat. For full real-time protection — live process monitoring, network inspection, I/O interception, prompt injection detection (55+ patterns), behavioral analysis, and automated quarantine — install the ClawSecurity desktop app.

Available for Linux (.deb, .rpm, .AppImage), macOS (Apple Silicon + Intel .dmg), and Windows (.msi, .exe).

Skill vs Desktop App

API Base

All API calls use https://api.clawsecurity.altllm.ai/api/v1. Authenticate with the CLAWSEC_API_KEY environment variable via the Authorization: Bearer $CLAWSEC_API_KEY header.

Commands

/clawsec-scan — Run a Security Scan

Scan a repository or directory for vulnerabilities using Semgrep, Trivy, and osv-scanner.

Usage: /clawsec-scan <repo-url-or-path>

API Call:

POST /api/v1/scans
Content-Type: application/json
Authorization: Bearer $CLAWSEC_API_KEY

{ "repoUrl": "<repo-url>" }

Response: Returns a scan_id and queues the scan. Poll GET /api/v1/scans/<scan_id> until status is "completed".

Result fields:

• id — Scan ID
• status — queued | running | completed | failed
• findingsCount — Total vulnerabilities found
• findings[] — Array of findings with severity, file, line, title, owasp, cwe

/clawsec-fix — Generate a Fix Patch

Generate a minimal security patch for a specific vulnerability finding.

Usage: /clawsec-fix <finding-id>

API Call:

GET /api/v1/fixes/<finding-id>/preview
Authorization: Bearer $CLAWSEC_API_KEY

Response:

• fixId — Fix ID
• redactedPatch — Preview of the patch (redacted for free users)
• locCount — Lines of code changed
• confidence — HIGH | MEDIUM | LOW

To download the full patch (requires Pro or Enterprise subscription):

GET /api/v1/fixes/<fix-id>/patch
Authorization: Bearer $CLAWSEC_API_KEY

Returns a unified diff .patch file.

/clawsec-report — Generate a Security Report

Generate a comprehensive security assessment report from scan results.

Usage: /clawsec-report <scan-id> [format]

API Call:

GET /api/v1/scans/<scan_id>/report?format=markdown
Authorization: Bearer $CLAWSEC_API_KEY

Formats: json (default), markdown, html, sarif

Report sections:

1. Executive summary with security health score (0-100)
2. Detailed findings with OWASP/CWE mapping
3. Before/after code comparison (if fixes applied)
4. Compliance matrix (OWASP Top 10, OWASP LLM Top 10)
5. Remediation roadmap with priority ordering
6. Dependency health and license compliance

/clawsec-monitor — Check Agent I/O for Sensitive Data

Detect sensitive data (API keys, secrets, PII) in agent input/output streams.

Usage: /clawsec-monitor <text-to-check>

API Call:

POST /api/v1/dynamic/events
Content-Type: application/json
Authorization: Bearer $CLAWSEC_API_KEY

{
  "events": [
    {
      "type": "stdout",
      "content": "<text-to-check>",
      "timestamp": "<ISO8601>"
    }
  ]
}

Detection categories: API keys, cloud credentials, private keys, database URIs, authentication tokens, PII (emails, phone numbers, SSNs)

Response: Returns detected sensitive data patterns with category, severity, and redacted preview.

Workflow: Full Security Assessment

1. Scan — /clawsec-scan . to scan the current project
2. Review — Read the findings, prioritize by severity (CRITICAL > HIGH > MEDIUM > LOW)
3. Fix — /clawsec-fix <finding-id> for each critical/high finding
4. Apply — Download and apply patches to the codebase
5. Verify — Re-scan to confirm fixes resolved the vulnerabilities
6. Report — /clawsec-report <scan-id> markdown for stakeholder distribution

Scan Engines

Severity Levels

Subscription Tiers

Sign up at clawsecurity.altllm.ai.

Guardrails

• Read-only scanning: Never modify scanned files during a scan
• Credential safety: Never include real secrets in reports or logs
• Minimal patches: Fix only the root cause, do not refactor surrounding code
• Confidence gating: Flag LOW confidence fixes for human review
• Sensitive data: Redact detected secrets before displaying to user