Clawdbot Security Check
Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when
Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when
Real data. Real impact.
Emerging
Developers
Per week
Open source
Skills give you superpowers. Install in 30 seconds.
This skill empowers Clawdbot to audit its own security posture using first-principles reasoning. Rather than relying on a static script, Clawdbot learns the framework and applies it dynamically to detect vulnerabilities, understand their impact, and recommend specific remediations.
"Security through transparency and self-awareness." — Inspired by ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ
Clawdbot should know its own attack surface. This skill embeds that knowledge directly.
Running an AI agent with shell access requires caution. Focus on three areas:
Start with the smallest access possible and widen it as you gain confidence.
Apply appropriate trust levels based on role:
| Level | Entity | Trust Model |
|---|---|---|
| 1 | Owner | Full trust — has all access |
| 2 | AI | Trust but verify — sandboxed, logged |
| 3 | Allowlists | Limited trust — only specified users |
| 4 | Strangers | No trust — blocked by default |
Use these commands to run security audits:
When auditing Clawdbot, systematically evaluate these domains:
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -A10 '"gateway"' env | grep CLAWDBOT_GATEWAY_TOKEN
Vulnerability: Binding to 0.0.0.0 or lan without auth allows network access.
Remediation:
# Generate gateway token clawdbot doctor --generate-gateway-token export CLAWDBOT_GATEWAY_TOKEN="$(openssl rand -hex 32)"
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -E '"dm_policy|"allowFrom"'
Vulnerability: Setting to allow or open means any user can DM Clawdbot.
Remediation:
{ "channels": { "telegram": { "dmPolicy": "allowlist", "allowFrom": ["@trusteduser1", "@trusteduser2"] } } }
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -E '"groupPolicy"|"groups"' cat ~/.clawdbot/clawdbot.json | grep -i "mention"
Vulnerability: Open group policy allows anyone in the room to trigger commands.
Remediation:
{ "channels": { "telegram": { "groupPolicy": "allowlist", "groups": { "-100123456789": true } } } }
What to check:
Credential Storage Map:
| Platform | Path |
|---|---|
| ~/.clawdbot/credentials/whatsapp/{accountId}/creds.json | |
| Telegram | ~/.clawdbot/clawdbot.json or env |
| Discord | ~/.clawdbot/clawdbot.json or env |
| Slack | ~/.clawdbot/clawdbot.json or env |
| Pairing allowlists | ~/.clawdbot/credentials/channel-allowFrom.json |
| Auth profiles | ~/.clawdbot/agents/{agentId}/auth-profiles.json |
| Legacy OAuth | ~/.clawdbot/credentials/oauth.json |
How to detect:
ls -la ~/.clawdbot/credentials/ ls -la ~/.clawdbot/agents/*/auth-profiles.json 2>/dev/null stat -c "%a" ~/.clawdbot/credentials/oauth.json 2>/dev/null
Vulnerability: Plaintext credentials with loose permissions can be read by any process.
Remediation:
chmod 700 ~/.clawdbot chmod 600 ~/.clawdbot/credentials/oauth.json chmod 600 ~/.clawdbot/clawdbot.json
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -A5 '"browser"' cat ~/.clawdbot/clawdbot.json | grep -i "controlUi|insecureAuth" ls -la ~/.clawdbot/browser/
Vulnerability: Exposed browser control without auth allows remote UI takeover. Browser access allows the model to use logged-in sessions.
Remediation:
{ "browser": { "remoteControlUrl": "https://...", "remoteControlToken": "...", "dedicatedProfile": true, "disableHostControl": true }, "gateway": { "controlUi": { "allowInsecureAuth": false } } }
Security Note: Treat browser control URLs as admin APIs.
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -A10 '"gateway"' cat ~/.clawdbot/clawdbot.json | grep '"tailscale"'
Vulnerability: Public binding without auth allows internet access to gateway.
Remediation:
{ "gateway": { "bind": "127.0.0.1", "mode": "local", "trustedProxies": ["127.0.0.1", "10.0.0.0/8"], "tailscale": { "mode": "off" } } }
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -i "restrict|mcp|elevated" cat ~/.clawdbot/clawdbot.json | grep -i "workspaceAccess|sandbox" cat ~/.clawdbot/clawdbot.json | grep -i "openRoom"
Workspace Access Levels:
| Mode | Description |
|---|---|
| none | Workspace is off limits |
| ro | Workspace mounted read-only |
| rw | Workspace mounted read-write |
Vulnerability: Broad tool access means more blast radius if compromised. Smaller models are more susceptible to tool misuse.
Remediation:
{ "restrict_tools": true, "mcp_tools": { "allowed": ["read", "write", "bash"], "blocked": ["exec", "gateway"] }, "workspaceAccess": "ro", "sandbox": "all" }
Model Guidance: Use latest generation models for agents with filesystem or network access. If using small models, disable web search and browser tools.
What to check:
How to detect:
stat -c "%a" ~/.clawdbot ls -la ~/.clawdbot/*.json
Vulnerability: Loose permissions allow other users to read sensitive configs.
Remediation:
chmod 700 ~/.clawdbot chmod 600 ~/.clawdbot/clawdbot.json chmod 600 ~/.clawdbot/credentials/*
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -i "plugin|allowlist" cat ~/.clawdbot/clawdbot.json | grep -i "model|anthropic"
Vulnerability: Untrusted plugins can execute code. Legacy models may lack modern safety.
Remediation:
{ "plugins": { "allowlist": ["trusted-plugin-1", "trusted-plugin-2"] }, "agents": { "defaults": { "model": { "primary": "minimax/MiniMax-M2.1" } } } }
What is logging.redactSensitive set to?
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -i "logging|redact" ls -la ~/.clawdbot/logs/
Remediation:
{ "logging": { "redactSensitive": "tools", "path": "~/.clawdbot/logs/" } }
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -i "untrusted|wrap"
Prompt Injection Mitigation Strategies:
Vulnerability: Untrusted content (web fetches, sandbox output) can inject malicious prompts.
Remediation:
{ "wrap_untrusted_content": true, "untrusted_content_wrapper": "<untrusted>", "treatLinksAsHostile": true, "mentionGate": true }
What to check:
How to detect:
cat ~/.clawdbot/clawdbot.json | grep -A10 '"blocked_commands"'
Vulnerability: Without blocking, a malicious prompt could destroy data or exfiltrate credentials.
Remediation:
{ "blocked_commands": [ "rm -rf", "curl |", "git push --force", "mkfs", ":(){:|:&}" ] }
What to check:
How to detect:
ls -la .secrets.baseline 2>/dev/null which detect-secrets 2>/dev/null
Secret Scanning (CI):
# Find candidates detect-secrets scan --baseline .secrets.baseline # Review findings detect-secrets audit # Update baseline after rotating secrets or marking false positives detect-secrets scan --baseline .secrets.baseline --update
Vulnerability: Leaked credentials in the codebase can lead to compromise.
The --fix flag applies these guardrails:
Treat findings in this priority order:
| Mode | Description |
|---|---|
| pairing | Default - unknown senders must be approved via code |
| allowlist | Unknown senders blocked without handshake |
| open | Public access - requires explicit asterisk in allowlist |
| disabled | All inbound DMs ignored |
Slash commands are only available to authorized senders based on channel allowlists. The /exec command is a session convenience for operators and does not modify global config.
| Risk | Mitigation |
|---|---|
| Execution of shell commands | blocked_commands, restrict_tools |
| File and network access | sandbox, workspaceAccess: none/ro |
| Social engineering and prompt injection | wrap_untrusted_content, mentionGate |
| Browser session hijacking | Dedicated profile, token auth, HTTPS |
| Credential leakage | logging.redactSensitive: tools, env vars |
If a compromise is suspected, follow these steps:
Report security issues to: security@clawd.bot
Do not post vulnerabilities publicly until they have been fixed.
When running a security audit, follow this sequence:
CONFIG_PATHS=( "$HOME/.clawdbot/clawdbot.json" "$HOME/.clawdbot/config.yaml" "$HOME/.clawdbot/.clawdbotrc" ".clawdbotrc" ) for path in "${CONFIG_PATHS[@]}"; do if [ -f "$path" ]; then echo "Found config: $path" cat "$path" break fi done
For each of the 13 domains above:
Format findings by severity:
🔴 CRITICAL: [vulnerability] - [impact] 🟠 HIGH: [vulnerability] - [impact] 🟡 MEDIUM: [vulnerability] - [impact] ✅ PASSED: [check name]
For each finding, output:
═══════════════════════════════════════════════════════════════ 🔒 CLAWDBOT SECURITY AUDIT ═══════════════════════════════════════════════════════════════ Timestamp: $(date -Iseconds) ┌─ SUMMARY ─────────────────────────────────────────────── │ 🔴 Critical: $CRITICAL_COUNT │ 🟠 High: $HIGH_COUNT │ 🟡 Medium: $MEDIUM_COUNT │ ✅ Passed: $PASSED_COUNT └──────────────────────────────────────────────────────── ┌─ FINDINGS ────────────────────────────────────────────── │ 🔴 [CRITICAL] $VULN_NAME │ Finding: $DESCRIPTION │ → Fix: $REMEDIATION │ │ 🟠 [HIGH] $VULN_NAME │ ... └──────────────────────────────────────────────────────── This audit was performed by Clawdbot's self-security framework. No changes were made to your configuration.
To add new security checks:
## 14. SSH Agent Forwarding 🟡 Medium **What to check:** Is SSH_AUTH_SOCK exposed to containers? **Detection:** ```bash env | grep SSH_AUTH_SOCK
Vulnerability: Container escape via SSH agent hijacking.
Severity: Medium
## Security Assessment Questions When auditing, ask: 1. **Exposure:** What network interfaces can reach Clawdbot? 2. **Authentication:** What verification does each access point require? 3. **Isolation:** What boundaries exist between Clawdbot and the host? 4. **Trust:** What content sources are considered "trusted"? 5. **Auditability:** What evidence exists of Clawdbot's actions? 6. **Least Privilege:** Does Clawdbot have only necessary permissions? ## Principles Applied - **Zero modification** - This skill only reads; never changes configuration - **Defense in depth** - Multiple checks catch different attack vectors - **Actionable output** - Every finding includes a concrete remediation - **Extensible design** - New checks integrate naturally ## References - Official docs: https://docs.clawd.bot/gateway/security - Original framework: [ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ on X](https://x.com/DanielMiessler/status/2015865548714975475) - Repository: https://github.com/TheSethRose/Clawdbot-Security-Check - Report vulnerabilities: security@clawd.bot --- **Remember:** This skill exists to make Clawdbot self-aware of its security posture. Use it regularly, extend it as needed, and never skip the audit.
No automatic installation available. Please visit the source repository for installation instructions.
View Installation Instructions1,500+ AI skills, agents & workflows. Install in 30 seconds. Part of the Torly.ai family.
© 2026 Torly.ai. All rights reserved.