# Immunize Your OpenClaw: Why Your AI Agent Needs a Security Checkup

**By Debu Sinha** | February 2026

---

This post focuses on evidence you can reproduce from this repository.

I built **agentsec** to detect recurring OpenClaw security misconfigurations and secret exposures, and to harden the risky defaults in one workflow.

## The Problem: Security Is Optional, Attackers Are Not

OpenClaw's own documentation admits: *"There is no 'perfectly secure' setup."* That's honest, but it creates a gap. The default configuration ships with:

- Gateway bound to localhost (good), but no guidance on what happens when you expose it
- No exec approval rules out of the box
- Full tool profiles enabled by default
- No SSRF protection until v2026.2.12
- Skills installed without behavioral analysis

Repository-backed evidence:

| What we measured in this repo | Number | Artifact |
|--------------|--------|--------|
| Named checks | 27 | `docs/checks-catalog.md` |
| Fixture benchmark | P=0.82 / R=1.00 / F1=0.90 | `docs/benchmarks/results/2026-02-15-v0.4.0.json` |
| Case studies | 4 | `docs/case-studies/` |
| Top-50 study targets | 50 | `docs/benchmarks/top50/reports/top50_summary_20260215.json` |

Any external ecosystem statistics should be cited separately in a references section before publication.

## What agentsec Does

agentsec is an open-source security scanner and hardener for OpenClaw installations. One command gives you a complete security posture assessment:

```bash
pip install agentsec-ai
agentsec scan
```

It runs 27 named checks plus dynamic credential detection across four scanners:

**Installation Scanner** -- checks your OpenClaw configuration for gateway exposure, identity policy misconfigurations, overpermissive tool profiles, missing exec approvals, disabled sandboxing, SSRF vulnerabilities, and 5 known CVEs.

**Skill Scanner** -- performs AST-based analysis of installed skills looking for instruction malware (pipe-to-shell patterns, credential path targeting, remote script execution), dangerous code patterns, and prompt injection in tool descriptions.

**MCP Server Scanner** -- audits MCP server configurations for tool poisoning, hardcoded credentials, missing authentication, and unverified packages.

**Credential Scanner** -- deep recursive scan for secrets using 17 regex patterns (OpenAI, Anthropic, AWS, GitHub, Slack, Stripe, Telegram, Discord, Google, Databricks, HuggingFace, and more) plus Shannon entropy detection for custom tokens.

Every finding maps to the **OWASP Top 10 for Agentic Applications (ASI01-ASI10)**. You get a posture grade from A to F.

## The Five CVEs Every OpenClaw User Should Know

If you're running OpenClaw below v2026.1.30, you're vulnerable to all five:

| CVE | What it does | CVSS |
|-----|-------------|------|
| **CVE-2026-25253** | One-click RCE via WebSocket hijacking -- attacker sends a link, steals your auth token | 8.8 |
| **CVE-2026-24763** | Command injection through Docker sandbox PATH variable | 8.8 |
| **CVE-2026-25157** | SSH command injection via sshNodeCommand -- arbitrary commands on remote hosts | 7.8 |
| **CVE-2026-25593** | Unauthenticated config write via WebSocket API -- full system takeover | Critical |
| **CVE-2026-25475** | Path traversal via MEDIA: extraction -- read any file on the system | High |

agentsec detects all five and tells you exactly what version to update to.

## Not Just Detection: Hardening

Most security tools stop at telling you what's wrong. agentsec also fixes it.

Three hardening profiles apply safe configuration changes directly to your openclaw.json:

```bash
# See what would change (safe preview)
agentsec harden -p workstation

# Apply the changes
agentsec harden -p workstation --apply
```

| Profile | Who it's for | What it does |
|---------|-------------|-------------|
| **workstation** | Solo developer, local use | Binds to localhost, paired DMs only, messaging-only tools, minimal mDNS |
| **vps** | Cloud/remote hosting | All of workstation + group allowlists, mDNS off, device auth enforced |
| **public-bot** | Untrusted input (Discord bot, public API) | Maximum lockdown: sandbox everything, deny exec/browser/web, allowlist-only access |

The hardener creates a backup before writing changes. Completely reversible.

## CI/CD: Shift Left on Agent Security

agentsec produces SARIF output that integrates directly with GitHub Code Scanning:

```yaml
- name: Run security scan
  run: agentsec scan -o sarif -f results.sarif --fail-on high

- name: Upload to GitHub Code Scanning
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif
```

Security findings appear as annotations on your pull requests. Same workflow as CodeQL, Semgrep, or Trivy -- but for your AI agent configuration.

## Scope

This repository demonstrates an offline CLI workflow with:

- installation + skill + mcp + credential scanning
- OWASP ASI01-ASI10 mapping
- hardening profiles
- JSON/SARIF output for CI

Claims about comparative market position are intentionally omitted here unless backed by reproducible side-by-side benchmarks.

## What's Next

agentsec v0.5 will add:

- **`.agentsec.yaml`** -- per-project configuration with ignore rules
- **Baseline/diff mode** -- only alert on new findings since last scan
- **`agentsec skill quarantine`** -- isolate suspicious skills before analysis
- **Community rule repository** -- share and import custom detection rules

## Get Started

```bash
pip install agentsec-ai
agentsec scan ~/.openclaw
```

The scan takes seconds and produces artifact-backed findings you can verify.

---

*agentsec is open source under the Apache-2.0 license. Contributions welcome.*

*GitHub: [github.com/debu-sinha/agentsec](https://github.com/debu-sinha/agentsec)*
