ClawGuard Security Lab
Securing AI Agents
AI security, technology news, and the Bay Area community.
Silicon Valley Daily
Bilingual Silicon Valley tech news, updated twice daily
Read Tech NewsSilicon Valley Tech Events
Tech events in Silicon Valley and the Bay Area for the next 30 days, updated daily
Explore Tech EventsWhat’s new
Today’s headlines
Nov 7- Congress moves to question Jensen Huang over alleged Chinese spy ties
- NYT: some Chinese firms cleared for Nvidia H200s have empty offices
- Anthropic keeps its pre-Thanksgiving IPO at a lower valuation
Upcoming events
- MakerMods Physical AI Hackathon
- Teen Hacks: AI/ML for Cybersecurity, Healthcare & Sustainability
- Chinese Culture Club: Use AI Tools to Enhance Your Life
Latest articles
- Democrats Took Congress. The Real Test for AI Is Only Beginning: Six Deeper Reasons
- How Employment is Changing at Anthropic
- The 2026 US Talent Report
AI agent security tools
Scan your OpenClaw setup for leaked keys, unsafe permissions, and dangerous defaults — in seconds, for free.
Choose files, review findings, rescan
Choose your configuration
Select the OpenClaw configuration files or folder you want to check.
Check the selected scope
Checks look for risky configuration settings and plaintext credential patterns. Missing evidence stays visible in your report.
See what needs fixing
Review the findings, evidence gaps and suggested changes. Rescan the same files to check the result.
What ClawGuard checks
Checks for your selected files
Gateway Security
Explicit gateway authentication and Control UI settings
Tool permissions
Elevated sender lists and tool configuration
Hook settings
Hook activation, agent routing and session-key settings
Secret Management
Supported plaintext credential patterns in the files read
Isolation settings
Sandbox settings present in the selected configuration
Local file permissions
POSIX configuration and credential file modes on macOS and Linux
Coverage depends on the scan mode and available evidence. The report identifies checks that could not be completed.
Real checks from the rule pack
Why scan your OpenClaw setup?
A few configuration choices can widen access to your OpenClaw instance. Check the settings you actually use.
Network access needs an authentication boundary
A reachable gateway with authentication disabled can expose agent operations to other devices.
Plaintext credentials need private file storage
Check which users and processes can read files containing credentials, and keep them out of source control.
Disabling device authentication removes one access check
dangerouslyDisableDeviceAuth bypasses device authentication. Other gateway authentication still needs to be checked.
Unrestricted exec tool lets agents run arbitrary commands
Without an allowlist on the exec tool, an agent can be prompted into running any shell command on your machine.
Scan now — it takes 30 seconds
Free · No account · Files never leave your device
Frequently Asked Questions
Everything you need to know before your first scan.
What does ClawGuard scan?
Browser Scan checks selected OpenClaw files with a 33-rule pack. Machine Scan adds local file collection: 11 checks on macOS/Linux, 9 on Windows. Each report shows what was checked and what still needs evidence.
Is my data safe?
Browser Scan runs on your device. Machine Scan uploads redacted configuration values and file security evidence. It does not upload raw file contents or read your browser profile by default.
What's the difference between Browser Scan and Machine Scan?
Browser Scan reads the files you select inside your browser. Machine Scan reads the selected local instance and credential files, redacts secret values, and uploads evidence. The current local baseline adds POSIX file-mode checks on macOS and Linux; it does not test running network services or enterprise governance.
How long does a scan take?
Browser checks usually finish in seconds. Machine Scan also downloads a temporary runner, so duration depends on your network and file count. The page updates when the report is ready.
What happens if ClawGuard finds issues?
Every finding comes with a plain-English explanation and step-by-step fix instructions. Issues are sorted by severity (Critical, High, Medium, Low) so you know what to fix first. Your security score updates each time you re-scan.
Do I need to install anything?
No installation needed for Browser Scan — it works in any modern browser. Machine Scan requires pasting one command into your terminal; the script removes itself after the scan completes. Nothing to maintain or update.