SuperagenticAI/superclaw

What it is

SuperClaw is a pip-installable CLI for pre-deployment security testing of AI coding agents (primarily OpenClaw). The existing summary covers its purpose; what the page adds is the concrete command workflow, the authorization guardrails, and an explicit scoping of what the tool will not do — it does not generate agents, run production workloads, or automate real-world exploitation.

How it works

Testing follows a generate → evaluate → audit → report pipeline. You can target a live OpenClaw instance over a WebSocket address or run offline against a mock adapter. Each security behavior ships as a structured contract (intent, success criteria, rubric, mitigation). Internally the repo splits into attacks/, behaviors/, adapters/, bloom/ (AI scenario generation), scanners/, analysis/ (drift), codeoptix/, and reporting/.

Preconditions

• Written authorization to test the target system.
• Isolated sandbox/VM recommended.
• Remote targets require SUPERCLAW_AUTH_TOKEN — and note the page's caveat: SuperClaw does not manage this token; you must obtain it from the remote system administrator. Local-only mode blocks remote targets by default.

What to do

pip install superclaw

# Attack a local OpenClaw instance
superclaw attack openclaw --target ws://127.0.0.1:18789
# Offline test with mock adapter
superclaw attack mock --behaviors prompt-injection-resistance

# Generate scenarios (with variations)
superclaw generate scenarios --behavior prompt_injection --num-scenarios 20
superclaw generate scenarios --behavior jailbreak --variations noise,emotional_pressure

# Evaluate against generated scenarios
superclaw evaluate openclaw --scenarios scenarios.json --behaviors all

# Comprehensive audit → HTML
superclaw audit openclaw --comprehensive --report-format html --output report
superclaw audit openclaw --quick

# SARIF for GitHub Code Scanning
superclaw report generate --results results.json --format sarif
# Drift between baselines
superclaw report drift --baseline baseline.json --current current.json

# Supply-chain / config scanning
superclaw scan config
superclaw scan skills --path /path/to/skills

# Discovery
superclaw behaviors
superclaw attacks

CodeOptiX multi-modal evaluation is an optional extra: pip install superclaw[codeoptix], then superclaw codeoptix register and superclaw codeoptix evaluate --target ws://127.0.0.1:18789 --llm-provider openai. A Python API (SecurityEvaluationEngine) is also exposed.

Caveats

The page states findings should be treated as signals, not proof — verify manually. Licensed Apache 2.0.