ClawSecCheck

What it is

ClawSecCheck runs as an OpenClaw skill, invoked conversationally ("Audit my OpenClaw setup with clawseccheck") rather than as a bare CLI. Install via openclaw skills install @gl0di/clawseccheck. It's verified against OpenClaw 2026.9.4 on Linux (also reads pre-2026.8.1 config shapes), Python 3.9+. The operational catch the summary omits: most ways of running it do not produce an A–F grade at all.

How it works

A full check is built from five audit layers, and a letter grade is issued only when all five ran. Short of that you get findings led by the most urgent one in words, plus an explicit line naming which layers didn't run — never a guessed number. Coverage by invocation:

• bare run → 2 of 5 layers (3 untouched: installed sweep, self-report, live test)
• --full → 3 of 5 (closes the installed sweep)
• --full --fast → 4 of 5 (trades deep phases for speed)

The last two layers are submissions, not stackable flags: one needs the agent's self-report, one pokes the running agent live. Each closes only when its answer is submitted back.

What to do

The single command that earns a grade:

clawseccheck --full --attest filled-template.json --judged-bundle verdicts.json

Ask the agent to handle both round-trips. Three modes, picked by phrasing:

• Mode A — one deliberate full check (grade only if all five layers run).
• Monitor — ongoing watch; reports changes, never a number:

clawseccheck --monitor

• Install gate — returns INSTALL / CAUTION / DO-NOT-INSTALL before you add a skill/MCP server.

The watch records a local baseline on first run, then diffs. Each run prints a baseline fingerprint (e.g. a6a061e78c6239b7); keep a copy off-machine and re-check with --verify-baseline to detect a locally rewritten record. Every post-baseline run ends with a count of dimensions it couldn't diff, so a quiet run isn't mistaken for a clean one.

State lives under ~/.clawseccheck/ (baseline, event journal, score history); --purge removes it, --state / --events separate multiple watches.

Caveats

• Self-test modes are standalone: --full --canary prints note: --full has no effect with --canary and runs only the canary.
• "No network calls" has two opt-in exceptions, both writing inside the audited home (never your config): its own suppression file, and a no-path --pdf into OpenClaw's managed attachment directory.
• It reports, it does not remediate — it never touches your OpenClaw config.

flowchart TD
    A[invocation] --> B{which flags?}
    B -->|bare| C[2 of 5 - no grade]
    B -->|--full| D[3 of 5 - no grade]
    B -->|--full --fast| E[4 of 5 - no grade]
    D --> F[+ --attest self-report<br>+ --judged-bundle live test]
    F --> G[5 of 5 - A–F grade issued]