A CLI tool that audits OpenClaw device token scopes and blocks privilege escalation paths before attackers exploit them
CVE-2026-32922 (CVSS 9.9) proved that a single API call to device.token.rotate can escalate any paired device to full admin. The root cause was missing scope validation, but the broader problem is that OpenClaw operators have zero visibility into which devices hold what scopes, which tokens have been rotated suspiciously, and whether their instance is still vulnerable. 137 security advisories were filed in 60 days. This CLI tool continuously audits device tokens, flags over-scoped devices, detects rotation anomalies, and blocks escalation attempts at the gateway level.
Demand Breakdown
Social Proof 2 sources
Gap Assessment
3 tools exist (OpenClaw built-in security (v2026.3.11+ patch), Blink.new OpenClaw CVE remediation, jgamblin/OpenClawCVEs tracker) but gaps remain: No audit of existing tokens, no historical log analysis, no real-time monitoring, no protection for unpatched instances, no scope inventory dashboard; No automated scanning, no runtime protection, no log analysis, no continuous monitoring of token scopes.
Features3 agent-ready prompts
Competitive LandscapeFREE
| Product | Does | Missing |
|---|---|---|
| OpenClaw built-in security (v2026.3.11+ patch) | Patches the specific rotateDeviceToken function to validate scopes | No audit of existing tokens, no historical log analysis, no real-time monitoring, no protection for unpatched instances, no scope inventory dashboard |
| Blink.new OpenClaw CVE remediation | Step-by-step guides for patching specific CVEs | No automated scanning, no runtime protection, no log analysis, no continuous monitoring of token scopes |
| jgamblin/OpenClawCVEs tracker | Tracks all OpenClaw CVEs and advisories in a public repo with JSON data | Passive tracking only, no active scanning of your instance, no remediation, no runtime protection |
Sign in to unlock full access.