A CLI tool that scans a running OpenClaw instance for active CVEs, malicious skills, and supply chain tampering before they get exploited
OpenClaw has accumulated 433+ CVEs in five months including critical auth bypasses (CVSS 9.8), sandbox escapes, and nation-state supply chain attacks targeting the npm ecosystem. Most operators have no idea which CVEs affect their specific version, whether their installed skills contain backdoors, or if their dependency tree has been tampered with. This tool runs a comprehensive security audit against a live OpenClaw instance and outputs an actionable remediation plan.
Demand Breakdown
Social Proof 3 sources
Gap Assessment
3 tools exist (jgamblin/OpenClawCVEs, Bitdefender AI Skills Checker, Snyk OpenClaw Research) but gaps remain: Static list only, no scanning of live instances, no skill auditing, no dependency checking; Only covers skill malware, not CVE exposure, dependency chains, or network configuration.
Features5 agent-ready prompts
Competitive LandscapeFREE
| Product | Does | Missing |
|---|---|---|
| jgamblin/OpenClawCVEs | Tracks and lists OpenClaw CVEs in a GitHub repo | Static list only, no scanning of live instances, no skill auditing, no dependency checking |
| Bitdefender AI Skills Checker | Scans ClawHub skills for malware signatures | Only covers skill malware, not CVE exposure, dependency chains, or network configuration |
| Snyk OpenClaw Research | Published research on 283 leaky skills with credential exposure | Research report not a scanning tool, no continuous monitoring, no remediation automation |
Sign in to unlock full access.