Caveat verdict
openclaw-security-checklist
Pre-deployment security compliance checklist covering firewall, SSH, API key management, and data regulations; runs local shell scripts to audit configuration and generate reports with no external data transmission.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (8)
Possible hardcoded credential
references/api-key-management.md · code · apiKey = "sk-1234567890abcdef
References sudo — requests elevated privileges
example-report.md · code · sudo
Accesses shell history/config
references/api-key-management.md · code · ~/.zshrc
Accesses OpenClaw config/secrets directly
references/api-key-management.md · code · ~/.openclaw/.env
References SSH/GPG private keys
SKILL.md · prose · downgraded · ssh-key
Accesses sensitive environment variables
references/api-key-management.md · code · process.env.OPENCLAW_API_KEY
yum install — installs system packages
references/deployment-scenarios/vps.md · prose · downgraded · yum install
Sets world-executable permissions
references/deployment-scenarios/personal-mac.md · prose · downgraded · chmod 755
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class B). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
credential_access Is this flag fair?
Thanks — recorded.