Security Audit is a beta feature. Detection coverage and UI are evolving — feedback is welcome.
Sensitive paths
Sensitive paths
The engine checks every
file_read and file_write event against glob patterns that match files likely to contain secrets or credentials. A match raises a sensitive_path or sensitive_path_medium risk flag.The OpenClaw workspace paths are whitelisted — they are checked first, and any match suppresses all other path rules. This prevents normal agent workspace reads from generating noise.Path matching uses glob syntax with dot-file support —
**/.ssh/** matches hidden directories at any depth.Dangerous commands
Dangerous commands
The engine evaluates every
exec event against two tiers of shell command patterns.Critical — high riskThese commands are immediately destructive or enable remote code execution. Any match sets the critical_cmd flag and scores the event as high risk.Elevated — medium riskThese commands are not immediately destructive but represent elevated privilege or significant network access. Any match sets the
elevated_cmd flag and scores the event as medium risk.Prompt injection patterns
Prompt injection patterns
The engine scans text content in agent messages for patterns that suggest an attempt to manipulate the agent’s instructions or extract data. All prompt injection findings are scored as high risk.
Prompt injection detection runs on the text content the agent receives, including content fetched from external URLs via
web_fetch. An injection planted in a web page the agent reads will be caught the same way as one in a user message.Data exfiltration detection
Data exfiltration detection
The engine checks
exec events for shell command patterns that explicitly send local file content to an external destination. A match sets the exfil_pattern flag and scores the event as high risk.Command patternsCredential escalation detectionWhen a credential is found in an agent’s tool output (
sensitive_data flag), Claw Lens checks the rest of the same session for subsequent web_fetch or web_search events. If any external call follows the exposure in the same session, the finding is flagged as a potential exfiltration path and the status in the credential inventory becomes Exfiltrated.This detection is correlative — it identifies a plausible exfiltration path (secret exposed, then external call made) rather than confirmed transmission of that specific secret.Anomaly detection
Anomaly detection
Anomaly signals compare each agent’s current behavior against its individual baseline, built from the past 30 days of activity. A deviation sets a low-risk flag. Anomaly detection requires an existing baseline — new agents with no history will not generate anomaly flags.
The baseline captures: top 20 filesystem directories, top 12 active hours of day, average tool calls per session, and all known external domains. Baselines update automatically as new sessions are recorded.