Skip to main content
Security Audit is a beta feature. Detection coverage and UI are evolving — feedback is welcome.
The Audit Rules tab shows every detection rule the audit engine is currently running. Rules are read-only — they reflect the live configuration and cannot be modified from the dashboard. This page documents each rule category in detail.
The engine checks every file_read and file_write event against glob patterns that match files likely to contain secrets or credentials. A match raises a sensitive_path or sensitive_path_medium risk flag.The OpenClaw workspace paths are whitelisted — they are checked first, and any match suppresses all other path rules. This prevents normal agent workspace reads from generating noise.Path matching uses glob syntax with dot-file support — **/.ssh/** matches hidden directories at any depth.
The engine evaluates every exec event against two tiers of shell command patterns.Critical — high riskThese commands are immediately destructive or enable remote code execution. Any match sets the critical_cmd flag and scores the event as high risk.Elevated — medium riskThese commands are not immediately destructive but represent elevated privilege or significant network access. Any match sets the elevated_cmd flag and scores the event as medium risk.
The engine scans text content in agent messages for patterns that suggest an attempt to manipulate the agent’s instructions or extract data. All prompt injection findings are scored as high risk.
Prompt injection detection runs on the text content the agent receives, including content fetched from external URLs via web_fetch. An injection planted in a web page the agent reads will be caught the same way as one in a user message.
The engine checks exec events for shell command patterns that explicitly send local file content to an external destination. A match sets the exfil_pattern flag and scores the event as high risk.Command patternsCredential escalation detectionWhen a credential is found in an agent’s tool output (sensitive_data flag), Claw Lens checks the rest of the same session for subsequent web_fetch or web_search events. If any external call follows the exposure in the same session, the finding is flagged as a potential exfiltration path and the status in the credential inventory becomes Exfiltrated.This detection is correlative — it identifies a plausible exfiltration path (secret exposed, then external call made) rather than confirmed transmission of that specific secret.
Anomaly signals compare each agent’s current behavior against its individual baseline, built from the past 30 days of activity. A deviation sets a low-risk flag. Anomaly detection requires an existing baseline — new agents with no history will not generate anomaly flags.The baseline captures: top 20 filesystem directories, top 12 active hours of day, average tool calls per session, and all known external domains. Baselines update automatically as new sessions are recorded.