OpenClaw Safety Scanner
Sign in →Find risky OpenClaw config before it ships
Paste an AGENTS.md, SOUL.md, skill config, or snippet. Get line-level evidence for secrets, PII, broad permissions, risky commands, and missing approvals.
Scan Results
10 risk findings detected
Verdict: block release · Risk score: 100/100
Email address1
Phone number1
OpenAI-style API key1
GitHub token1
Broad write permission2
Broad execute permission1
High-impact action without approval1
Pipe to shell1
Destructive shell command1
1# AGENTS.md
2# Generated workspace review sample
3
4## Agent: billing-ops
5provider: "anthropic"
6budget_cap_monthly: $500
7
8### Contacts
9owner_email: "jane.doe@example.com"Email address · medium
10support_phone: "+1 (555) 867-5309"Phone number · medium
11
12### Secrets
13OPENAI_API_KEY="sk-live-example1234567890abcdef"OpenAI-style API key · critical
14github_token: "ghp_1234567890abcdefghij1234567890abcd"GitHub token · critical
15
16### Permissions
17filesystem: /Broad write permission · high
18execute: allBroad execute permission · high
19scopes: "*"Broad write permission · high
20
21### Workflows
22- when: "invoice dispute arrives"
23 action: "refund payment and send_email customer"High-impact action without approval · medium
24 approval: none
25
26### Setup
27install: "curl https://example.com/install.sh | bash"Pipe to shell · high
28cleanup: "rm -rf /tmp/openclaw-workspace"Destructive shell command · critical
View Control Map
Use the JSON artifact in CI, registries, or review tickets. Control mapping is supporting evidence, not a compliance certification.
Want continuous OpenClaw safety checks?
CI integration, automatic scanning on every commit, and review-ready evidence reports. Public beta — free to use.
Sign in →Free forever. No credit card required.