clawarmor 2.0.0-alpha.3 โ 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +50 -146
- package/cli.js +3 -2
- package/demo-preview.gif +0 -0
- package/demo.cast +680 -0
- package/demo.gif +0 -0
- package/lib/fix.js +76 -14
- package/lib/harden.js +114 -13
- package/lib/prescan.js +166 -70
- package/lib/protect.js +60 -4
- package/lib/status.js +38 -15
- package/package.json +2 -2
- package/scripts/record-demo.py +125 -0
package/README.md
CHANGED
|
@@ -1,163 +1,67 @@
|
|
|
1
|
-
|
|
1
|
+
# ClawArmor
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
**The security auditor for OpenClaw agents.**
|
|
6
|
-
|
|
7
|
-
Checks your config. Probes your live gateway. Scans your skills.
|
|
8
|
-
Runs in 30 seconds. Finds what config-only tools miss. Free forever.
|
|
3
|
+
Security armor for OpenClaw agents โ audit, scan, monitor.
|
|
9
4
|
|
|
10
5
|
[](https://www.npmjs.com/package/clawarmor)
|
|
11
6
|
[](LICENSE)
|
|
12
|
-
[](package.json)
|
|
49
8
|
|
|
50
|
-
##
|
|
9
|
+
## What it does
|
|
51
10
|
|
|
52
|
-
|
|
11
|
+
- Audits your OpenClaw config and live gateway with 30+ checks โ scored 0โ100
|
|
12
|
+
- Scans every installed skill file for malicious code and prompt injection patterns
|
|
13
|
+
- Guards every install: intercepts `openclaw clawhub install`, pre-scans before activation
|
|
53
14
|
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
Config says `bind: loopback`. Is your gateway *actually* unreachable on LAN? Config says auth is enabled. Does the live WebSocket endpoint *actually* reject unauthenticated connections? A misconfigured nginx in front can make your config lie. Live probes can't be faked.
|
|
57
|
-
|
|
58
|
-
> All probes connect from your machine to `127.0.0.1` (and your local network interfaces). Nothing leaves your machine.
|
|
59
|
-
|
|
60
|
-
---
|
|
61
|
-
|
|
62
|
-
## Five commands
|
|
15
|
+
## Quick start
|
|
63
16
|
|
|
64
17
|
```bash
|
|
65
|
-
|
|
66
|
-
clawarmor
|
|
67
|
-
clawarmor
|
|
68
|
-
clawarmor verify # Re-run only previously-failed checks. Exit 0 if all fixed (CI-friendly).
|
|
69
|
-
clawarmor trend # ASCII chart of your security score over time.
|
|
18
|
+
npm install -g clawarmor
|
|
19
|
+
clawarmor protect --install
|
|
20
|
+
clawarmor audit
|
|
70
21
|
```
|
|
71
22
|
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
## What it checks
|
|
75
|
-
|
|
76
|
-
### Live gateway probes (behavioral โ not just config reads)
|
|
23
|
+
## Commands
|
|
77
24
|
|
|
78
|
-
|
|
|
25
|
+
| Command | Description |
|
|
79
26
|
|---|---|
|
|
80
|
-
|
|
|
81
|
-
|
|
|
82
|
-
|
|
|
83
|
-
|
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
---
|
|
102
|
-
|
|
103
|
-
## What it protects against
|
|
104
|
-
|
|
105
|
-
| Threat | Covered | Notes |
|
|
27
|
+
| `audit` | Score your OpenClaw config (0โ100), live gateway probes, plain-English verdict |
|
|
28
|
+
| `scan` | Scan all installed skill files for malicious code and SKILL.md instructions |
|
|
29
|
+
| `prescan <skill>` | Pre-scan a skill before installing โ blocks on CRITICAL findings |
|
|
30
|
+
| `protect --install` | Install guard hook, shell intercept (zsh/bash/fish), and watch daemon |
|
|
31
|
+
| `protect --uninstall` | Remove all ClawArmor protection components |
|
|
32
|
+
| `protect --status` | Show current protection state |
|
|
33
|
+
| `watch` | Monitor config and skill changes in real time |
|
|
34
|
+
| `watch --daemon` | Start the watcher as a background daemon |
|
|
35
|
+
| `harden` | Interactive hardening wizard (--dry-run, --auto) |
|
|
36
|
+
| `status` | One-screen security posture dashboard |
|
|
37
|
+
| `log` | View the audit event log |
|
|
38
|
+
| `digest` | Show weekly security digest |
|
|
39
|
+
| `verify` | Re-run only previously-failed checks (CI-friendly, exit 0 = all fixed) |
|
|
40
|
+
| `trend` | ASCII chart of your security score over time |
|
|
41
|
+
| `compare` | Compare coverage vs openclaw security audit |
|
|
42
|
+
| `fix` | Auto-apply safe fixes (--dry-run to preview, --apply to run) |
|
|
43
|
+
|
|
44
|
+
## What it catches
|
|
45
|
+
|
|
46
|
+
| Threat | Description | Coverage |
|
|
106
47
|
|---|---|---|
|
|
107
|
-
|
|
|
108
|
-
|
|
|
109
|
-
|
|
|
110
|
-
|
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
Sandbox isolation is enabled safely: if Docker is installed, `fix --apply` sets `sandbox.mode=non-main` + `workspaceAccess=rw` so your Telegram/group sessions keep workspace access.
|
|
124
|
-
|
|
125
|
-
---
|
|
126
|
-
|
|
127
|
-
## CI integration
|
|
128
|
-
|
|
129
|
-
```bash
|
|
130
|
-
# Fail CI if security score drops
|
|
131
|
-
clawarmor verify # exit 0 = all previously-failed checks now pass
|
|
132
|
-
# exit 1 = still failing
|
|
133
|
-
```
|
|
134
|
-
|
|
135
|
-
Score history persists in `~/.clawarmor/history.json`.
|
|
136
|
-
|
|
137
|
-
---
|
|
138
|
-
|
|
139
|
-
## Privacy & security
|
|
140
|
-
|
|
141
|
-
- `audit`, `scan`, `fix`, `verify`, `trend` run **entirely locally**
|
|
142
|
-
- One optional network call: `registry.npmjs.org` for version check (skippable with `--offline`)
|
|
143
|
-
- Every run prints exactly what files it reads and what network calls it makes before executing
|
|
144
|
-
- Nothing is sent anywhere
|
|
145
|
-
|
|
146
|
-
**Found a vulnerability in ClawArmor itself?** Please email `pinzasrojas@proton.me` before public disclosure.
|
|
147
|
-
|
|
148
|
-
---
|
|
149
|
-
|
|
150
|
-
## Installation
|
|
151
|
-
|
|
152
|
-
```bash
|
|
153
|
-
npm install -g clawarmor # requires Node.js 18+
|
|
154
|
-
clawarmor audit
|
|
155
|
-
```
|
|
156
|
-
|
|
157
|
-
Zero runtime npm dependencies. Node.js built-ins only (`net`, `http`, `os`, `fs`, `crypto`).
|
|
158
|
-
|
|
159
|
-
---
|
|
48
|
+
| Token/config exposure | File permission checks, config hardening | Full |
|
|
49
|
+
| Malicious skill supply chain | All skill files scanned โ not just SKILL.md | Full |
|
|
50
|
+
| Credential hygiene | Token age, rotation reminders, access scope | Full |
|
|
51
|
+
| Config drift | Baseline hashing, change detection on every startup | Full |
|
|
52
|
+
| Obfuscation | Base64 blobs, dynamic eval, encoded payloads | Partial |
|
|
53
|
+
| Prompt injection via SKILL.md | Instruction patterns, exfil, deception, system overrides | Full |
|
|
54
|
+
| Live gateway auth | WebSocket probe โ does server actually reject unauthenticated connections? | Full |
|
|
55
|
+
| CORS misconfiguration | OPTIONS probe with arbitrary origin | Full |
|
|
56
|
+
| Gateway exposure | TCP-connects to every non-loopback interface | Full |
|
|
57
|
+
| Runtime policy enforcement | Requires a runtime layer (SupraWall) | None |
|
|
58
|
+
|
|
59
|
+
## Philosophy
|
|
60
|
+
|
|
61
|
+
ClawArmor runs entirely on your machine โ no telemetry, no cloud, no accounts.
|
|
62
|
+
It has zero npm runtime dependencies, using only Node.js built-ins.
|
|
63
|
+
Every run prints exactly what files it reads and what network calls it makes before executing anything.
|
|
160
64
|
|
|
161
65
|
## License
|
|
162
66
|
|
|
163
|
-
MIT
|
|
67
|
+
MIT
|
package/cli.js
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
|
|
4
4
|
import { paint } from './lib/output/colors.js';
|
|
5
5
|
|
|
6
|
-
const VERSION = '2.
|
|
6
|
+
const VERSION = '2.1.0';
|
|
7
7
|
const GATEWAY_PORT_DEFAULT = 18789;
|
|
8
8
|
|
|
9
9
|
function isLocalhost(host) {
|
|
@@ -156,7 +156,7 @@ if (cmd === 'compare') {
|
|
|
156
156
|
|
|
157
157
|
if (cmd === 'fix') {
|
|
158
158
|
const { runFix } = await import('./lib/fix.js');
|
|
159
|
-
const fixFlags = { apply: process.argv.includes('--apply'), dryRun: process.argv.includes('--dry-run') };
|
|
159
|
+
const fixFlags = { apply: process.argv.includes('--apply'), dryRun: process.argv.includes('--dry-run'), force: process.argv.includes('--force') };
|
|
160
160
|
process.exit(await runFix(fixFlags));
|
|
161
161
|
}
|
|
162
162
|
|
|
@@ -202,6 +202,7 @@ if (cmd === 'harden') {
|
|
|
202
202
|
const hardenFlags = {
|
|
203
203
|
dryRun: args.includes('--dry-run'),
|
|
204
204
|
auto: args.includes('--auto'),
|
|
205
|
+
force: args.includes('--force'),
|
|
205
206
|
};
|
|
206
207
|
const { runHarden } = await import('./lib/harden.js');
|
|
207
208
|
process.exit(await runHarden(hardenFlags));
|
package/demo-preview.gif
ADDED
|
Binary file
|