Xpersona
Claim this agent
Agent DossierCLAWHUBSafety 84/100

Xpersona Agent

opena2a-security

Security hardening for OpenClaw. Audit your configuration, scan installed skills for malware, detect CVE-2026-25253, check credential exposure, and get actionable fix recommendations. Runs locally with no external API calls. --- name: opena2a-security description: Security hardening for OpenClaw. Audit your configuration, scan installed skills for malware, detect CVE-2026-25253, check credential exposure, and get actionable fix recommendations. Runs locally with no external API calls. version: 1.0.0 requires: bins: [node, npx] env: [] config: [] permissions: filesystem: - "~/.openclaw" network: [] exec: - npx hackmyagent tags: [security,

OpenClaw · self-declared
Trust evidence available
View on ClawHub
clawhub skill install skills:abdelsfane:opena2a-security

Overall rank

#62

Adoption

No public adoption signal

Trust

Unknown

Freshness

Feb 25, 2026

Freshness

Last checked Feb 25, 2026

Best For

opena2a-security is best for your, ask, installed workflows where OpenClaw compatibility matters.

Not Ideal For

Contract metadata is missing or unavailable for deterministic execution.

Evidence Sources Checked

editorial-content, CLAWHUB, runtime-metrics, public facts pack

OverviewEvidence & TimelineArtifacts & DocsAPI & ReliabilityMedia & RelatedMachine Appendix

Overview

Key links, install path, reliability highlights, and the shortest practical read before diving into the crawl record.

Verifiededitorial-content

Overview

Executive Summary

Security hardening for OpenClaw. Audit your configuration, scan installed skills for malware, detect CVE-2026-25253, check credential exposure, and get actionable fix recommendations. Runs locally with no external API calls. --- name: opena2a-security description: Security hardening for OpenClaw. Audit your configuration, scan installed skills for malware, detect CVE-2026-25253, check credential exposure, and get actionable fix recommendations. Runs locally with no external API calls. version: 1.0.0 requires: bins: [node, npx] env: [] config: [] permissions: filesystem: - "~/.openclaw" network: [] exec: - npx hackmyagent tags: [security, Capability contract not published. No trust telemetry is available yet. Last updated 4/15/2026.

No verified compatibility signals

Trust score

Unknown

Compatibility

OpenClaw

Freshness

Feb 25, 2026

Vendor

Openclaw

Artifacts

0

Benchmarks

0

Last release

Unpublished

Install & run

Setup Snapshot

clawhub skill install skills:abdelsfane:opena2a-security
  1. 1

    Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.

  2. 2

    Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Evidence & Timeline

Public facts grouped by evidence type, plus release and crawl events with provenance and freshness.

Verifiededitorial-content

Public facts

Evidence Ledger

Vendor (1)

Vendor

Openclaw

profilemedium
Observed Apr 15, 2026Source linkProvenance
Compatibility (1)

Protocol compatibility

OpenClaw

contractmedium
Observed Apr 15, 2026Source linkProvenance
Security (1)

Handshake status

UNKNOWN

trustmedium
Observed unknownSource linkProvenance
Integration (1)

Crawlable docs

6 indexed pages on the official domain

search_documentmedium
Observed Apr 15, 2026Source linkProvenance

Events

Release & Crawl Timeline

Docs Update

Docs refreshed: Sign in to GitHub · GitHub

search_documentmedium

Fresh crawlable documentation was indexed for the official domain.

Observed Apr 15, 2026

Artifacts & Docs

Parameters, dependencies, examples, extracted files, editorial overview, and the complete README when available.

Self-declaredCLAWHUB

Captured outputs

Artifacts Archive

Extracted files

0

Examples

6

Snippets

0

Languages

typescript

Parameters

Executable Examples

text

"Run a security audit on my OpenClaw setup"

text

"Is my OpenClaw configuration secure?"

text

"Check my OpenClaw for known vulnerabilities"

text

"Am I vulnerable to CVE-2026-25253?"

text

"Check for the OpenClaw WebSocket vulnerability"

text

"Scan my installed skills for malware"

Editorial read

Docs & README

Docs source

CLAWHUB

Editorial quality

ready

Security hardening for OpenClaw. Audit your configuration, scan installed skills for malware, detect CVE-2026-25253, check credential exposure, and get actionable fix recommendations. Runs locally with no external API calls. --- name: opena2a-security description: Security hardening for OpenClaw. Audit your configuration, scan installed skills for malware, detect CVE-2026-25253, check credential exposure, and get actionable fix recommendations. Runs locally with no external API calls. version: 1.0.0 requires: bins: [node, npx] env: [] config: [] permissions: filesystem: - "~/.openclaw" network: [] exec: - npx hackmyagent tags: [security,

Full README

name: opena2a-security description: Security hardening for OpenClaw. Audit your configuration, scan installed skills for malware, detect CVE-2026-25253, check credential exposure, and get actionable fix recommendations. Runs locally with no external API calls. version: 1.0.0 requires: bins: [node, npx] env: [] config: [] permissions: filesystem: - "~/.openclaw" network: [] exec: - npx hackmyagent tags: [security, audit, hardening, vulnerability-scanner, cve-detection, credential-protection, supply-chain]

OpenA2A Security for OpenClaw

Security auditing and hardening for OpenClaw installations. Scan your configuration, detect known vulnerabilities, audit installed skills for malicious code, and get specific remediation steps.

This skill runs entirely locally. No data leaves your machine. No API keys required.

What You Can Ask

Quick Security Check

Ask for a fast overview of your security posture:

"Run a security audit on my OpenClaw setup"

"Is my OpenClaw configuration secure?"

"Check my OpenClaw for known vulnerabilities"

CVE-2026-25253 Detection

Check if your OpenClaw instance is vulnerable to the WebSocket hijack RCE (CVSS 8.8):

"Am I vulnerable to CVE-2026-25253?"

"Check for the OpenClaw WebSocket vulnerability"

Skill Scanning

Scan installed skills for malicious code patterns (command injection, data exfiltration, obfuscated payloads, crypto mining):

"Scan my installed skills for malware"

"Is the weather-bot skill safe?"

"Check all my skills for security issues"

Credential Audit

Check for exposed credentials, weak file permissions, and plaintext storage:

"Are my API keys and tokens stored securely?"

"Check my credential file permissions"

Configuration Hardening

Get specific recommendations for hardening your OpenClaw config:

"How do I harden my OpenClaw configuration?"

"What security settings should I change?"

How It Works

This skill uses HackMyAgent, an open-source security scanner with 47 OpenClaw-specific checks across these categories:

Skill Security (6 checks)

| Check | What It Detects | |-------|-----------------| | SKILL-001 | Command injection via shell execution | | SKILL-002 | Dynamic code execution (eval, Function, vm) | | SKILL-003 | Data exfiltration to external endpoints | | SKILL-004 | Obfuscated code (base64, hex, charcode) | | SKILL-005 | Crypto mining indicators | | SKILL-006 | Path traversal outside skill directory |

Credential Security (4 checks)

| Check | What It Detects | |-------|-----------------| | CRED-001 | Credentials exposed via gateway API | | CRED-002 | Credential files with world-readable permissions | | CRED-003 | Plaintext credential storage without encryption | | CRED-004 | Timing side-channel in authentication |

Gateway Security (4 checks)

| Check | What It Detects | |-------|-----------------| | GW-001 | Missing rate limiting on endpoints | | GW-002 | SSRF-vulnerable URL fetch handlers | | GW-003 | Missing or incomplete security headers | | GW-004 | CVE-2026-25253 WebSocket hijack vulnerability |

Supply Chain (4 checks)

| Check | What It Detects | |-------|-----------------| | SC-001 | npm install without --ignore-scripts | | SC-002 | Unpinned or pre-release dependencies | | SC-003 | Missing skill signing or hash verification | | SC-004 | Known ClawHavoc malicious skill patterns |

Running Scans

When asked to perform a scan, run the following commands:

Full Security Audit

npx hackmyagent secure ~/.openclaw

Scan a Specific Skill

npx hackmyagent scan --skill <skill-name>

CVE Detection Only

npx hackmyagent scan --cve ~/.openclaw

Configuration Audit

npx hackmyagent audit ~/.openclaw/config.json5

Generate Security Report

npx hackmyagent secure ~/.openclaw --format html --output security-report.html

Output formats: text, json, sarif, html, asp

Security Recommendations

When providing recommendations, reference these priority levels:

Do Immediately

  1. Update OpenClaw to the latest version (patches CVE-2026-25253, credential redaction, timing-safe auth, lifecycle script blocking)
  2. Run npx hackmyagent secure to identify your current exposure
  3. Review installed skills — remove any you do not actively use
  4. Check file permissions — credential files should be 0600, not world-readable

Configuration Changes

Recommend these config.json5 changes when relevant:

  • Set gateway.auth to a strong token (32+ characters, randomly generated)
  • Set gateway.host to 127.0.0.1 (loopback only) unless remote access is required
  • Disable unused channel integrations
  • Set plugins.allowUnsafe to false
  • Enable Docker sandbox mode when available

For Skill Publishers

  • Do not hardcode API keys in skill code — use environment variables
  • Declare minimum required permissions in SKILL.md frontmatter
  • Do not use eval(), Function(), or child_process.exec() with user input
  • Do not fetch external URLs at install time

Interpreting Results

When presenting scan results to the user:

  • CRITICAL findings require immediate action — explain the specific risk and provide the fix command
  • HIGH findings should be addressed before deploying to production
  • MEDIUM findings are defense-in-depth improvements
  • LOW findings are best-practice recommendations

Always explain findings in plain language. Not every user is a security expert. State what the risk is, who could exploit it, and exactly how to fix it.

Background

This skill is built by OpenA2A (opena2a.org), the team behind 6 merged security patches in OpenClaw main:

| PR | Fix | |----|-----| | #9806 | Skill code safety scanner (19 detection rules, +1,721 lines) | | #9858 | Credential redaction for gateway WebSocket responses | | #10525 | Path traversal fix in A2UI file serving | | #10527 | Timing-safe comparison for hook token auth | | #10528 | Blocked npm lifecycle scripts during plugin install | | #10529 | File permission enforcement on WhatsApp credentials |

Scanner: https://www.npmjs.com/package/hackmyagent Source: https://github.com/opena2a-org/hackmyagent Threat model: https://github.com/openclaw/trust/pull/7

API & Reliability

Machine endpoints, contract coverage, trust signals, runtime metrics, benchmarks, and guardrails for agent-to-agent use.

MissingCLAWHUB

Machine interfaces

Contract & API

Endpoints

Dossier APISnapshot APIContract APITrust API

Contract coverage

Status

missing

Auth

None

Streaming

No

Data region

Unspecified

Protocol support

OpenClaw: self-declared

Requires: none

Forbidden: none

Guardrails

Operational confidence: low

No positive guardrails captured.
Invocation examples
curl -s "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/snapshot"
curl -s "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/contract"
curl -s "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/trust"

Operational fit

Reliability & Benchmarks

Trust signals

Handshake

UNKNOWN

Confidence

unknown

Attempts 30d

unknown

Fallback rate

unknown

Runtime metrics

Observed P50

unknown

Observed P95

unknown

Rate limit

unknown

Estimated cost

unknown

Do not use if

Contract metadata is missing or unavailable for deterministic execution.
No benchmark suites or observed failure patterns are available.

Media & Related

Public screenshots, demo and owner links, plus neighboring agents from the same ecosystem for shortlist building.

Missingno-media

Visual context

Media & Demo

No screenshots, media assets, or demo links are available.

Comparison set

Related Agents

GITHUB_REPOSactivepieces

Rank

70

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

Traction

No public download signal

Freshness

Updated 2d ago

OPENCLAW
GITHUB_REPOScherry-studio

Rank

70

AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs

Traction

No public download signal

Freshness

Updated 6d ago

MCPOPENCLAW
GITHUB_REPOSAionUi

Rank

70

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

Traction

No public download signal

Freshness

Updated 6d ago

MCPOPENCLAW
GITHUB_REPOSCopilotKit

Rank

70

The Frontend for Agents & Generative UI. React + Angular

Traction

No public download signal

Freshness

Updated 23d ago

OPENCLAW
Agent hubMore from this sourceOpenClaw agents

Machine Appendix

Raw contract, invocation, trust, capability, facts, and change-event payloads for machine-side inspection.

MissingCLAWHUB

Contract JSON

{
  "contractStatus": "missing",
  "authModes": [],
  "requires": [],
  "forbidden": [],
  "supportsMcp": false,
  "supportsA2a": false,
  "supportsStreaming": false,
  "inputSchemaRef": null,
  "outputSchemaRef": null,
  "dataRegion": null,
  "contractUpdatedAt": null,
  "sourceUpdatedAt": null,
  "freshnessSeconds": null
}

Invocation Guide

{
  "preferredApi": {
    "snapshotUrl": "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/snapshot",
    "contractUrl": "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/contract",
    "trustUrl": "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/trust"
  },
  "curlExamples": [
    "curl -s \"https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/snapshot\"",
    "curl -s \"https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/contract\"",
    "curl -s \"https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/trust\""
  ],
  "jsonRequestTemplate": {
    "query": "summarize this repo",
    "constraints": {
      "maxLatencyMs": 2000,
      "protocolPreference": [
        "OPENCLEW"
      ]
    }
  },
  "jsonResponseTemplate": {
    "ok": true,
    "result": {
      "summary": "...",
      "confidence": 0.9
    },
    "meta": {
      "source": "CLAWHUB",
      "generatedAt": "2026-04-17T02:54:02.921Z"
    }
  },
  "retryPolicy": {
    "maxAttempts": 3,
    "backoffMs": [
      500,
      1500,
      3500
    ],
    "retryableConditions": [
      "HTTP_429",
      "HTTP_503",
      "NETWORK_TIMEOUT"
    ]
  }
}

Trust JSON

{
  "status": "unavailable",
  "handshakeStatus": "UNKNOWN",
  "verificationFreshnessHours": null,
  "reputationScore": null,
  "p95LatencyMs": null,
  "successRate30d": null,
  "fallbackRate": null,
  "attempts30d": null,
  "trustUpdatedAt": null,
  "trustConfidence": "unknown",
  "sourceUpdatedAt": null,
  "freshnessSeconds": null
}

Capability Matrix

{
  "rows": [
    {
      "key": "OPENCLEW",
      "type": "protocol",
      "support": "unknown",
      "confidenceSource": "profile",
      "notes": "Listed on profile"
    },
    {
      "key": "your",
      "type": "capability",
      "support": "supported",
      "confidenceSource": "profile",
      "notes": "Declared in agent profile metadata"
    },
    {
      "key": "ask",
      "type": "capability",
      "support": "supported",
      "confidenceSource": "profile",
      "notes": "Declared in agent profile metadata"
    },
    {
      "key": "installed",
      "type": "capability",
      "support": "supported",
      "confidenceSource": "profile",
      "notes": "Declared in agent profile metadata"
    },
    {
      "key": "my",
      "type": "capability",
      "support": "supported",
      "confidenceSource": "profile",
      "notes": "Declared in agent profile metadata"
    },
    {
      "key": "a",
      "type": "capability",
      "support": "supported",
      "confidenceSource": "profile",
      "notes": "Declared in agent profile metadata"
    },
    {
      "key": "results",
      "type": "capability",
      "support": "supported",
      "confidenceSource": "profile",
      "notes": "Declared in agent profile metadata"
    }
  ],
  "flattenedTokens": "protocol:OPENCLEW|unknown|profile capability:your|supported|profile capability:ask|supported|profile capability:installed|supported|profile capability:my|supported|profile capability:a|supported|profile capability:results|supported|profile"
}

Facts JSON

[
  {
    "factKey": "docs_crawl",
    "category": "integration",
    "label": "Crawlable docs",
    "value": "6 indexed pages on the official domain",
    "href": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fopenclaw%2Fskills%2Ftree%2Fmain%2Fskills%2Fasleep123%2Fcaldav-calendar",
    "sourceUrl": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fopenclaw%2Fskills%2Ftree%2Fmain%2Fskills%2Fasleep123%2Fcaldav-calendar",
    "sourceType": "search_document",
    "confidence": "medium",
    "observedAt": "2026-04-15T05:03:46.393Z",
    "isPublic": true
  },
  {
    "factKey": "vendor",
    "category": "vendor",
    "label": "Vendor",
    "value": "Openclaw",
    "href": "https://github.com/openclaw/skills/tree/main/skills/abdelsfane/opena2a-security",
    "sourceUrl": "https://github.com/openclaw/skills/tree/main/skills/abdelsfane/opena2a-security",
    "sourceType": "profile",
    "confidence": "medium",
    "observedAt": "2026-04-15T00:45:39.800Z",
    "isPublic": true
  },
  {
    "factKey": "protocols",
    "category": "compatibility",
    "label": "Protocol compatibility",
    "value": "OpenClaw",
    "href": "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/contract",
    "sourceUrl": "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/contract",
    "sourceType": "contract",
    "confidence": "medium",
    "observedAt": "2026-04-15T00:45:39.800Z",
    "isPublic": true
  },
  {
    "factKey": "handshake_status",
    "category": "security",
    "label": "Handshake status",
    "value": "UNKNOWN",
    "href": "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/trust",
    "sourceUrl": "https://xpersona.co/api/v1/agents/clawhub-skills-abdelsfane-opena2a-security/trust",
    "sourceType": "trust",
    "confidence": "medium",
    "observedAt": null,
    "isPublic": true
  }
]

Change Events JSON

[
  {
    "eventType": "docs_update",
    "title": "Docs refreshed: Sign in to GitHub · GitHub",
    "description": "Fresh crawlable documentation was indexed for the official domain.",
    "href": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fopenclaw%2Fskills%2Ftree%2Fmain%2Fskills%2Fasleep123%2Fcaldav-calendar",
    "sourceUrl": "https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fopenclaw%2Fskills%2Ftree%2Fmain%2Fskills%2Fasleep123%2Fcaldav-calendar",
    "sourceType": "search_document",
    "confidence": "medium",
    "observedAt": "2026-04-15T05:03:46.393Z",
    "isPublic": true
  }
]

Sponsored

Ads related to opena2a-security and adjacent AI workflows.