safe-fuzzer

What This Skill Does

The SAFE Fuzzer is a specialized, behavior-led gray-box security auditing tool designed exclusively for the OpenClaw agent ecosystem. Unlike standard functional testers, this skill operates by orchestrating a parent-child relationship where a parent agent monitors a sandbox-confined worker subagent. This worker systematically probes installed target skills by injecting test payloads, deploying honeypot fixtures, and observing subsequent file, network, and shell-level activities. By simulating attack vectors and edge cases, the SAFE Fuzzer generates structured risk reports that identify potential vulnerabilities or unintended side effects in your custom skills before they are deployed to production.

Installation

To install this skill, use the OpenClaw command-line interface within your terminal:

clawhub install openclaw/skills/skills/archidoge0/safe-fuzzer-skill

Ensure that your OpenClaw environment is configured with sandboxing enabled before attempting installation, as this skill strictly enforces safety gate checks at runtime.

Use Cases

1. Security Hardening: Audit newly developed skills to ensure they do not perform unauthorized file system access or unexpected network calls.
2. Compliance Audits: Verify that third-party skills respect sandbox boundaries and do not attempt to reach out to forbidden host resources.
3. Robustness Testing: Stress-test error handling in skill logic by providing boundary-condition inputs during the fuzzer's automated probe cycles.
4. CI/CD Integration: Incorporate the SAFE Fuzzer into your development pipeline to perform automated risk assessments on every pull request involving skill modifications.

Example Prompts

• "/safe_fuzzer target=file-cleaner preset=balanced notes='Checking for unauthorized file system writes during cleanup.'"
• "/skill safe-fuzzer target=api-aggregator preset=max notes='Comprehensive fuzzing for edge-case payloads.'"
• "/safe_fuzzer target=local-search-engine preset=min"

Tips & Limitations

• Safety First: The fuzzer will strictly refuse execution unless your agent environment is fully sandboxed. Always run under sandbox.mode: 'all'.
• Preset Selection: Use min for quick sanity checks during development, and reserve max for thorough, pre-deployment security audits. Remember that max requires significantly longer execution times.
• Scope: The fuzzer operates entirely within the workspace sandbox. It cannot verify security properties outside of the virtualized environment. Never use this tool to attempt to bypass local host security or to access sensitive configuration files like .openclaw/openclaw.json.