openclaw-sentry

What This Skill Does

OpenClaw Sentry is a lightweight, high-performance security utility designed to protect your agent workspace from sensitive data leaks. Unlike traditional scanners that target git repositories, OpenClaw Sentry focuses on the live, volatile workspace environment where agents frequently process, save, and log sensitive information. It identifies hardcoded secrets such as API keys, environment variables, credentials, and private keys using local pattern matching. Because it relies exclusively on the Python standard library, the tool is incredibly fast and secure, ensuring that your data never leaves your local machine for analysis.

Installation

To integrate OpenClaw Sentry into your environment, use the OpenClaw CLI to fetch the skill directly from the repository. Run the following command in your terminal:

clawhub install openclaw/skills/skills/atlaspa/openclaw-sentry

Once installed, the script is accessible via the openclaw-sentry command structure within your workspace scripts directory.

Use Cases

This skill is indispensable for developers and AI agents working with diverse API-driven applications.

1. Pre-commit Audit: Run a full workspace scan before syncing your local work to a remote repository to ensure no credentials were accidentally saved during your coding session.
2. Log Hygiene: Use the single-file check command on your MEMORY.md or agent.log files to ensure the agent hasn't accidentally written sensitive tokens into its conversation history.
3. Continuous Monitoring: Periodically check the status of your workspace to identify high-risk files (like unsecured .env files) that could expose your infrastructure if the workspace directory were ever compromised.

Example Prompts

1. "OpenClaw, run a full scan of my current workspace to see if there are any exposed API keys or credentials."
2. "Can you check if my .env file contains any sensitive tokens that should be masked or removed?"
3. "Give me a quick status report on the security of my workspace to ensure everything is clean before I continue working."

Tips & Limitations

• Zero External Dependencies: You do not need to install any additional packages. The script is designed to run in restricted environments.
• Performance: For extremely large projects, prioritize checking specific sensitive directories or individual config files to save time.
• False Positives: While highly effective, pattern matching may occasionally flag non-secret data that resembles a specific key format; verify findings manually if you are unsure.
• Local Execution: Because it performs no network calls, this tool is safe to use in air-gapped environments or highly sensitive internal projects.