leak-check

What This Skill Does

The leak-check skill is a specialized security diagnostic tool designed for OpenClaw users who frequently interact with AI agents using sensitive tokens or keys. Its primary function is to iterate through your stored JSONL session logs to identify instances where private credentials may have been inadvertently transmitted to external AI providers. By comparing the content of these logs against a user-defined pattern file, the agent distinguishes between actual potential leaks and benign configuration echoes. The skill excels at providing actionable security intelligence by pinpointing exactly which AI model provider received the data, allowing users to audit their session history and revoke credentials that have been compromised.

Installation

You can install this security utility directly from the central repository using the OpenClaw management CLI. Run the following command in your terminal: clawhub install openclaw/skills/skills/khaney64/leak-check. After installation, it is strongly recommended to set up your configuration file in the persistent directory at ~/.openclaw/credentials/leak-check.json. This ensures that your credential patterns are not wiped when you perform future skill updates via clawhub, maintaining a consistent security posture across agent cycles.

Use Cases

This skill is essential for developers, security researchers, and power users who handle API keys for services like Discord, GitHub, or email providers (such as Postmark). Use cases include conducting routine security audits of local agent activity, verifying that AI chat interactions do not contain sensitive environment variables, and establishing a baseline for secure credential management within the local OpenClaw environment. It is particularly useful for teams who need to ensure compliance with data handling policies when using LLMs for code generation and debugging.

Example Prompts

1. "Perform a security scan on my session logs to ensure no Discord or AWS credentials have been leaked."
2. "Run the leak-check tool and output the results in JSON format so I can pipe it into my reporting dashboard."
3. "Scan my recent session history and tell me if any files contain configuration echoes from my leak-check.json file."

Tips & Limitations

To minimize false positives, be aware of 'config echoes'—instances where the agent reads the pattern file itself during a session. If you see these reported, consider deleting the offending session files from ~/.openclaw/agents/main/sessions/. Furthermore, ensure your leak-check.json entries use partial fragments rather than full credentials to maintain your own security. Remember that this tool only scans what is locally stored; it cannot prevent real-time transmission of sensitive data during an active session. Practice good hygiene by avoiding pasting raw secrets into the agent interface whenever possible.